Privacy Policy Website - Cardoen

For DATOS NV, hereinafter “Cardoen”, the protection of your personal data is of the utmost importance. In this privacy policy we describe the measures taken to guarantee the protection of your personal data in accordance with the European General Data Protection Regulation (GDPR). With this explanation we wish to inform you clearly how we at Cardoen look after your personal data, which personal data we collect from you and why Cardoen does so. This privacy policy applies to all services offered by Cardoen, such as newsletters, online reservations, online purchases, servicing, contact requests via the website, the purchase of cars through our branches, financing applications, insurance applications and promotions.

DATOS NV (Cardoen), with registered office at Boomsesteenweg 958 – 2610 Antwerp and registered under VAT number BE 0425.303.824, is the controller for the processing of personal data in the various processes and systems that apply or are in use within Cardoen.

As controller, Cardoen takes the necessary technical and organisational measures to protect your personal data. These measures apply to all systems, employees and processes that make up Cardoen's information systems.

Cardoen sells new and second-hand passenger cars through its website and its branches. In addition to selling cars, Cardoen offers related services, such as taking over your current car, maintenance and repairs, maintenance contracts (ServicePlus), extended warranty, and applying for or acting as an intermediary for financing and insurance. Cardoen is part of Aramis Group, a European group specialising in the online sale of second-hand cars, with its head office in France.

“Personal data” means any information relating to an identified or identifiable natural person

Cardoen collects and processes various personal data relating to you in connection with reserving or purchasing a car via our website or at one of our branches. If you complete a contact request on our website, Cardoen will also process your personal data. When your car is serviced or when we take over your old car, Cardoen will likewise process personal data about you.

3.1. Cardoen processes data that you provide to us; this concerns the following personal data (non-exhaustive): ● Personal identification data: name, date of birth, address, e-mail, telephone number, mobile number, language, gender, national register number, copy of identity card, copy of driving licence; ● Business-related personal data: company name, company address, legal form, company number; ● Financial data (when applying for financing): bank account number, invoicing and payment data and, in the case of a financing application, information about your income such as payslips; ● Technical data: chassis number, registration number, mileage readings, maintenance and repair history; ● Electronic identification data: IP addresses, cookies; ● Communication data: the content of your e-mails, forms and conversations with chatbot Joe, telephone calls with our customer service, including automatically generated summaries thereof; ● Marketing data: your preferences, your subscription to and unsubscription from our newsletter and your interaction with our e-mails, such as opening and clicking, and the promotional messages you receive from us by SMS; ● Camera images: when you visit one of our branches;

3.2. National register number and identity documents: Cardoen processes your national register number only where a legal provision permits or requires this, in particular for the registration of your car with the Vehicle Registration Service (DIV) and for your financing application with the lender. When you purchase a car, we ask for your identity card in order to verify your identity. We only make a copy or scan where this is necessary for our purpose. The scan or copy of your identity card and any salary documents are automatically deleted after delivery of your car.

3.3. Special categories of personal data: Cardoen does not collect or process special categories of personal data, such as data on your race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, or sexual behaviour or sexual orientation. Should we nevertheless need to process such data, we will only do so with your explicit consent or where this is necessary for the establishment, exercise or defence of a legal claim.

We process your personal data only for specified purposes and always on a legal basis set out in Article 6 of the General Data Protection Regulation (GDPR): the performance of a contract or pre-contractual measures at your request, a legal obligation, our legitimate interest, or your consent. Where we rely on our legitimate interest, we have assessed in advance that this interest outweighs the impact on your privacy. You may object to such processing at any time (see section 13).

All personal data are used only for the following purposes:

• Reserving and purchasing a car via our website or at a branch, including drawing up a quotation
• Applying for financing when purchasing a car
• Applying for insurance when purchasing a car
• Cardoen taking over your old car
• Invoicing
• Maintenance and repairs of the car, maintenance contracts (ServicePlus), warranty, extended warranty
• Answering questions, contact requests and complaints via the website, e-mail, telephone or chatbot Joe
• Automatic summaries of telephone calls with our customer service
• Offers and news about similar products and services to existing customers (e-mail, SMS, social media)
• Newsletter and commercial messages to people who are not (yet) customers
• Satisfaction surveys (and invitations to leave a review)
• Camera surveillance at our branches

We obtain your personal data first and foremost directly from you: when you visit a branch, call or e-mail us, complete a form on our website, chat with chatbot Joe, subscribe to our newsletter or take part in a promotion or an open day.

Through cookies and similar technologies we also collect data about your use of our website. You will find more information in our cookie policy.

The data are kept for as long as is necessary to provide our services and fulfil our purposes, but for a maximum period of 10 years, after which they are deleted or anonymised. As a data subject you may also ask for your data to be deleted sooner, provided that the statutory retention periods are not breached and subject to the resolution of any disputes.

Cardoen never sells or rents out your personal data. We share your data only where this is necessary for the purposes.

Processors are bound to Cardoen by a data processing agreement. They may use your data only in accordance with our instructions and never for their own purposes, and must treat your data confidentially and securely. Cardoen does not share your personal data with third parties, except in the following cases:

• You give us written consent to do so;
• We are legally obliged to do so;
• The data are requested in the context of a judicial investigation;

We process your data as far as possible within the European Economic Area (EEA). Some service providers are, however, established outside the EEA or work with subcontractors outside the EEA, for example in the United States. This is the case, among others, for the advertising services of Google and Microsoft. In such cases we ensure appropriate safeguards, such as an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework for certified US companies) or the European Commission's standard contractual clauses.

In order to be able to process your personal data, we grant our employees access to your personal data. We guarantee a similar level of protection by laying down a contractual agreement between Cardoen and the employee. Employees are required to treat the data discreetly and only have access to the data they need to perform their job. Cardoen's employees are required to follow our GDPR awareness training and to keep their GDPR knowledge up to date.

Cardoen does not take decisions about you based solely on automated processing which produce legal effects. Nor does chatbot Joe take such decisions.

We do, however, use profiling for marketing purposes. On the basis of your purchases, your car, your maintenance history and your interaction with our e-mails, we divide customers into segments so that we can send you relevant offers. With your consent, we also show you advertisements based on your browsing behaviour on our website by means of cookies. You may object to profiling for direct marketing at any time. When you apply for financing, the lender assesses your creditworthiness. That assessment is carried out by the lender and not by Cardoen. You will find more information in the lender's privacy statement.

Cardoen has a company page on LinkedIn, Facebook, Instagram and YouTube, among others, to inform you about our services, current topics, events, working at Cardoen, and so on. You are free to follow Cardoen or not via these social media channels.

Since May 2026 you can use Joe on our website, a chatbot based on artificial intelligence (AI). Joe answers questions about our range and our services. You are not speaking to an employee, but to an automated system. Joe's answers are informative and not binding.

Joe is currently in a test phase. Its operation and functionalities may therefore still change, and conversations may be reviewed in order to improve the quality of the answers. When Joe leaves the test phase or the processing changes substantially, we will amend this privacy policy. Joe is developed and technically managed by Aramis Group, established in France, of which Cardoen is also part.

When you use Joe, we process the content of your messages and the data you share in them, such as your name, contact details or preferences for a car, as well as technical data such as your IP address, session data and the time of the conversation. We ask you not to share sensitive data or copies of identity documents via Joe.

We use this data to answer your questions. During the test phase we also use the data to improve how Joe works (legitimate interest). For the technical operation, Aramis relies on Microsoft. Joe uses the Azure OpenAI service, with the processing taking place within Microsoft's European data zone. Microsoft acts as a sub-processor in this respect. Your conversations are not used to train generally available AI models. In principle, your conversations are not processed outside the European Economic Area. Should this exceptionally be the case, for example for technical support, the safeguards set out in section 7 apply.

Conversations with Joe are kept for a maximum of three months. If your conversation leads to a request or a contact, the relevant data are included in your file and the retention periods set out in section 6 apply. Joe does not take decisions about you with legal effects. To exercise your rights, you can contact [email protected].

Your personal data are considered strictly confidential. We have therefore implemented the necessary technical and organisational measures to guarantee the security of your personal data.

Cardoen does everything possible to secure its network thoroughly against unauthorised access and to safeguard the confidentiality of the personal data and the business data of its users. Cardoen's website uses a secure (TLS) connection to ensure that your personal data do not fall into the wrong hands. Encryption of information during storage, firewalls and the like are some of the security measures Cardoen has implemented in its information systems.

At organisational level, we have a privacy statement and clear responsibilities and powers. The necessary processes and procedures are also in place to implement and monitor this policy optimally.

As a data subject you have various rights, which are set out in the GDPR and include, among others:

13.1 Right of access: You have the right to be informed free of charge at any time of your personal data and of the use we make of your personal data.

13.2 Right to rectification, erasure and restriction: You always have the right to ask us to correct or complete your personal data. You may also ask for your personal data to be erased, but only if Cardoen no longer needs this personal data for the purposes for which we initially collected it. If legal obligations or administrative or judicial orders prevent us from erasing your personal data, we cannot comply with your request, but you will of course be informed of this. You may also ask us to restrict the processing of your personal data.

13.3 Right to object: You always have the right to object to the use of personal data for direct marketing purposes. In such a case you do not have to give any reasons.

13.4 Right to data portability: You have the right to obtain the personal data processed by Cardoen in a structured, commonly used and machine-readable format and/or to transfer it to other controllers.

13.5 Right to withdraw consent: Insofar as the processing is based on your prior consent, you have the right to withdraw that consent. This consent can be withdrawn at any time, without giving reasons and free of charge, for example by clicking the unsubscribe link provided at the bottom of every promotional e-mail and/or newsletter.

You can exercise your rights by sending an e-mail to [email protected] or a letter to Cardoen, attn. the Data Protection Officer, Boomsesteenweg 958, 2610 Antwerp. Please state which right you wish to exercise and how we can reach you.

We will respond within one month of receiving your request. In the case of complex or numerous requests, that period may be extended by two months; we will inform you of this within the first month. Only where we have reasonable doubts about your identity will we ask you for additional information. Please do not send us a copy of your identity card unless we ask for it. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive. Where we cannot comply with your request, we will tell you why.

At our branches we use camera surveillance to protect the safety of employees, customers and visitors, to prevent and detect theft, vandalism and fraud, and to be able to investigate incidents. This processing is based on our legitimate interest and takes place in accordance with the Act of 21 March 2007 regulating the installation and use of surveillance cameras (the Camera Act). The presence of cameras is indicated by a pictogram at the entrance.

The images are kept for a maximum of one month, unless they are needed as evidence of an offence, damage or nuisance, or to identify a perpetrator, witness or victim. In that case they may be provided to the police or the judicial authorities. Only authorised persons have access to the images. For questions or to exercise your rights, you can always contact us at the contact address provided.

Cardoen has a Data Protection Officer (DPO). The Data Protection Officer assists Cardoen with processing activities involving personal data. We do our utmost to handle your personal data correctly. However, if you are not satisfied with our working method, or if you have questions for our DPO, please contact us at the following e-mail address: [email protected]

You can also lodge a complaint at any time to the Data Protection Authority (DPA):

Data Protection Authority 35 Drukpersstraat, 1000 Brussels Tel: +32 (0)2 274 48 00 E-mail: [email protected]

https://www.gegevensbeschermingsautoriteit.be/burger/acties/klacht-indienen

Cardoen may amend or supplement this statement if we deem it necessary. We encourage you to review this statement periodically so that you remain informed about how we process and protect your personal data.

This privacy policy was last amended in September 2026. The Dutch-language text of the privacy policy on the website prevails over translations into other languages.