Privacy Policy
Privacy Policy
Last updated: 16 June 2026
This Privacy Policy explains how C.A.R.S (Ireland) Ltd ("CARS.ie", "we", "us", "our") collects, uses, shares and protects your personal data when you use the cars.ie website and related services, and the rights you have under data protection law.
It should be read alongside our Cookie Policy, which explains the cookies and similar technologies we use, and our Terms and Conditions, which govern your use of the site.
We are committed to handling your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Irish Data Protection Act 2018, and the ePrivacy Regulations (S.I. 336 of 2011).
1. Who we are
CARS.ie is operated by C.A.R.S (Ireland) Ltd, a company registered in Ireland under company number 150050, with its registered office at:
Keltar, Ballynoe, Whites Cross, Co. Cork, T23 K290, Ireland
For the personal data described in this policy, C.A.R.S (Ireland) Ltd is the data controller.
You can contact us about this policy or about your personal data at:
- Email: [email protected]
- Data Protection Officer: [email protected]
- Post: Data Protection, C.A.R.S (Ireland) Ltd, Keltar, Ballynoe, Whites Cross, Co. Cork, T23 K290, Ireland
2. Scope of this policy
This policy applies to personal data we process about:
- visitors who browse the site without an account;
- registered users (private sellers and buyers);
- business users (dealers) and their authorised staff;
- people who contact us by email, web form or phone;
- people whose data appears within a listing or a message (for example, where a seller includes their own contact details).
It does not apply to the practices of third parties whose websites or services you reach through links on CARS.ie. Those organisations are independent controllers with their own privacy policies.
3. The personal data we collect
Depending on how you use the site, we may collect the following categories of personal data.
Account data — name, email address, password (stored in hashed form), and, for dealers, business name, trading address, contact details and trader status.
Listing data — the content you submit when advertising a vehicle, including text, images, asking price and any contact details you choose to include. Note that a vehicle registration number, where you choose to provide it, may constitute personal data when it can be linked to an identifiable individual.
Messaging data — the content of messages you send to, or receive from, other users through the site's messaging function.
Transaction data — records of paid listings and subscriptions, including amount, date, the listing concerned and a limited, masked record of the payment method. We do not receive or store your full card details (see §8).
Usage and technical data — IP address, device and browser type, operating system, referring URL, pages and listings viewed, searches run, and similar information collected through cookies and server logs. See our Cookie Policy.
Communications data — the content of, and metadata about, any correspondence you have with us (support requests, complaints, reports of illegal or objectionable content).
Chatbot data — where you use the on-site assistant, the questions you submit and the related search context. These are processed to generate a response (see §8, "AI and automated features").
We do not intentionally collect special categories of personal data (such as health, ethnicity or political opinions). Please do not include such information in listings or messages.
4. How we collect your personal data
We collect personal data:
- directly from you — when you register, create or edit a listing, message another user, pay for a service, use the chatbot, or contact us;
- automatically — through cookies, server logs and similar technologies as you use the site;
- from third parties — for example, our payment processor confirms the outcome of a transaction, and fraud- and bot-prevention services help us protect the site.
5. Why we use your personal data, and our lawful basis
Under the GDPR we must have a lawful basis for each use of your personal data. The table below sets out our purposes and the corresponding lawful basis under Article 6.
| Purpose | Personal data used | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Create and administer your account | Account data | Contract — Art. 6(1)(b) |
| Publish and display your listings | Listing data | Contract — Art. 6(1)(b) |
| Enable messaging between users | Messaging data, account data | Contract — Art. 6(1)(b) |
| Process payments for listings and subscriptions | Transaction data | Contract — Art. 6(1)(b) |
| Keep accounting and tax records | Transaction data | Legal obligation — Art. 6(1)(c) |
| Secure the site; prevent fraud, abuse and bot activity | Technical data, account data | Legitimate interests — Art. 6(1)(f) (keeping the service secure) |
| Measure and improve site performance (analytics) | Usage and technical data | Consent — Art. 6(1)(a) (via the cookie banner) |
| Show personalised advertising / retargeting | Usage and technical data | Consent — Art. 6(1)(a) (via the cookie banner) |
| Send service messages (e.g. changes to terms, security notices) | Account data | Contract / Legal obligation |
| Send marketing emails about our services | Account data | Consent — Art. 6(1)(a), or legitimate interests for existing customers under the ePrivacy "soft opt-in", subject to your right to object |
| Respond to your queries, complaints and content reports | Communications data | Legitimate interests — Art. 6(1)(f) (running the service) / Legal obligation where applicable |
| Operate the on-site chatbot | Chatbot data | Legitimate interests — Art. 6(1)(f) (providing the feature you requested) |
| Comply with legal and regulatory obligations, and respond to lawful requests | Any relevant data | Legal obligation — Art. 6(1)(c) |
| Establish, exercise or defend legal claims | Any relevant data | Legitimate interests — Art. 6(1)(f) |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may ask us for more detail on that assessment, and you have the right to object (see §11).
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
6. Marketing and electronic communications
We will only send you marketing emails where you have consented, or where you are an existing customer and we are contacting you about similar services under the ePrivacy "soft opt-in", which we apply subject to your right to object at any time.
Every marketing message contains an unsubscribe link, and you can also opt out at any time by emailing [email protected] or updating your account preferences. Withdrawing marketing consent does not stop essential service messages (for example, security alerts or changes to these terms), which we must send to operate your account.
Advertising shown to you on the site, and any retargeting of CARS.ie adverts on other websites, is governed by your choices in the cookie banner — see our Cookie Policy.
7. Cookies and similar technologies
We use cookies and similar technologies to operate the site, remember your preferences, measure performance and, where you consent, support advertising. Strictly necessary cookies are set without consent; all other categories are set only after you consent through the cookie banner. Full details, including a complete inventory and how to change your choices, are in our Cookie Policy.
8. Who we share your personal data with
We do not sell your personal data. We share it only as described below.
Other users. Listings are public and visible to anyone. Any contact details or information you include in a listing or message will be visible to the users you share them with. By submitting a paid listing you acknowledge that, where required by law, we may be obliged to disclose your identity to a recipient of that listing or to a competent authority.
Service providers (processors). We use trusted third parties to run the site on our behalf — including hosting and content-delivery (our infrastructure provider and Cloudflare), our payment processor [PAYMENT_PROCESSOR], email delivery, security and bot-prevention (including Google reCAPTCHA), and analytics (Google Analytics, where you consent). These providers act on our documented instructions under written data-processing agreements and may only use your data to provide the service to us.
Payment processor. When you pay for a service you are directed to [PAYMENT_PROCESSOR]'s secure platform. The processor acts as an independent controller for your full payment-card data; we receive only confirmation of the transaction and limited metadata (timestamp, amount, masked card number). We never see or store your full card number.
AI and automated features. The on-site chatbot is powered by a third-party AI provider (the Anthropic API). When you use the chatbot, your query and the relevant on-site context are sent to that provider, acting as our processor, solely to generate a response. We do not use the chatbot to make decisions that produce legal or similarly significant effects about you (see §13).
Advertising partners. Where you consent to marketing cookies, advertising partners may receive usage data to measure and serve adverts. These partners act as independent controllers; their own privacy policies apply. (As at the date above, no advertising/marketing cookies are active on the site — see the Cookie Policy.)
Authorities and legal. We may disclose personal data where required to comply with a legal obligation, a court order, or a lawful request from An Garda Síochána, the PSNI or another law-enforcement or regulatory body; to enforce our Terms; or to establish, exercise or defend legal claims.
Business transfers. If our business is sold or reorganised, personal data may be transferred to the new owner subject to this policy.
9. International transfers
We aim to keep personal data within the European Economic Area (EEA). Some of our service providers (for example, Google and Cloudflare) are based outside the EEA or process data outside it. Where personal data is transferred outside the EEA, we ensure an appropriate safeguard is in place, which may be:
- an adequacy decision by the European Commission (for example, the EU–US Data Privacy Framework, where the recipient is certified); or
- the European Commission's Standard Contractual Clauses, together with any additional measures required.
You can ask us for more information about the safeguards that apply to a specific transfer using the contact details in §1.
10. How long we keep your personal data
We keep personal data only for as long as necessary for the purposes set out in this policy, and to meet legal, accounting and regulatory requirements. Our retention periods are:
| Data | Retention period |
|---|---|
| Account data | For as long as your account is active, then up to 24 months after closure, unless a longer period is required |
| Listing data | While the listing is live, then up to 12 months after it expires or is removed |
| Messaging data | Up to 12 months from the date of the message |
| Transaction / accounting records | 6 years from the end of the relevant accounting period (Irish tax law) |
| Communications and complaints | Up to 24 months after the matter is closed |
| Content-moderation and illegal-content reports | As required to meet our obligations under the Digital Services Act and to defend legal claims |
| Server logs | Up to 12 months |
| Analytics data | As set out in the Cookie Policy |
Where data is no longer needed, we securely delete or anonymise it. (These periods are our standard schedule; specific data may be kept longer where needed to resolve a dispute or meet a legal obligation.)
11. Your rights
Subject to the conditions in the GDPR, you have the right to:
- Access — obtain a copy of the personal data we hold about you (Art. 15);
- Rectification — have inaccurate or incomplete data corrected (Art. 16);
- Erasure — have your data deleted in certain circumstances (Art. 17);
- Restriction — ask us to limit how we use your data in certain circumstances (Art. 18);
- Portability — receive certain data in a structured, machine-readable format, or have it transmitted to another controller (Art. 20);
- Object — object to processing based on legitimate interests, and to object to direct marketing at any time (Art. 21);
- Withdraw consent — where we rely on consent, withdraw it at any time, without affecting prior processing (Art. 7);
- Not be subject to solely automated decisions that produce legal or similarly significant effects (Art. 22 — see §13).
To exercise any of these rights, email [email protected] or write to us at the address in §1. We will respond within one month, which may be extended by up to two further months for complex requests, in which case we will tell you. We do not charge a fee unless a request is manifestly unfounded or excessive. We may need to verify your identity before acting on a request.
Right to complain. If you are unhappy with how we have handled your personal data, you can complain to the Irish supervisory authority:
Data Protection Commission 21 Fitzwilliam Square South, Dublin 2, D02 RD28 www.dataprotection.ie
We would, however, appreciate the chance to address your concerns first.
12. Children
CARS.ie is not directed at children. Use of the site by anyone under 18 is subject to the consent of a parent or guardian, who is responsible for the minor's use of the site. We do not knowingly collect personal data from children for the purpose of providing them with marketing. The digital age of consent in Ireland is 16; we do not knowingly process the personal data of a child under 16 on the basis of their own consent. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.
13. Automated decision-making and profiling
We do not make decisions that produce legal effects, or similarly significantly affect you, based solely on automated processing.
Where you consent to marketing cookies, we and our partners may carry out limited profiling to measure advertising and show you relevant adverts. This does not produce legal or similarly significant effects, and you can object at any time by withdrawing marketing consent in the cookie banner.
The on-site chatbot generates responses automatically but does not make decisions about you.
14. How we protect your personal data
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include encryption in transit (HTTPS), hashed password storage, access controls, network protection through Cloudflare, security monitoring, and bot- and fraud-prevention controls. No system can be guaranteed completely secure; you are responsible for keeping your account password confidential.
15. Changes to this policy
We may update this policy from time to time. When we do, we will change the "Last updated" date above. Where changes are material, we will take reasonable steps to bring them to your attention — for example, by email to registered users or a notice on the site.
16. Contact us
For any question about this policy or your personal data:
- Email: [email protected]
- Data Protection Officer: [email protected]
- Post: Data Protection, C.A.R.S (Ireland) Ltd, Keltar, Ballynoe, Whites Cross, Co. Cork, T23 K290, Ireland
