Privacy policy

• No advertising on the site, no selling of data, and the site sends you no email you did not ask for.
• No audience measurement or advertising cookies: only those the site needs to work.
• No account needed to search for a car or contact a seller.
• When you write to a seller, whether a garage or a private individual, your contact details go to that seller, and to that seller alone.
• The site’s data is hosted in the European Union, in Frankfurt and, for the photos, in Paris; only its emails pass through the United States.
• Vehigo also reaches out to dealerships and garages, using their public contact details: see “Business prospecting”.

The controller is Julien Jacobs, who operates Vehigo: Rue Haute Marexhe 94, 4040 Herstal, Belgium, company number 1040.928.477 (see the legal notice).

For any question about your data, write to infos@vehigo.be. Vehigo is not required to appoint a data protection officer and has not appointed one.

When you write to a garage, that garage in turn becomes responsible for the use it makes of your contact details. A private individual selling their car may only use them for that sale.

Visitors

Browsing listings requires no information. To search near you, you can give a postcode: it is only used to measure the distance to sellers, stays in the page address and is not recorded, except in an alert you create. To work and to protect itself against abuse, the site uses your IP address without storing it on a lasting basis (see “Security and limits” below) and necessary cookies (see the cookie policy).

Buyers who write to a seller

Your name, your email address, your phone number if you give it, your message and the language of the site. They are used to pass your request on to the seller and to follow up the conversation: this is the service you are asking for (article 6.1.b of the GDPR). You receive a copy of your message and a personal link to the conversation. The browser from which you write, or open this link, keeps it in an encrypted cookie that only the site can read, to show you your conversations under “Messages” without an account (see the cookie policy).

Buyers who create an alert

Your email address, the search you follow (its filters, such as the make, the price, the region, or a postcode and a distance), the language of the site, and the dates of the request, of the confirmation and of the last sending. They are used to send you, at most once an evening, the new cars that match your searches, up to 5 searches per address. Basis: your consent (article 6.1.a of the GDPR), given by clicking the link in the confirmation email: without this click, nothing is sent. You can withdraw it at any time, without giving a reason, via the “Stop this alert” link in each email or the “Unsubscribe” button of your email app. No account is created, and your address is used for nothing else.

People who report content

Your name, your email address, the language of the site, the reported listing, the reason and your explanation. They are used to examine your report, to acknowledge receipt of it and to inform you of the decision, as required by the EU Digital Services Act (article 6.1.c of the GDPR). The seller concerned receives neither your name nor your email address.

Garages

The business’s information, published on its showcase (name, company number, address, phone, WhatsApp, email, website, opening hours, description, logo and banner), up to 3 previous web addresses of its showcase, which still lead to it, its news (title, text, photo and last day of display) and its listings, including the VIN, which is never published. For each account: the person’s name, their email address, their password (stored in an unreadable form, even for Vehigo), their language, the date their email address was confirmed, the date and version of the terms accepted, and the date of their last sign-in, which is used to identify an abandoned account. When the email address of an account changes, from its dashboard or by Vehigo at its request, the new address waits for the click on the link sent to it; the garage’s history then keeps the old and the new address. If the account enables two-step verification: the key of its authenticator app (encrypted), the activation date, the time of the last code used, so that a code can only be used once, and its backup codes (stored in an unreadable form, even for Vehigo). This data is used to provide the service to the garage: this is the performance of the contract (article 6.1.b of the GDPR).

Team members of a garage

When a garage invites someone to its team, it gives their e-mail address and what they may do. Vehigo sends them an invitation link, valid for 7 days. If they create their account, Vehigo processes the same data as for a garage account, their rights and the date they joined; the history of the garage keeps their e-mail address at the invitation, on joining and on leaving. This is the performance of the contract with the garage (Article 6(1)(b) GDPR). The garage sees the name and address of each person on its team.

Garages that entrust their stock to Vehigo

At a garage’s written request, Vehigo reads the public pages of its site every day to create, update and remove its listings: its cars, their prices, mileages, texts and photos, without the contact details found in the texts. Vehigo keeps the link to that site, the date and form of the written consent, the number of each car on that site, and what the robot read and did during its last 10 passes, about the cars only. The pages read are not kept. This is the performance of the contract (Article 6(1)(b) of the GDPR), which the garage can stop at any time by an email to infos@vehigo.be.

Verification of garages

On registration and during verification, the company number is checked against the European Commission’s VIES register, to rule out fake accounts. During verification, Vehigo also consults the business’s public record at the Crossroads Bank for Enterprises, which shows its legal situation (for example a bankruptcy or a liquidation). Decisions taken about a garage, its listings or its news (approval, refusal, suspension, removal of a listing or a news item, reset of an account’s two-step verification) are kept with their reasons, which are sent to the garage. A removed news item is erased; only its title remains, with the decision. Basis: Vehigo’s legitimate interest in the security of the marketplace (article 6.1.f of the GDPR).

Private individuals selling their car

From 19 January 2027 (see the terms of use). For each account: first name and surname, email address, phone number, postcode and municipality, language, password (stored in an unreadable form, even for Vehigo), the date the email address was confirmed, the date and version of the terms accepted, with the declaration of selling in a private capacity, and the date of the last sign-in, which is used to identify an abandoned account. When the email address of the account changes, the new address waits for the click on the link sent to it; the account’s history then keeps the old and the new address. Their listings and photos, including the VIN if they give it, which is never published, with their publication and end dates. The date each car was put online in the last twelve months, even if its listing has been deleted, to apply the limit of 3 cars. Only their first name and municipality are published with their listings and, if they choose, their phone number and WhatsApp number. If they enable two-step verification, the same data as for a garage. This data is used to provide the service to the private seller: this is the performance of the contract (article 6.1.b of the GDPR).

Verification of private sellers

Before their listings are visible, a person at Vehigo reviews a new private seller’s account and first listing, and may call them on the number they gave, to rule out fake accounts, scams and professionals posing as private individuals. Decisions taken about a private seller or their listings (approval, refusal, suspension, removal of a listing) are kept with their reasons, which are sent to them. Basis: Vehigo’s legitimate interest in the security of the marketplace (article 6.1.f of the GDPR).

Seller statistics

To show each seller how many times their listings, and a garage’s showcase, have been viewed, shared or have led to a contact, the site counts visits and shares without cookies. A share counts the action on the “Share” button; the site does not know whether a message was sent. A visit or a share is counted once a day using a fingerprint calculated from the IP address, the browser and the listing or showcase concerned, with a secret key drawn at random each day and never stored. The IP address is not stored. The fingerprint changes from one listing to another and from one day to the next: it cannot be used to track a visitor. It is erased the next day, and the day’s key is forgotten: no one, not even Vehigo, can recalculate it. Bots, and a seller viewing their own listings, are not counted. Basis: the legitimate interest of Vehigo and of sellers (article 6.1.f of the GDPR).

Price book

To know the prices of the used-car market, and later help sellers set theirs, Vehigo keeps a price book of every listing put online: the car (make, model, version, year and month of first registration, fuel, power, engine size, battery, gearbox, body type, drive, condition, whether VAT is deductible), its successive prices with the mileage and the day, whether the seller is a garage or a private seller, and the days the listing went online, was sold and was deleted. The price book keeps neither the seller’s name, nor their contact details, nor the VIN, nor the description, nor the photos. As long as the listing exists, its line is linked to it; when the listing or the seller’s account is deleted, the line remains, without any link to them. Basis: Vehigo’s legitimate interest in knowing market prices, for sellers and buyers alike (article 6.1.f of the GDPR).

Security and limits

To prevent abuse (mass messages, password guessing, copying of the site), the site counts certain actions per IP address and, for failed sign-ins, per IP address and email address. These counters do not keep the email address itself, but a fingerprint calculated with a secret key. They erase themselves, within a few minutes for most and after three hours at the latest. In the event of an error, the server’s technical log may contain an email address; it is erased after 7 days. Basis: Vehigo’s legitimate interest in the security of the site (article 6.1.f of the GDPR).

Site errors

When a page does not work, the site sends a technical description of the error to PostHog, its error-tracking service, so that it can be fixed: the type of error and its message, the lines of code involved, the page concerned without its exact address, the type of visitor (visitor, garage, private seller or administrator), the language and version of the site, and a number that refers to the server’s technical log. The site first removes email addresses, IP addresses, keys and personal links from it. It sends no cookie, no password, no form or message content, and not the identity of the account. It does the same when an email from the site has still not gone out after half an hour of attempts, then when it gives up on it: the kind of email (for example “forgotten password”), the number of attempts and the email provider’s response, without the address or the content of the email. It does the same when a task that the site runs on its own fails, such as the end of the launch offer: the name of the task and the error. Basis: Vehigo’s legitimate interest in a site that works (article 6.1.f of the GDPR).

Payment

When paid plans are open, Stripe processes the payment. Vehigo only keeps the Stripe references of the garage, of its subscription and of each VIN lookup charged on top of its plan, its plan and the end of the paid period. For the founder offer, Vehigo keeps the company number of each garage that has benefited from it, so that it can only be used once per business. Invoices are kept as accounting law requires (article 6.1.c of the GDPR).

Sales codes

When a garage signs up with the code of a Vehigo salesperson, that code is kept with its account, to apply the code’s discount and to count the garages each salesperson brings (Vehigo’s legitimate interest, article 6.1.f of the GDPR). It is erased with the account. The site also counts how many people open the pricing page through the QR code of a code, without cookies and like the seller statistics: once a day, using a fingerprint that differs from one code to another and is erased the next day. Only the code and the day of the scan then remain. Bots and signed-in accounts are not counted.

Page “Insure your car”

On the page “Insure your car”, the site counts how many people open the website of an insurer or call it from its card, for the report Vehigo sends it (Vehigo’s legitimate interest, article 6.1.f of the GDPR). This counting is done without cookies and like the seller statistics: once a day, using a fingerprint that differs from one insurer to another and is erased the next day. Only the insurer, the action and the day then remain. Bots and signed-in accounts are not counted. No data of a visitor or a car goes to an insurer: the link to its website passes nothing on, and what follows happens on that website, under its own rules.

Emails

The site only sends emails linked to the service: email address confirmation, change of email address or password, forgotten password, activation, deactivation or reset of two-step verification, messages between buyers and sellers, new car alerts requested by a buyer and their confirmation, acknowledgement of receipt and follow-up of a report, decisions about a seller, a listing or a news item, a warning before an abandoned account is deleted, reminders before the end of the launch offer or of a private seller’s listing, the announcement of a new version of the terms (Vehigo notes the day each seller is told of it, for as long as their account exists), confirmation and cancellation of a meeting with Vehigo. Each email waits to be sent in the database, encrypted, then it is erased as soon as it has gone out. If it cannot go out, the site keeps trying for a little over a day; an email that could not go out is kept for 30 days, so that Vehigo can deal with it, then erased. The emails you send to Vehigo are kept for as long as it takes to follow up your request.

Messages to Vehigo on WhatsApp

A garage that has been refused or suspended can write to Vehigo on WhatsApp from its pro dashboard. Vehigo then receives the number and profile name of the person writing, and their messages. They are used to reply to that person, for example when they contest a decision (article 6.1.b of the GDPR), and are kept for as long as it takes to follow up their request. These exchanges go through WhatsApp, a Meta service that applies its own rules.

Meetings with Vehigo

A garage can book a meeting with Vehigo from its pro dashboard: a visit to the dealership in the province of Liège, a video call elsewhere. Vehigo then receives the chosen day and time, what the garage wants to talk about, the name and email address of the person who books, and the name, company number, address, phone number and email address of the garage. The site passes them on to Vehigo’s prospecting notebook, which keeps its agenda and the garage’s file, and sends Vehigo a copy by email. They are used to prepare and hold the meeting, then to follow up the relationship with the garage: it is the service the garage asks for (article 6.1.b of the GDPR). Video calls take place on Google Meet: the person joins from their browser, without an account, and Google processes the call under its own rules.

Vehigo processes no sensitive data (health, opinions, origin…) and takes no automated decision with legal effects on you other than the deletion of an abandoned account, whether a garage’s or a private seller’s: provided for by the terms of use, it is announced by email 30 days in advance, and signing in is enough to prevent it. When a garage’s plan allows fewer listings than it has online, those beyond that number go offline automatically, without being erased: this is the application of the contract, and the garage chooses which ones it keeps (see the terms of sale).

• The seller you contact, garage or private seller, receives your message and your contact details, by email and in their dashboard.
• A buyer who writes to a garage receives the garage’s replies, with the garage’s email address. A buyer who writes to a private seller receives their replies without their email address.
• A garage’s showcase and its listings are public. So are a private seller’s listings, with their first name, their municipality and, if they choose, their phone number and WhatsApp number.
• Hostinger International Ltd (Cyprus) hosts the site’s server in Frankfurt, as well as Vehigo’s mailbox.
• Supabase Pte. Ltd. (Singapore) hosts the database in Frankfurt.
• OVH SAS (France) hosts the site’s photos in Paris. Your browser downloads them directly from OVHcloud, which receives its IP address to do so.
• Resend (Plus Five Five, Inc., United States) delivers the site’s emails and keeps a copy of them for 30 days, to track their delivery.
• PostHog, Inc. (United States) receives the technical description of the site’s errors and stores it in Frankfurt, to help fix them.
• The European Commission (VIES service) receives the company number entered on registration.
• The FPS Economy (Crossroads Bank for Enterprises) receives a garage’s company number when Vehigo consults its public record.
• Stripe Payments Europe, Limited (Ireland) processes payments for paid plans, once they are open.
• Billit (Belgium) sends invoices for paid plans via the Peppol network, once they are open: the garage’s name, address and company number, with the content of the invoice.
• WhatsApp Ireland Limited (Ireland), a Meta service, carries the messages that a garage sends to Vehigo on WhatsApp, under its own rules.
• If the garage uses VIN lookup, and when this service is enabled, the VIN is sent to the data provider InMotiv.
• Cloudflare, Inc. (United States) hosts Vehigo’s prospecting notebook, with its database in the European Union; it also receives the meetings garages book with Vehigo.
• Google Ireland Limited (Ireland): video calls with Vehigo take place on Google Meet, under its own rules.
• Anthropic, PBC (United States): its artificial intelligence assistant, Claude, helps Vehigo prepare the starting list for its prospecting, from public pages, and maintain the site. To learn how to read the site of a garage that asked for it, Claude receives public pages of that site, without contact details, from Vehigo’s computer; the site’s server never talks to it, and no data from the database is passed on. To check the live site, Claude reads only technical data: numbers, dates, statuses, an account number and, in the server’s technical log, the description of an error or of a connection, with its IP address. It never reads the names, email addresses, phone numbers or messages the site keeps. Anthropic processes what Claude reads under its own rules.
• The authorities, only on a request based on the law.

Service providers process the data on behalf of Vehigo, on its instructions, under a contract that complies with article 28 of the GDPR.

The site’s data is hosted in the European Union. Its emails go through Resend, in the United States, with their content: a buyer’s message and contact details, for example. Supabase, established in Singapore, PostHog and Cloudflare, established in the United States, Stripe and Google, whose parent companies are in the United States, may also access the data from outside the European Economic Area, for example for technical support. Cloudflare keeps the database of the prospecting notebook in the European Union, but may process its data elsewhere, for example when the notebook is opened from abroad. These transfers are governed by the European Commission’s standard contractual clauses or, for the United States, by the EU–US Data Privacy Framework.

A garage deletes its account itself from its pro dashboard, or asks for it to be deleted by writing to infos@vehigo.be. Vehigo then erases its accounts, its showcase, its news, its listings and their photos, its messages, its statistics, the reports on its listings and the decisions taken about it, except what the law requires to be kept, and confirms this to the garage by email. A private seller deletes their account in the same way, from their private seller dashboard (“My account” section) or by email: Vehigo then erases their account, their listings and their photos, their messages, their statistics, the dates their cars were put online, the reports on their listings and the decisions taken about them. An abandoned account, of a garage or of a private seller, that no one has signed in to for three years, is deleted in the same way, 30 days after an email warning of it, unless someone signs in to it in the meantime. In all these cases, the price book keeps the line of each listing, without any link to the seller, for up to five years after it is deleted. A person who has written to a seller, reported a listing or created an alert may also ask for their data to be erased: their conversations are erased with all their messages, including in the sellers’ dashboards, as well as their new car alerts and the emails intended for them that have not yet gone out. Erased data disappears from the backup copies as they are replaced.

You may at any time:

• find out what data concerns you and receive a copy of it;
• have inaccurate data rectified;
• have your data erased, except data that the law requires to be kept;
• withdraw at any time the consent you have given, for example for an alert, without affecting what was done before;
• request the restriction of processing;
• receive the data you have provided in a structured format, to transmit it elsewhere;
• object to processing based on legitimate interest.

To exercise any of these rights, write to infos@vehigo.be, if possible from the email address concerned. In the event of reasonable doubt, Vehigo may ask you to confirm your identity. The reply is free of charge and reaches you within one month; this period may be extended by two months for a complex request, in which case you are informed of this within the first month.

A garage, or a private seller, can also correct most of their information themselves in their dashboard.

• Exchanges with the site are encrypted (HTTPS).
• Passwords are stored in an unreadable form (scrypt hashing): no one can read them, not even Vehigo.
• Administrator accounts, and the accounts of sellers who enable it, require, in addition to the password, a code given by a phone app (two-step verification).
• Access to the database is restricted to the site’s server and the administrator, over encrypted connections.
• Each seller only accesses their own data; the admin area is restricted to administrators.
• Sign-ins, messages and pages viewed are limited in number, to prevent abuse.
• Published photos are converted by the site, without their metadata, such as the GPS location.

In the event of a personal data breach, Vehigo notifies it to the Data Protection Authority within 72 hours of becoming aware of it, unless it presents no risk to your rights. If the risk is high, you are informed without delay.

Vehigo only uses cookies necessary for the site to work, with no audience measurement or advertising. They are described in the cookie policy.

Vehigo has a page on Facebook, Instagram, LinkedIn, TikTok and YouTube: the icons at the bottom of every page of the site lead to them. The site sends these networks nothing (see the cookie policy). When you visit these pages, it is the network that collects your data, under its own privacy policy.

Each network gives Vehigo statistics about its page: for example the number of views, likes and followers, and how they break down by country, age or gender. These are overall figures, which do not tell Vehigo who saw what: they show Vehigo which posts interest people. If you follow a Vehigo page, react to a post, comment on it or write to Vehigo on a network, Vehigo also sees what the network shows of it: your profile name and what you did or wrote. Vehigo only uses this to reply to you and to run its page. Basis: Vehigo’s legitimate interest in making its service known (article 6.1.f of the GDPR).

Vehigo and the network are jointly responsible for these statistics (article 26 of the GDPR). Facebook (Meta Platforms Ireland Limited), LinkedIn (LinkedIn Ireland Unlimited Company) and TikTok (TikTok Technology Limited) have settled this in an addendum published on their site (Meta’s, LinkedIn’s and TikTok’s): the network informs you and answers your requests for access, erasure or objection. The simplest is to send them to the network; if you write to Vehigo, Vehigo forwards them to it.

Vehigo presents its service to dealerships and garages, so that they publish their listings on vehigo.be: this is business-to-business prospecting. If Vehigo has contacted you, this part tells you where your contact details come from, how Vehigo contacts you, what is kept, why, for how long, and how to stop being contacted.

The data

First, the dealership’s contact details: its trade name, which is sometimes the name of the person who runs it, its address, its general phone number and email address, its website, the brands it sells and the size of the stock it displays. No names of people. Then, after a first contact, what Vehigo notes to follow up the relationship: the people it meets (name, position, phone and email address), each exchange (call, visit, video call, email or message) with its date, its report and the planned next step, and notes on the dealership, such as its opening hours or the software it uses. To respect your choices, Vehigo also notes whether you accepted or refused its emails, with the date, and the date of the last check of your number against the “Ne m’appelez plus” list, with its result.

Where it comes from

The dealership’s contact details come from public sources: its own website, those of the brands and groups it represents, AutoScout24 and the Golden Pages. Vehigo draws a starting list from them, prepared with the help of Claude, Anthropic’s artificial intelligence assistant, which reads these public pages. Each line keeps its source and the date it was checked, and Vehigo tells you where your contact details come from at its first contact. The rest comes from you, as the exchanges go on. No robot continuously browses directories or dealership websites, and a dealership only enters the prospecting notebook if Vehigo adds it. The result of the check comes from the “Ne m’appelez plus” list kept by the non-profit association Do Not Call Me: Vehigo downloads it, compares it with its numbers on its computer, then erases it.

Why and on what basis

To present Vehigo to motor trade professionals, then to follow up the business relationship, including when the dealership becomes a customer. Basis: Vehigo’s legitimate interest in making its service known (article 6.1.f of the GDPR). Prospecting emails also require your prior consent (article XII.13 of the Belgian Code of Economic Law), which you can withdraw at any time. Vehigo checks your number against the “Ne m’appelez plus” list because the law requires it before any prospecting call. This data is neither sold nor lent, and is used for nothing else.

How Vehigo contacts you

By phone, unless your number is on the “Ne m’appelez plus” list: at the start of the call, Vehigo tells you who is calling, why, where your number comes from, and that you can refuse without giving a reason. By email, only if you have agreed to it: each email presents itself as advertising and says how to stop receiving them. Never by text message or WhatsApp for a first contact.

Who uses it

Only Julien Jacobs, who runs Vehigo. The starting list stays on the computer of Julien Jacobs. The prospecting notebook is protected by a password and hosted by Cloudflare, with its database in the European Union (see “Who receives your data”). Emails go through Vehigo’s mailbox, at Hostinger.

How long

The starting list is erased twelve months after it is prepared, and redone if needed. The file of a dealership that does not take things further is erased three years after the last exchange. The file of a dealership that has become a customer is kept as long as it has an account on vehigo.be, then erased three years after the last exchange. If you ask not to be contacted again, your file is erased. Only the dealership’s name and that request are kept, with no time limit, so that you are never approached again, even if the dealership turns up in a new list. Your consent to or refusal of emails, with its date, and the result of the last “Ne m’appelez plus” check are kept with the file or the line of the starting list, and erased with them.

Your rights

You can find out where your contact details come from, receive a copy of what Vehigo keeps about you, have it corrected or erased, and ask not to be contacted again, at any time and without having to give a reason. A word during an exchange is enough, or an email to infos@vehigo.be. To stop receiving emails from Vehigo, reply STOP to one of them: Vehigo confirms your request by email. An erasure applies to the prospecting notebook and to the starting list. Your other rights, and how to complain to the Data Protection Authority, are described in “Your rights”.

This policy evolves with the service. The date of the version in force appears at the top of this page. Registered garages and private sellers are notified by email of any significant change.