Privacy Policy

RENNscout s.r.o.

October 2026

Version v1.4

1. Who We Are (Data Controller)

The data controller responsible for your personal data is:

2. Personal Data We Collect

We collect and process the following categories of personal data:

Identity data: Your first name and surname.

Contact data: Your email address and telephone number.

Vehicle search data: Vehicle preferences you provide (make, model, year, budget, geographic scope, and similar criteria you share when briefing us on your search or sale). Where you ask us to perform a VIN history check, we submit the VIN number to a third-party provider; the VIN number is a vehicle identifier, not a personal identifier, and does not by itself constitute personal data.

Communications: Emails, messages, and other correspondence between you and RENNscout during your engagement.

Payment data: Payments are processed by Stripe, Inc. We do not store or process your card number, bank account details, or full payment credentials. We retain only the transaction reference, amount, date, and payment status provided by Stripe.

Consent records: Where required (e.g., consent to begin work before the 14-day withdrawal period expires, or consent to receive marketing), we record the timestamp, channel, and content of your consent.

Marketing preferences: If you subscribe to our newsletter or opt in to marketing communications, we record your email address and the date and channel of your subscription.

Testimonials, portfolio and social media data: Where you give us your express consent, we may publish a client testimonial (using your initials only, unless you consent to full name), add the sourced or verified vehicle to the portfolio section of our website (without any identifying personal data, such as registration plates, unless you specifically consent to their inclusion), or feature the vehicle or engagement on our social media channels (Instagram, TikTok, or similar). We collect and retain your consent record (including the timestamp, channel, and scope of consent) and use only the content and level of identification you have approved. No personal data is published without your prior written or recorded consent.

Website usage data: We use a cookie-free, privacy-first analytics tool to understand how visitors use our website. This tool collects only anonymised, aggregated data — such as page views, approximate country of origin, and referral source. It does not set any cookies, does not store IP addresses, and does not collect or process any personal data. No cookie consent notice is required for this analytics tool. See Section 9.2 for information about advertising measurement cookies.

Advertising interaction data: Where you give consent to advertising measurement cookies, our advertising and measurement tools (Meta Pixel, Meta Conversions API, the Google Ads tag with conversion tracking and enhanced conversions, and Google Analytics 4) record website interaction events — which pages you viewed, whether you reached our contact form, and whether you submitted a contact enquiry — together with an advertising click identifier and technical data such as your IP address, browser type and device information. When you submit a contact enquiry, a hashed (irreversibly encoded) version of your email address and/or telephone number may be sent to Google and Meta so that they can match the enquiry to your account for conversion measurement and ad optimisation (Google enhanced conversions; Meta Advanced Matching). We use this data to measure and optimise our paid advertising and, where you consent, to show you our advertisements. Google Ireland Limited and Meta Platforms Ireland Limited receive this data (see Sections 5 and 9.2). No advertising data is collected or sent before you give your consent.

Social media and messaging interactions: If you contact us through Instagram, Facebook or WhatsApp, we receive your profile name or telephone number and the content of your messages. Meta Platforms Ireland Limited processes that data under its own privacy policy. We use it only to respond to your enquiry and, if you become a client, it is handled as described in this policy.

Provision of your name, contact details and information necessary to perform the requested service is a contractual requirement. Without these data we may be unable to provide the requested services. Provision of marketing data is voluntary.

3. Legal Bases for Processing

We process your personal data on the following legal bases under Article 6 of the GDPR:

3.1 Article 6(1)(b) — Performance of a contract

We process your identity, contact, vehicle search, and communications data in order to provide the service you have requested (Verify, Scout, Scout Pro, or Sale Advisory). Processing is necessary to perform the contract between us.

3.2 Article 6(1)(c) — Legal obligation

We retain invoice and accounting records as required by Act No. 431/2002 Coll. (Slovak Accounting Act) and related tax legislation.

3.3 Article 6(1)(f) — Legitimate interests

We may send you a follow-up message after delivery of your report to ask whether you found a vehicle, to request a review, or to inform you of relevant updates. Our legitimate interest is to maintain client relationships and improve our service quality. This interest does not override your rights; you may object at any time (see Section 8). Our use of cookie-free, anonymised website analytics is also based on our legitimate interest in understanding how visitors interact with our website; because no personal data is collected, this does not affect your rights as a data subject.

3.4 Article 6(1)(a) — Consent

Where you subscribe to our newsletter or opt in to marketing communications, we process your data on the basis of that consent. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

3.5 Article 6(1)(a) — Consent (testimonials, portfolio and social media)

Where you have given us your express consent, we process your testimonial text, vehicle details, and any agreed identifying information (such as initials) for the purpose of publishing client testimonials on our website, adding vehicles to our portfolio section, or featuring content on our social media channels. Consent is obtained before any publication and may be withdrawn at any time; withdrawal will result in removal of the relevant content from our website and social channels as soon as reasonably practicable.

3.6 Article 6(1)(a) — Consent (advertising measurement cookies)

Where you give consent via the cookie consent banner displayed on our website, we process advertising interaction data collected through the Meta Pixel, Meta Conversions API, Google Ads tag and Google Analytics 4 (including hashed contact details submitted through our enquiry form, see Section 2) for the purpose of measuring and optimising our paid advertising campaigns and, where you consent, showing you our advertisements on Google, Facebook and Instagram. Our use of cookies and similar technologies on your device is based on your consent under Section 55(5) of Act No. 452/2021 Coll. on Electronic Communications; the subsequent processing of personal data is based on Article 6(1)(a) GDPR. You may withdraw this consent at any time via the cookie settings link in the website footer. Withdrawal does not affect the lawfulness of processing before withdrawal.

4. How We Use Your Personal Data

We use your personal data only for the following purposes:

• To provide, manage, and deliver the vehicle sourcing, sale advisory, and consultancy service you purchased.

• To communicate with you about the progress of your engagement.

• To issue invoices and comply with our accounting and tax obligations.

• To record and preserve consent for audit purposes (e.g., early-performance consent under the Consumer Rights Act).

• To send post-delivery follow-up messages (on the basis of legitimate interest — see Section 3.3).

• To send you newsletters, market updates, or promotional content where you have given consent (see Section 10).

• To publish client testimonials, portfolio entries, and social media content where you have given express consent, and only to the extent of that consent.

• To understand how visitors use our website using anonymised, cookie-free analytics (no personal data is involved in this process).

• To measure and optimise the performance of our paid advertising campaigns on Google, Facebook, and Instagram, and (where you have consented) to show you relevant advertisements, based on advertising cookies consent (see Section 9.2).

• To prevent fraud and maintain the security of our systems.

• To comply with any applicable law, court order, or regulatory requirement.

We do not sell, rent, or otherwise commercialise your personal data. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects. Where you consent to advertising cookies, Google and Meta may use your interaction data to build advertising audiences and personalise the advertisements shown to you; this is profiling for advertising purposes only, it has no legal or similarly significant effect on you, and you can stop it at any time by withdrawing your consent (see Section 9.2).

5. Who We Share Your Data With

We share your personal data only where necessary and only with the following categories of recipients:

5.1 Data processors and advertising platforms

5.2 Other disclosures

We may also disclose personal data to:

• Our legal advisors and accountant, solely in connection with their professional services to us, subject to their own professional secrecy obligations.

• Public authorities or law enforcement where required by applicable law or a binding court order.

We do not share your data with vehicle sellers, dealers, or any other commercial third party for their own marketing or sales purposes.

6. International Transfers

The following processors are based in the United States and transfers to them are protected by the safeguards described:

We do not knowingly transfer your personal data to any country outside the European Economic Area (EEA) other than through the processors listed above under the safeguards described. The EU–US Data Privacy Framework adequacy decision is relied upon as an additional safeguard where applicable; our contracts also include Standard Contractual Clauses as a fallback in the event that the adequacy decision is suspended or invalidated.

Our website analytics provider (Umami) is self-hosted on our own infrastructure within the EEA, meaning no cross-border transfer of data occurs in connection with analytics. Our invoicing provider (SuperFaktúra) is registered in the Slovak Republic and also falls within the EEA; no international transfer occurs in connection with invoice processing.

7. How Long We Keep Your Data

After the applicable retention period expires, personal data is securely deleted or irreversibly anonymised.

8. Your Rights Under the GDPR

Under the GDPR and Act No. 18/2018 Coll., you have the following rights in relation to your personal data:

Right of access (Art 15): You may request a copy of the personal data we hold about you.

Right to rectification (Art 16): You may ask us to correct any inaccurate or incomplete personal data.

Right to erasure (Art 17): You may ask us to delete your personal data where there is no compelling reason for continued processing. This right may be limited where we are required to retain data by law (e.g., accounting records).

Right to restriction (Art 18): You may ask us to restrict processing in certain circumstances (e.g., while you contest the accuracy of data, or while an objection is being considered).

Right to data portability (Art 20): Where processing is based on consent or contract and carried out by automated means, you may ask us to provide your data in a structured, commonly used, machine-readable format.

Right to object (Art 21): You may object at any time to processing based on legitimate interests (including post-delivery follow-up). We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Right to withdraw consent (Art 7): Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of the above rights, please contact us at: [email protected]

We will respond within 30 days of receiving a valid request. We may ask you to verify your identity before processing a request. There is no charge for exercising your rights unless a request is manifestly unfounded or excessive.

9. Cookies and Tracking Technologies

9.1 Analytics (cookieless)

We use Umami, an open-source analytics tool self-hosted on our own infrastructure, to understand how visitors use our website. Umami:

• sets no cookies of any kind;

• does not store or process your IP address;

• does not track you across sessions, devices, or websites;

• collects only anonymised, aggregated data — such as page view counts, approximate country, referral source, device type, and time spent on pages;

• does not transfer any data to third parties.

No cookie consent is required for Umami, as it does not collect personal data or set cookies.

9.2 Advertising and measurement cookies

We use the following tools to measure the effectiveness of our paid advertising campaigns. They set cookies or similar technologies in your browser and are activated only after you give your consent via the cookie consent banner shown on your first visit to the website. Until you consent, no advertising cookie is set and no data is sent to Google or Meta by these tools.

Meta Pixel (Meta Platforms Ireland Limited): measures whether visitors who clicked our Facebook or Instagram advertisements went on to submit a contact enquiry, and (with your consent) allows us to build advertising audiences, including audiences of website visitors, for future campaigns. For the collection and transmission of this data via the Meta Pixel, RENNscout and Meta Platforms Ireland Limited act as joint controllers (Art. 26 GDPR) under the Meta Controller Addendum; Meta is responsible for the further processing of the data for its own purposes.

Google Ads tag (Google Ireland Limited): measures whether visitors who clicked our Google Ads proceeded to submit a contact enquiry (conversion tracking), and (with your consent) allows us to show our advertisements to visitors of our website (remarketing). Google Ireland Limited processes this data in accordance with the Google Ads Data Processing Terms and, for its own purposes, as an independent controller under its privacy policy.

Google Analytics 4 (Google Ireland Limited): measures, in aggregated reports, how visitors who arrive through our advertisements use the website (pages viewed, enquiries submitted, approximate location). It is activated only after your consent, does not log or store IP addresses, and reported data is retained for 14 months.

Server-side measurement (Meta Conversions API and Google): when you have consented and submit a contact enquiry, our web server may send that event, with hashed contact details, directly to Meta and Google so that conversions can be measured even where browser restrictions block cookies. This happens only for visitors who have consented.

Consent signals: your banner choice is passed to Google (Google Consent Mode) and Meta so that their tags respect it. If you decline, the tags are not loaded and no data is sent.

The following cookies may be set once you have accepted advertising cookies (durations are those stated by the providers and may change):

Cookie names and durations are set by Google and Meta and may change; the cookies listed are those used by the tools described above. When you accept, the tools also send your IP address and technical browser data to Google and Meta, which may involve transfers to the United States (see Section 6).

How consent works: when you first visit the website, a cookie banner offers "Accept all" and "Reject all" options of equal prominence, and a "Settings" option; advertising cookies are not pre-selected. If you do not choose, or you reject, no advertising cookies are set and our website functions normally. You may change or withdraw your consent at any time via the "Cookie settings" link in the website footer, which has the same effect as the original choice and is as easy to use. You can also delete cookies in your browser settings. Withdrawal does not affect the lawfulness of processing before withdrawal. We keep a record of your consent choice (see Section 7).

Your advertising choices: you can also manage personalised advertising directly with the providers — Google at adssettings.google.com and Meta at facebook.com/adpreferences — or via the European opt-out tool at youronlinechoices.com. The provider-level controls do not replace the choice you make on our cookie banner.

9.3 Strictly necessary measures

If you use our website's contact or enquiry form, the form may use a session-level technical measure to prevent spam submissions. This is strictly necessary for the form to function and does not involve tracking or profiling.

10. Newsletter and Marketing Communications

We send newsletters and marketing communications only to individuals who have explicitly opted in. You may subscribe:

• Via a subscription form on our website.

• Via a lead-generation resource (e.g., a guide or checklist we offer in exchange for your email address), provided a clear consent statement is displayed at the point of sign-up.

• By providing express consent during or after your engagement with us.

Our email communications — including transactional emails (order confirmations, engagement updates, invoices) and newsletter distributions — are delivered either through Google Workspace (via the @rennscout.com domain) or through Resend, Inc., a third-party email delivery platform, depending on the channel used. In either case, your email address and the content of emails sent to you are processed solely for the purpose of delivering those communications. Both providers are listed in Section 5.1.

Each marketing email will contain a clear and functional unsubscribe link. You may also unsubscribe at any time by emailing [email protected]. Unsubscribing from marketing emails does not affect the delivery of transactional emails necessary for any active engagement.

Past clients: if you were a client before we implemented this Privacy Policy, we will contact you separately to request your consent before adding you to any marketing list. We do not rely on the previous service relationship as a basis for marketing without a fresh, GDPR-compliant opt-in.

11. How We Protect Your Data

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These include:

• Storage of client files within Google Workspace, which provides encryption in transit (TLS) and at rest.

• Website and application hosting on DigitalOcean infrastructure with standard data-centre security controls.

• Email delivery via Google Workspace or Resend, both of which use TLS for email transmission.

• Invoice generation and delivery through SuperFaktúra. Client data shared with SuperFaktúra is limited to invoice-relevant details only.

• Access to client data restricted to authorised personnel only.

• Payments processed exclusively through Stripe, a PCI DSS-compliant provider. We do not store payment card data.

• Periodic review of access rights and data held.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours of becoming aware of the breach and, where required, notify you directly.

12. Supervisory Authority and Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR or Act No. 18/2018 Coll., you have the right to lodge a complaint with the supervisory authority:

You also have the right to bring a claim before a competent court if you consider that your rights have been infringed.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. The current version will always be available on our website at www.rennscout.com/privacy. Where changes are material, we will notify active clients by email.

This policy was last reviewed and updated in October 2026. Version 1.4 expands Section 9 (advertising cookies, consent mechanism and cookie table), adds enhanced conversions, server-side measurement and Google Analytics 4, updates the controller roles for Meta and Google, and adds a retention entry for advertising cookie data.

RENNscout s.r.o. | IČO: 56 372 744 | Gorkého 4, Bratislava — Privacy Policy v1.4 | October 2026