Advisory
Regulatory Disclosure

Privacy & Data Governance Policy

Effective Date: January 1, 2026. Compliant with EU Regulation 2016/679 (GDPR) and international privacy frameworks.

1. Data Controller Identification

This Privacy Policy governs the processing of personal data by Curiovault Automotive Intelligence GmbH (hereinafter referred to as "Curiovault", "we", "us", or "our"), having its registered corporate seat at Maximilianstraße 35, 80539 Munich, Bavaria, Germany, registered at the Munich Commercial Register under registration number HRB 249811.

For any data protection inquiries, access requests, or regulatory communication, you may contact our designated Data Protection Officer (DPO) at [email protected].

2. Categories of Personal Data Collected

We process the following categories of information depending on your interaction with curiovaultnavigatr.com:

  • Direct Communication Data: When you complete our contact forms or advisory consultation requests, we collect your full name, email address, country of residence, desired vehicle class, and any unstructured textual notes regarding chassis history.
  • Telemetry and Device Data: When browsing our digital estate, our web servers log your truncated (anonymized) IP address, browser user-agent header, screen resolution, referral URL, and interaction timestamps.
  • Simulator Configurations: Inputs provided within our interactive matching tool and Total Cost of Ownership calculator are processed client-side via JavaScript and stored in your browser's local storage session unless explicitly transmitted via an inquiry form.

3. Legal Bases for Data Processing under GDPR

Under Article 6(1) of the General Data Protection Regulation, our data processing activities rely strictly upon:

  • Article 6(1)(b) Contractual Performance: Processing required to deliver requested vehicle valuation dossiers, import advice, or pre-purchase inspection coordination.
  • Article 6(1)(f) Legitimate Interest: Processing server log metrics to prevent distributed denial-of-service (DDoS) attacks, detect malicious bot scraping, and maintain infrastructure stability.
  • Article 6(1)(a) Explicit Consent: Processing web telemetry data governed by our Cookie Consent mechanism.

4. Third-Party Data Processors & Cross-Border Transfers

We do not sell, rent, or lease personal telemetry to data brokers. We utilize contracted technical subprocessors strictly bound by Data Processing Agreements (DPAs) incorporating standard contractual clauses (SCCs):

  • Cloud Infrastructure: EU-based instances hosted in Frankfurt, Germany.
  • Email Dispatch: Encrypted SMTP relay servers operating within the EEA.

5. Data Retention Schedules

Direct contact inquiries and advisory correspondence are retained for a period of twenty-four (24) months following the conclusion of advisory engagement, after which records are automatically deleted or irrevocably anonymized. Server telemetry logs are purged on a rolling thirty (30) day schedule.

6. Your Statutory Rights (GDPR / CCPA)

As a data subject, you enjoy the following rights under EU Law:

  • Right of Access (Art. 15 GDPR): Obtain confirmation of processed data and a copy thereof.
  • Right to Rectification (Art. 16 GDPR): Correct inaccurate or incomplete personal records.
  • Right to Erasure ('Right to Be Forgotten', Art. 17 GDPR): Request deletion of personal data when no legal retention obligation exists.
  • Right to Restriction of Processing (Art. 18 GDPR) & Data Portability (Art. 20 GDPR).
  • Right to Lodge a Complaint: You have the right to lodge a complaint with the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.