Privacy statement
Version 1.0 of 23 October 2026
Which personal data Carmantic processes, why, for how long and with whom, and what your rights are. Did you sign a document from a garage? Then be sure to read section 2.
1. Who is responsible
Hebel & Margo BV, Kapellekensweg 32, 3391 Meensel-Kiezegem, Belgium, company number BE 0794.199.079, is the controller for the data we process when you visit the website, request a demo, use Carmantic as a member of a customer's staff or are the contact person for billing.
For any question about your data: support@carmantic.be.
2. You signed a document from a garage
Did you sell a car to a garage, or sign a brokerage or consignment agreement? Then that garage is the controller of your data in that dossier: your name, address, contact details, the copy of your identity document, your bank account number, the vehicle's details, your signature and the evidence of the signing.
Carmantic processes that data only on behalf of the garage, to prepare the document, have it signed, keep it and send it, and under a data processing agreement. We never use it for our own purposes, do not sell it and do not send you advertising.
For your rights (access, rectification, erasure), contact the garage; its details are on the document. If you contact us, we pass your request on to the garage and help it to answer.
3. Which data, why and for how long
| When | Which data | Why and legal basis | How long |
|---|---|---|---|
| You visit the website | IP address, browser, time, requested page (server logs of our hosting) | Running and securing the website; legitimate interest | As short as possible, at most 30 days |
| You request a demo | Name, garage, email, phone, your preference for the demo, a pseudonymised IP address | Contacting you and planning the demo; steps at your request before entering into an agreement | 12 months after the last contact if no customer relationship follows |
| You use Carmantic as staff | Name, email, password (only as a hash), two-step verification, role, your fixed signature, sessions (IP address and browser), who did what in a dossier | Giving you access, providing the service and proving who did what; performance of the agreement with your employer and legitimate interest | As long as your account exists; sessions at most 30 days; a dossier's log as long as that dossier exists |
| Billing | Name and address of the business, VAT number, billing contact, invoices and payments | Invoicing and keeping our accounts; performance of the agreement and legal obligation | 10 years (statutory accounting retention) |
| Something goes wrong | Technical details of the error, filtered so that names, account numbers and photos are not sent | Finding and fixing errors; legitimate interest | At most 90 days |
| You email us | Your email and what you write to us | Answering your question; legitimate interest | As long as needed for your question, at most 3 years |
A pseudonymised IP address is an IP address we transform irreversibly (hash) before storing it. This lets us recognise misuse without keeping your real IP address.
5. Data outside the European Union
Some suppliers are US companies or process data in the US. Such transfers are based on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses, with additional measures such as encryption. Where we can, we choose servers in the European Union.
6. Security
All connections are encrypted. Each garage sees only its own dossiers. We store passwords and personal links only as a hash. Two-step verification is available to every user and mandatory for our administrators. Large files are shared only through temporary, secured links. We make regular backups.
7. Your rights
You have the right to access your data, to have it rectified or erased, to have its processing restricted, to take it with you and to object to processing based on legitimate interest.
Send your request to support@carmantic.be. We answer within one month and may ask you to prove who you are.
If you are not satisfied, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.
8. What we do not do
We do not take decisions about you based solely on automated processing, we do not build profiles and we do not use cookies or trackers for advertising or statistics. The cookies we do use are listed in the cookie statement.
9. Changes
We update this statement when our processing changes. The date at the top shows the latest version. We inform our customers of important changes by email.