Carpaydiem Privacy Notice

Introduction and Scope

This Carpaydiem Privacy Notice ("Privacy Notice") applies to the collection and processing of personal data in connection to the use of the website ("Website") and all services (including used car sales/auction, brand-new/used car component sales, bidding/selling agency), products and tools ("Services") offered by Carpaydiem Co., Ltd.

Data Controller

The responsible data controller for any personal data collected and processed in connection with the use of the Website and our Services is Carpaydiem Co., Ltd., Verde Aoyama Building 5th Floor, 2-6-12 Shibuya, Shibuya-ku 150-0002, Tokyo, Japan ("Carpaydiem", "we" or "us").

Contact Details and Representative

If you have any questions about or in connection with this Privacy Notice or would like to complain about our handling of your personal data or exercise any of your rights (see Section 11 below), please contact us under the following email:

The contact details of our representative in the European Union are:
Head of Risk Management Department and Chief Compliance Officer at Toyota Tsusho Europe, based at 13 Belgicastraat, 1930 Zaventem, Belgium, mail:

Data Subjects

This Privacy Notice applies to the collection and processing of personal data of users of the Website and our Services.

Categories of Data and Source

Personal Data voluntarily provided by you

The following personal data is only collected when you register on our Website. The provision of the following personal data is voluntary (however, if you do not provide the personal data, it may be impossible to enter into a contractual relationship with us and the provision of services by us may be delayed or impossible):

  • Account and profile information (email address, selected password, name, nickname, gender, country, date of birth, telephone number, WhatsApp number, import record, whether or not you allow us to send a direct email to you);
  • Payment information (bank account, currency, payment method, units, referral code);
  • Shipping information (address, city, country, name, port, destination country, destination port, telephone number); and
  • Data collected when you contact us through the Website (name, email address, telephone number, message content).

You may review or update information about you which you have provided to us in your account by accessing your profile page. If you would like to exercise your data protection rights, please see Section 11 below.

Personal data collected automatically:

In addition to the personal data that you actively provide when registering on our Website, the following information regarding the use and interaction with our Website and Services may be automatically collected, processed and stored through the Website when you use our Website and Services:

  • Internal identifier;
  • Number of inquiries/invoices/payments;
  • Date of payment;
  • Referral status (whether or not you have used referral codes);
  • Model of car
  • Vehicle Identification Number (VIN)
  • Registration number
  • Type of the user device and operating system;
  • Websites from which the system of the user comes to our Website (referrer information);
  • URLs viewed and time stamp of the time viewed;
  • IP address;
  • Information regarding the products you have searched;
  • Server log information; and
  • Other website analytics and device and usage information.

Purposes of the Processing and Legal Basis

Below you can find a description of the purposes for which we process personal data and the relevant legal basis.

We process your personal data in order to fulfill our contract with you or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6 (1) (b) GDPR), including for the following purposes:

  • Registration for the Website and our Services;
  • Processing of data relating to you for the purpose of entering into a contract with you; and
  • Performance of contractual relationship with you (including fulfilling the contractual obligations, provide our Services, invoice processing, communication, customer support, enforcement of any contractual terms).

We process your personal data based on your consent (Art. 6 (1) (a) GDPR) for the following purposes:

  • Marketing communication by electronic mail (including promotional messages, advertising and other information you may be interested in), unless these communications are legally permitted without consent; and
  • Measurement and improving the performance of the Website as well as personalization, measurement and improvement of our and third-party advertisements (also see Section 12 "Cookies and similar technologies").

We process your personal data in order to comply with legal obligations (Art. 6 (1) (c) GDPR) to which we are subject, including for the following purposes:

  • Participation in investigations and proceedings (including judicial proceedings) conducted by public authorities or governmental authorities, in particular, for the purpose of detecting, investigating and prosecuting illegal acts; and
  • Complying with legal retention obligations (see Section 9 "Storage Period" below).

We process personal data to the extent necessary for the purposes of the legitimate interests pursued by us or by a third party (Art. 6 (1) (f) GDPR), including for the following purposes:

  • Maintain information security;
  • Communication and provision of the Website and our Services to the extent it is not already necessary perform a contract with you or in order to take steps prior to entering into a contract (e.g., respond to general requests or inquiries, including complaints);
  • Participation in proceedings (including judicial proceedings) conducted by courts, law enforcement agencies, government agencies or public authorities, intergovernmental or supranational bodies, in particular for the purpose of detecting, investigating and prosecuting illegal acts, unless there is a statutory obligation;
  • Prevention, detection, investigation, mitigation and remediation of fraud, spam, abuse, security incidents and other prohibited, unlawful or harmful activities, including the assessment of corresponding risks;
  • Managing and enabling verification of users as well as the access to and the use of the Services including login, vehicle search, auction functionality, payment functionality; and
  • Improving our Website and Services.

More information regarding the balancing of interest test carried out for the above purposes is available upon request.

For detailed information on our use of Cookies and similar technologies, please see Section 12 below.

Recipients and Categories of Recipients

Any access to your personal data at Carpaydiem is restricted to those individuals that have a need to know in order to fulfill their job responsibilities. Carpaydiem will transfer your personal data for the respective purposes to the recipients and categories of recipients listed below:

Service Providers: We use third party service providers to provide our Services on our behalf and will share your personal data with them as necessary for the provision of the Services (this includes data analytics services, marketing automation services, review request automation services, and business efficiency services). Our service providers are contractually obligated to process such data on behalf of Carpaydiem under appropriate instructions as necessary for the respective processing purposes and to appropriately protect your personal data. Our service providers may not otherwise process or share your personal data, except as permitted by law. We use service providers to communicate news and deliver promotional and transactional materials to you, including personalized online advertising, and direct email.

Governmental authorities, courts, external advisors, and similar third parties that are public bodies as required or permitted by applicable law, in order to: (i) ensure compliance with applicable laws, (ii) respond to governmental inquiries or requests from public authorities, (iii) comply with valid legal process, (iv) protect the rights, privacy, safety or property of Carpaydiem, Website visitors, guests, employees or the public, (v) permit us to pursue available remedies or limit the damages that we may sustain, (vi) enforce our Websites' and Services' terms and conditions, and (vii) respond to an emergency.

Private third parties: We may share your personal data with unaffiliated private bodies other than us to be able to provide our Services to you, including to process and facilitate your orders, payment and shipping. Such unaffiliated private bodies may include merchants and business partners.

Cross-Border Data Transfer

The personal data that we collect or receive about you may be transferred to and processed by recipients which are located inside or outside the European Union ("EU") or the European Economic Area ("EEA") and which do not provide for an adequate level of data protection. The countries that are recognized to provide for an adequate level of data protection from an EU law perspective (Art. 45 GDPR) are Andorra, Argentina, Canada (commercial organizations), Faroe Islands, Guernsey, the State of Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom under the GDPR and the LED (Law Enforcement Directive), the United States (commercial organizations participating in the EU-US Data Privacy Framework) and Uruguay. To the extent your personal data are transferred to countries that do not provide for an adequate level of data protection from an EU law perspective, we will base the respective transfer on appropriate safeguards, such as standard data protection clauses adopted by the European Commission (Art. 46 (2) GDPR), where this is required under applicable law. You can ask for a copy of such appropriate safeguards by contacting us as set out in Section 3.

Storage Period

Your personal data is stored by Carpaydiem and/or our service providers, strictly to the extent necessary for the performance of our obligations and strictly for the time necessary to achieve the purposes for which the personal data is collected, in accordance with applicable data protection laws. When Carpaydiem no longer needs to process your personal data, we will erase it from our systems and/or records and/or take steps to properly anonymize it so that you can no longer be identified from it unless we need to keep your information to comply with statutory or regulatory obligations to which Carpaydiem is subject.

In addition, if a judicial or disciplinary action is initiated, the personal data will be stored until the end of such action, including any potential periods for appeal, and will then be deleted or archived as permitted by applicable law.

Automated decision-making

We may use personal data on your online behavior for automated decision-making including profiling to improve our marketing efficiency.

Your Rights

If you have declared your consent for any personal data processing activities, you can withdraw this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal.

Pursuant to applicable data protection law you have the following rights which you may exercise by contacting us at

  1. Right of access: You have the right to obtain from us confirmation as to whether or not personal data concerning you is processed, and, where that is the case, to request access to the personal data. The access information includes - inter alia - the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed. However, this is not an absolute right, and the interests of other individuals may restrict your right of access.

    You also have the right to obtain a copy of the personal data undergoing processing. For further copies requested by you, we may charge a reasonable fee based on administrative costs.

  2. Right to rectification: You have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

  3. Right to erasure ("right to be forgotten"): Under certain circumstances, you have the right to obtain from us the erasure of personal data concerning you and we may be obliged to erase such personal data.

  4. Right to restriction of processing: Under certain circumstances, you have the right to obtain from us restriction of processing your personal data. In this case, the respective data will be marked and may only be processed by us for certain purposes.

  5. Right to data portability: Under certain circumstances, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another entity without hindrance from us.

  6. Right to object: Under certain circumstances, you have the right to object at any time to the processing of your personal data by us on grounds arising from your particular situation, and we can be required not to process your personal data any longer.

    If personal data is processed for direct marketing purposes, you have an additional right to object at any time to the processing of personal data in relation to you for the purpose of such marketing. This also applies to profiling where this is connected to direct marketing. In that case, the personal data will no longer be processed by us for these purposes.

In addition to the rights set out above, you also have the right to lodge a complaint with the competent data protection supervisory authority.

Cookies and similar technologies

General Information

  1. What are Cookies and similar technologies and what information do they collect?

    When you visit our Website or view our Services online, we or an authorized third party may send you a cookie. Cookies are small text files that may be placed on your device. When a website is accessed, a cookie that is placed on a device will send information to the party that has placed the cookie. Cookies are common and used on a number of websites. Each cookie will typically contain the name of the domain from which the cookie has come, the "lifetime" of the cookie and usually the IP address or another unique number of the device, and thus may contain personal data, i.e., information relating to an identified or identifiable natural person (see Section 5.2 for more information on what personal data is collected and processed through our use of Cookies and similar technologies).

  2. Session and Persistent Cookies

    Our Website may place session and persistent cookies on your device. The difference between a session and a persistent cookie relates to the length of time the cookie lasts. Session cookies are cookies that typically last for as long as you are using your browser, or browser session. When you end your browser session, the cookie expires. Persistent cookies, as the name implies, are persistent and will last after you close your browser. This allows, for example, for quicker and often more convenient access to our website.

  3. First Party and Third-Party Cookies

    Our Website may place first party cookies and allow third parties to place cookies on your device. The difference between a first party cookie and a third-party cookie relates to the control of the party who serves the cookie. First party cookies are cookies that are specific to the website that created them. Their use enables us to operate an efficient service and to track the patterns of behavior of visitors to the website. Third-party cookies, on the other hand, are placed on your device by a third party (i.e., not by us). While we may allow third parties to access the website to place these cookies on users' devices, we do not retain control over the information supplied by the cookies, nor do we retain access to that data. This information is controlled wholly by that third party.

  4. Web beacons, Pixel and other similar technology

    Our Website may use web beacons, pixel and other similar technology (collectively referred to as "tracking technology") which allows us and third parties to track your use of our Website. Such tracking technology is embedded into our Website and used on your device when you access and load our website.

Details on the cookies and tracking technologies used on the website

Withdrawing consent, Disabling, and/or Browser settings

To the extent that you have given consent, you can withdraw your consent at any time with future effect via our . Such a withdrawal will not affect the lawfulness of the processing prior to the withdrawal of consent.

You can also change your selections for the usage of certain types of cookies and similar technologies in our .

In addition, most web browsers allow at least some control of most cookies through browser settings. You may refuse the use of cookies by selecting the appropriate settings on your browser to decline cookies. You may also delete existing cookies through your browser.

However, please note that if you withdraw your consent or disable cookies, you may not be able to use the full functionality of our Website. In particular, you may have limited access to some areas or be transitioned to a different experience.

Changes to the Privacy Notice

This Privacy Notice may require an update from time to time - e.g., due to the implementation of new technologies or the introduction of new services or features. We reserve the right to change or supplement this Privacy Notice at any time. We will publish the changes on our Website and/or inform you accordingly (e.g., via email).