Privacy notice

1. Who is responsible and how to contact us

MILAN MOTORS AUCTION ORGANIZING L.L.C, a single-owner limited liability company, trading as Milan Motors, licence 909319 issued by the Department of Economy and Tourism in Dubai, registered at Shop R.04, The Atria Residence, Marasi Drive, Business Bay, Dubai, United Arab Emirates, is the controller of personal data it decides to process for the purposes described here. Privacy and rights requests: milanmotors95@gmail.com; +971 55 855 8222; +971 4 834 2250. Independent banks, insurers, authorities and other providers may be separate controllers for their own services. We identify the relevant provider before referring a request. This notice is information about processing, not a waiver of rights or blanket permission for every use.

2. Information involved

Depending on your interaction, information may include your name, contact details, enquiry and correspondence; vehicle make, model, year, mileage, specification, price, history, photographs and ownership-related information; appointment and service requirements; and transaction, invoice, consent or complaint records. Identity, ownership, finance or insurance documents are requested only when necessary for a specific lawful transaction through an agreed appropriate channel. Browsing also involves technical data such as IP address, request time, page or file requested, browser/device information and security events processed by infrastructure providers. Do not send passwords, one-time codes, full payment-card details or unrelated sensitive information. Redact unnecessary personal details in vehicle photographs and documents.

3. Website forms and WhatsApp

Submitting a website enquiry sends the name, phone number, selected vehicle details, requested service and message you provide to our private enquiry system hosted by Supabase in Sydney, Australia. Authorised staff can review it and respond. The form confirms successful saving with a reference number; if confirmation fails, your entries remain in the form so you can retry or contact us directly. A retry of the same request is checked to limit duplicate records. Sending does not confirm a purchase, booking, finance approval or insurance. After saving, you may choose an optional WhatsApp link containing your request and reference. Opening that link can disclose the prepared text and associated technical data to WhatsApp/Meta even before you press Send, and the URL may appear in browser history. Sending the WhatsApp message delivers an additional copy to our business account. WhatsApp’s terms and privacy policy also apply. Do not include identity documents, bank statements, salary information or payment details in these initial enquiries. You may contact us by phone or email instead. Website delivery and security may also generate technical provider logs.

4. Sources of information

We receive information from you or an authorised representative, vehicle owners supplying listings, communications and service or transaction records. Where relevant to your request, information may also come from the independent provider you choose, inspection reports, ownership documentation or lawfully available vehicle-history sources. We seek only information relevant to the purpose and do not treat another person's possession of your details as unrestricted permission to use them. Ask us about the source of information relating to you.

5. Purposes and legal grounds

We use relevant data to respond to your request; arrange appointments, valuations, purchases, sales, consignment or requested support; verify necessary vehicle and transaction details; prepare and perform agreements; issue invoices and keep legally required records; address complaints, fraud, security incidents and legal claims; and manage authorised administration and approved vehicle listings. Processing relies on specific valid consent where required, steps requested toward or performance of a contract where the applicable law permits, compliance with a legal obligation, or another specifically applicable statutory exception. An enquiry authorises only the processing appropriate to that request, not unrelated marketing. If essential information is withheld, we may be unable to complete the requested service; we will explain what is needed and why.

6. Sharing and independent providers

Access and disclosure must be limited to what the purpose requires. Recipient categories include authorised personnel; hosting, database, storage, authentication, communications and IT providers; the vehicle owner, buyer or other transaction party where necessary; the bank, insurer, inspection centre, workshop, detailing, tinting or protection-film provider you request; professional advisers, auditors, insurers and competent authorities where lawfully required. This website uses Vercel for hosting and Supabase for public vehicle content, media and restricted administration; email and WhatsApp involve their respective communications providers. A referral is not permission to send a complete customer file to every partner. Providers handling data on our instructions require appropriate contractual and security arrangements; independent controllers apply their own notices and legal duties. We do not sell personal data or trade enquiry lists.

Website enquiry records are private and accessible only to authorised staff; they are not published with the vehicle catalogue.

7. Public listings and photographs

An approved listing can make vehicle details, photographs and its price publicly available and searchable; a sold record may remain in an agreed historical archive. We must have appropriate authority and a lawful basis before publication. Personal contact details, identity documents and ownership documents are not intended for public listings. Avoid or redact unnecessary faces, number plates, addresses and other personal identifiers. Public material can be copied or cached by search engines and others; removing our copy cannot guarantee instant removal everywhere. Contact us to correct or withdraw personal material. Retaining evidence of a transaction does not automatically justify keeping a person's photograph publicly displayed.

8. International processing

Cloud hosting, communications and support may involve processing outside the UAE, including countries in which Vercel, Supabase, WhatsApp/Meta, email providers or their authorised subprocessors operate. This notice does not claim that all data stays in the UAE. Where we control a cross-border transfer, it must use a lawful mechanism and the protections required by the applicable law, such as an applicable adequacy arrangement, appropriate contractual safeguards or a specific lawful exception. Merely using the website is not express consent to every international transfer. The primary Supabase project used for this website is hosted in Sydney, Australia. Hosting delivery, support, communications and provider account data may also be handled internationally, including in the United States, Singapore and other locations described by the relevant provider. The exact locations depend on the service and its subprocessors. We restrict access to authorised purposes and require the lawful transfer mechanism and safeguards applicable to the processing; this notice does not represent a certification of any country or provider.. Contact us for further information about the recipients and protections applicable to your request.

9. Retention and disposal

We keep identifiable information only as long as needed for its stated purpose and applicable legal duties. Enquiry correspondence that does not lead to a transaction is reviewed for deletion or anonymisation no later than 12 months after the last substantive interaction, unless an active request, complaint or legal requirement justifies longer retention. Necessary contract, invoice and tax evidence is kept for the applicable statutory period; corporate-tax records, where the relevant duty applies, are generally retained at least seven years after the end of the relevant tax period. This does not justify retaining every identity document or photograph for that period. Public personal content is removed when the agreed listing purpose or permission ends unless another lawful basis applies; a limited non-personal sold-vehicle record may remain. Security logs and backups follow provider-specific periods and necessary incident holds. Retention for a dispute is limited to the relevant evidence and need. Deletion from active systems and expiry of backups may occur at different times; retained copies must remain restricted.

To limit abuse and duplicate submissions, our intake service keeps keyed, pseudonymous network, phone and request identifiers in a restricted system table. These records are used for short-term checks; entries older than 48 hours are removed during subsequent successful submissions. We do not store raw IP addresses in this intake table; infrastructure providers may retain their own technical logs.

10. Cookies, browser storage and links

The current public website does not implement advertising pixels or optional analytics cookies. Essential infrastructure may process technical data for delivery and security. Restricted administration uses per-tab session storage for sign-in and the selected interface language. Public inventory and images are fetched from Supabase, so the visitor's device contacts that service. External maps, Instagram and WhatsApp are links; opening them involves the destination provider's own processing and possible cookies. We will update this notice and provide any required choice before introducing optional tracking. Browser controls may restrict cookies or storage but can affect features. A privacy notice alone is not a substitute for consent where consent is required.

11. Marketing and automated decisions

The website enquiry consent is not a subscription to marketing calls, messages or mailing lists. Unrelated promotions require a separate lawful basis and, where required, a distinct opt-in; any future marketing must respect applicable restrictions and opt-outs. You can object to direct marketing and withdraw any marketing consent through the contact above. Necessary responses about an active request are distinct from advertising. Milan Motors does not use this website to make solely automated credit, insurance or other decisions producing legal or similarly significant effects. A provider's eligibility assessment is governed by that provider's role and notice; ask for human review where the applicable law gives that right.

12. Your rights and complaints

Subject to the applicable law and its conditions, you may request information about processing and recipients; access or a copy; correction or completion; erasure; restriction or stopping of processing; portability where applicable; objection to direct marketing; and review of qualifying automated decisions. You may withdraw consent for future consent-based processing without affecting earlier lawful processing. We may verify identity proportionately and request only what is necessary to protect your information. We handle requests within applicable deadlines without unjustified delay and explain any lawful refusal or retention requirement. Deletion may be limited by legally required records or relevant legal claims. You may complain to us and to the competent data-protection authority, including the UAE Data Office where it has jurisdiction, without first exhausting our internal process. Additional mandatory rights apply where the law extends them to your circumstances.

13. Security and children

We use appropriate access restrictions and technical and organisational measures for the relevant processing; restricted administration includes multi-factor authentication. No internet or messaging system can be guaranteed entirely secure. Contact us promptly if information appears misdirected or access is compromised; do not send credentials. Incidents must be assessed and notified to the appropriate authority and affected persons where legally required. The site and its transaction services are intended for adults with legal capacity, not for children, and we do not intentionally solicit children's personal data or target advertising to them. A parent or guardian who believes a child has supplied data should contact us so that it can be assessed and appropriately removed or otherwise handled under the applicable law. An adult-only statement does not remove duties that apply if children's data is actually processed.

14. Changes and language

We publish a version and effective date when this notice takes effect or changes. Material changes in purposes, recipients, international transfers or optional tracking require updated information and any consent or other steps required by law before the new processing begins. We do not obtain new consent by silently changing a page. Arabic, English, Russian and Simplified Chinese versions are intended to convey the same information; mandatory legal rights prevail over any translation inconsistency. Contact us if a translation is unclear.