DATA PROTECTION POLICY

Effective Date: 01/03/2025

Last Updated 02/04/2025

1. INTRODUCTION

Carfax Commerce Inc (“Company”) respects your privacy and is committed to protecting your personal data in compliance with the Seychelles Data Protection Act, 2023 (DPA 2023). This Data Protection Policy outlines how we collect, use, disclose, store, and protect your personal information when you use our website www.accmarket.com and services.

By accessing or using our website, you agree to the practices described in this policy.

________________________________________

2. DATA CONTROLLER & CONTACT INFORMATION

The Data Controller responsible for the processing of your personal data is:

Carfax Commerce Inc

Company No: 238058

Registered Address: Suite 1, Second Floor, Sound & Vision House, Rue de La Possession, Victoria, Mahe, Seychelles

Email: [email protected]

Phone: +2482544931

If you have any questions or concerns regarding this policy or how we handle your personal data, please contact our Data Protection Officer (DPO) at [email protected]

________________________________________

3. TYPES OF DATA WE COLLECT

We collect and process the following categories of personal data:

• Contact Data: Email address, phone number, postal address.
• Account Data: Login credentials, account activity, and preferences.
• Financial Data: Payment details, billing information, and transaction records.
• Technical Data: IP address, browser type, operating system, device information.
• Usage Data: Information on how you use our website, services, and interactions with us.
• Marketing Data: Your communication preferences and participation in promotional activities.

We do not process sensitive personal data (e.g., race, religious beliefs, health data) unless required by law or with your explicit consent.

________________________________________

4. HOW WE COLLECT YOUR DATA

We collect data from you through the following means:

• Direct interactions: When you provide personal data through our website, sign-up forms, inquiries, or communication with our support team.
• Automated technologies: Cookies, analytics tools, and log files that collect Technical and Usage Data.
• Third parties: Business partners, service providers, and public sources.

For more details, see our Cookie Policy.

________________________________________

5. PURPOSES OF DATA PROCESSING

We process personal data for the following purposes, in compliance with the DPA 2023

We do not use personal data for automated decision-making or profiling without your explicit consent.

________________________________________

6. DATA RETENTION POLICY

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy, or as required by law. The general retention periods are:

• Account and transaction records: 5 years from the last transaction.
• Marketing data: Until withdrawal of consent.
• Website analytics data: 6 months (or as per cookie settings).

Once the retention period expires, personal data is securely deleted or anonymized.

________________________________________

7. DISCLOSURE & THIRD-PARTY SHARING

We may share your data with the following:

• Service providers (e.g., payment processors, hosting providers).
• Regulatory authorities (if required by law).
• Business partners (with your consent).

We do not sell, rent, or trade your personal data with third parties.

________________________________________

8. CROSS-BORDER DATA TRANSFERS

If personal data is transferred outside Seychelles, we ensure that it is done in compliance with DPA 2023 by:

• Transferring data to countries with adequate protection levels.
• Using contractual safeguards such as Standard Contractual Clauses (SCCs).
• Obtaining your explicit consent if no other legal basis applies.

________________________________________

9. YOUR RIGHTS UNDER THE DPA 2023

As a data subject, you have the following rights under DPA 2023:

1. Right to Access – Request a copy of your personal data.
2. Right to Rectification – Request correction of inaccurate data.
3. Right to Erasure ("Right to be Forgotten") – Request deletion of your data under certain conditions.
4. Right to Restrict Processing – Limit processing in specific circumstances.
5. Right to Data Portability – Receive your data in a structured format.
6. Right to Object – Object to processing based on legitimate interests or direct marketing.
7. Right to Withdraw Consent – Withdraw consent at any time where processing is based on consent.

To exercise your rights, please contact us at [email protected]

________________________________________

10. DATA SECURITY MEASURES

We implement technical and organizational measures to protect your personal data, including:

• Encryption & Secure Servers: Protects data from unauthorized access.
• Access Controls: Restricts access to authorized personnel only.
• Regular Audits & Monitoring: Ensures compliance with security standards.

Despite these measures, no system is completely secure, and we encourage users to take precautions when sharing data online.

________________________________________

11. CHANGES TO THIS POLICY

We may update this Data Protection Policy from time to time to reflect legal updates or operational changes. We will notify users of any significant changes via email or website notification.

The latest version will always be available at accsmarket.com/en/privacy-policy

________________________________________

12. CONTACT INFORMATION & COMPLAINTS

If you have any questions about this policy or wish to file a complaint, you can contact:

Data Protection Officer (DPO): Alexey Savin

Carfax Commerce Inc

Company No: 238058

Registered Address: Suite 1, Second Floor, Sound & Vision House, Rue de La Possession, Victoria, Mahe, Seychelles

Email: [email protected]

Phone: +2482544931

If you believe your data rights have been violated, you have the right to file a complaint with the Information Commission of Seychelles:

Seychelles Information Commission

Website: https://www.infocom.sc

Email: [email protected]

________________________________________

By using our website, you acknowledge that you have read and understood this Data Protection Policy.