CamperProffB2B Camper & Caravan ExchangeVersion 1.8 · effective 12 November 2026 · with the statistics addendum of 18 October 2026 · with the ad measurement addendum of 12 November 2026 · with the inquiries and emails addendum of 25 October 2026
Privacy policy
Diese Seite gibt es noch nicht auf Deutsch. Unten steht die englische Fassung; verbindlich ist die dänische Fassung.
This policy describes what personal data CamperProff processes, why, and what rights you have. It applies to visitors to the website, businesses on the interest list (/registrer) and dealers and their staff with an account on the platform and in the app. Version 1.8 replaces version 1.7 of 4 November 2026. This is an English translation of the Danish privacy policy. The Danish version is legally binding.
Data controller
The data controller is CamperProff ApS (which operates the website and the trade name CamperProff), CVR 46885279, Stiftsvej 35, 7120 Vejle Øst, Denmark. Contact regarding data protection: sebastian@camperproff.dk.
What information we collect
The sign-up on /registrer collects the contact name, email, telephone number, company name, the company's address (street, postcode and city), CVR/VAT number, country, an optional message and the sender's IP address. The password is created in Supabase Auth when the account is approved, not at sign-up. For dealers with an account we also process the users' names, emails and telephone numbers, login and session information (see our cookie policy), role and permissions, CVR/VAT number, vehicle data on listed and traded vehicles (VIN, registration number, photos, moisture and condition data), bids, trade history and reference, invoices and the stored acceptance event (actor, time, terms version) for a trade. When you are logged in, we register which listings and auctions you open and when, together with your company and its country. For security and troubleshooting we log who did what and when, with a shortened IP address (the network, not the full address) and a hash of the session. When the company opens its payment account, the contact person enters name, email, telephone and date of birth and the company's bank account. We send these directly to the payment provider. We do not store the date of birth ourselves. We also keep the account number for our DAC7 report to the Danish Tax Agency. We process a Danish personal identity number (CPR number) only for the owner of a sole proprietorship that sells through the platform: the DAC7 report needs the owner's name, CPR number and date of birth. Only Assessment can see the CPR number, it is otherwise shown only with the last four digits hidden, and we pass it on to the Danish Tax Agency only. For push notifications, we store the device's APNs token, the app's device ID (IDFV), push environment and registration timestamps with your account. They are used for notifications about your account, listings and trades according to your notification settings, not for advertising or tracking.
Where the information comes from
Besides what you enter yourself, we obtain information from public registers: the company's data from the Danish CVR register, the validity of the VAT number from the EU's VIES system, vehicle data from the Danish Motor Register via MotorAPI and from the Dutch vehicle register RDW, and liens and inspections for Danish vehicles from the Danish register of motor vehicle charges (Bilbogen) via Synsbasen. From Bilbogen we keep only a summary; we do not keep the names and dates of birth of debtors or private creditors. If the company has switched on import from Danbase, we fetch its vehicles from there. From the payment provider we only learn whether the identity check is approved, not the documents.
Purposes and legal basis
Account, bids, agreements, payment and invoicing: performance of a contract (GDPR Art. 6(1)(b)). Bookkeeping, VAT and the annual report to the Danish Tax Agency under the rules on reporting by digital platforms (DAC7): legal obligation (Art. 6(1)(c)). We process the CPR number of a sole proprietorship's owner because the DAC7 rules require it (section 11(2)(1) of the Danish Data Protection Act and Art. 6(1)(c)). Operational security, abuse prevention and troubleshooting: legitimate interest (Art. 6(1)(f)). Guaranteed prices, valuations, model catalogues and market statistics based on vehicle data and trade prices: legitimate interest (Art. 6(1)(f)); contact details and photos are not included, and outside the platform we share only aggregated figures. Statistics on buyers' interest in listings and auctions, based on which listings logged-in users open: legitimate interest (Art. 6(1)(f)); we use them to run the marketplace and to report to our board, we do not pass the information on to others, and the reports contain aggregated figures only. Your sign-up to the interest list on /registrer: steps prior to entering into a contract at your own request, or legitimate interest (Art. 6(1)(b)/(f)). We send news about the platform and upcoming auctions by email only to dealers with an account and to businesses that asked to hear from us when they signed up, in line with section 10 of the Danish Marketing Practices Act: legitimate interest (Art. 6(1)(f)). Every email has an unsubscribe link. We do not sell information and do not use it for advertising.
Recipients and transfers
These providers process information on our behalf: Supabase (database, login and files; data is stored in Ireland), Vercel (running the website and the app's server in Ireland, and backup copies of files), Resend (sending emails), Dinero (bookkeeping and invoices) and OpenAI (AI drafts, which a person always checks before they are used: for the valuation behind a guaranteed price, where OpenAI receives vehicle data only, and for answers to inquiries to our support, where OpenAI receives the message with email addresses and phone numbers masked and, when the sender has an account, the company's own listings and trades; never the sender's name, address, phone number or company name. In addition, machine translation of the seller's free text in a listing (remarks, notes on moisture readings and reasons) into the buyer's language, where OpenAI receives only the text and the languages, not who wrote it. The translation is not checked by a person; it is shown marked “machine-translated” next to the original, and the original prevails). We have concluded a data processing agreement with each of these providers. These recipients are controllers in their own right: the payment provider PayProff, which opens the payment account, checks the identity of the company and its contact person under the Danish Anti-Money Laundering Act and carries out the payment, and which has its own privacy policy; the other party to a concluded trade (company name, address, VAT number, business email and telephone, as stated in the purchase agreement, and, for the buyer, the papers the seller uploaded for the vehicle, which may contain information about previous owners); the Danish Tax Agency and other authorities where bookkeeping, VAT or DAC7 requires it (for sellers, among other things, identity, VAT number, account number, the consideration for the trades and our fees); the bookkeeper and auditor; and, only if a GMP partner is active, that partner. Supabase, Vercel, Resend and OpenAI may access information from countries outside the EU/EEA, even when it is stored in the EU. Vercel and Resend are US companies. Supabase has companies in Singapore and the US, and information may be transferred to both countries. OpenAI processes information from customers in the EU/EEA through its Irish company, OpenAI Ireland Ltd, which may transfer it to other OpenAI companies and sub-processors outside the EU/EEA, including in the US. Transfers to the US are based on the European Commission's decision on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's standard contractual clauses. Transfers to Singapore are based on the European Commission's standard contractual clauses. Push notifications are delivered through Apple Push Notification service (APNs). When a notification is sent, Apple receives the device's APNs token, the notification text and relevant listing or trade references. The app's device ID (IDFV) is not included in this transmission.
Retention
Trade-related data and invoices are kept for 5 years after the end of the financial year. Information for the DAC7 report is kept for as long as the rules require. Data on sign-ups to the interest list without a completed trade is kept for 2 years after the last substantive contact. In the security log, the shortened IP address and the session hash are deleted after 90 days and the event itself after 2 years. The content of calls to the payment provider is deleted after 13 months. The record of which listings and auctions you have opened is deleted after 12 months. If you ask for your account to be deleted, we delete the account and your personal data within 30 days, except what the Danish Bookkeeping Act requires us to keep. Data needed to meet a continuing bookkeeping or legal obligation is not deleted until the obligation expires. Aggregated figures and model catalogues without information about persons may be kept longer. Push registrations are updated when the app registers the device again. The app attempts to unregister the device when you sign out. A new registration replaces the previous one. We also attempt to remove a registration when Apple reports the token as invalid. When you request account deletion, we immediately attempt to remove your push registrations. There is no separate automatic deletion period for inactive push registrations.
Security
Access to operational and trade data is role-based. Photos and other private uploads go through authenticated routes to private storage and are not publicly accessible. Your session is re-verified server-side on every request.
Automated decisions
We do not make decisions about you as a person based solely on automated processing. The platform automatically rejects bids above the cap on open purchases and pauses bidding on payment default; this is based on the company's trades, and Assessment can change it. A guaranteed price is always approved by a person, also when an AI made the draft.
Your rights
You can request access, rectification, erasure, restriction and data portability, and you can object to processing based on legitimate interest. You can always object to news emails and unsubscribe through the link in the email. The right to erasure yields to our bookkeeping obligation. You can ask for your account to be deleted in the app or by writing to us. Contact sebastian@camperproff.dk to exercise your rights; we confirm receipt and normally respond within 30 days. You can lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, www.datatilsynet.dk.
Cookies
See our cookie policy for which cookies the platform sets, and why.
Google Analytics after consent
The purpose is to understand traffic and how many visitors start or complete a dealer enquiry. Processing starts only after voluntary consent, which you can withdraw in Cookie choices without affecting sign-up or use of the platform. Google Ireland Limited provides Analytics; Google may also process data outside the EU/EEA under its data processing terms. See https://business.safety.google/adsprocessorterms/ and https://policies.google.com/privacy. We do not link statistics to your account or trades. Withdrawal does not automatically erase data already collected; contact us about your rights. The cookie policy describes the data and cookies in more detail.
Google Ads measurement after consent
The purpose is to see how many of the dealers who click our ads on Google complete a sign-up, so we can steer the advertising budget. Processing starts only after voluntary consent to ad measurement, which is separate from consent to statistics and can be withdrawn in Cookie choices without affecting sign-up or use of the platform. Google Ireland Limited provides Google Ads; Google may also process data outside the EU/EEA under its terms. See https://business.safety.google/adsprocessorterms/ and https://policies.google.com/privacy. We do not use ad measurement data for personalised advertising, remarketing or audiences, and we do not link it to your account or trades.
Inquiries, listing reports and emails
If you write to us through the contact form on /kontakt, we process your name, your email, your telephone number and your company if you give them, the language of the page and your message. If a dealer reports a listing with "Report listing", we process the reporter's name, email and company, the listing, the reason and the message; the seller is not told who reported the listing. The inquiry is emailed to us and stored in our support inbox together with our answer. If the email is the one an active user signs in with, we link the inquiry to that user's account and company, so that we can answer with the account in mind. A report is always linked to the reporter's account. The purpose is to answer the inquiry and handle the report. The legal basis is our legitimate interest in answering inquiries (Art. 6(1)(f)) and, for reports, our obligation to handle notices of illegal content under the Digital Services Act (Art. 6(1)(c)). The inquiry and our answer are deleted automatically from the support inbox 2 years after their last change. Emails that the platform sends through our sending queue are held there with their recipient, subject and content, and are deleted automatically from the queue 30 days after they were sent or, if they could not be sent, 90 days after the last attempt.