Last updated: 1 July 2025 · Effective: 1 July 2025
Data Controller: Motohive (trading as motohive.ie), Ireland.
Email: privacy@motohive.ie
Website: https://www.motohive.ie
For any question about how we handle your personal data, or to exercise a data subject right, contact us at privacy@motohive.ie. We aim to respond within five working days and are obliged to respond within one month under GDPR Article 12.
If you are not satisfied with our response you have the right to lodge a complaint with the Irish supervisory authority:
Data Protection Commission (DPC)
21 Fitzwilliam Square South, Dublin 2, D02 RD28
Web: www.dataprotection.ie · Phone: +353 (0)57 868 4800
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, profile picture, Google account ID | You provide it via Google Sign-In (OAuth 2.0) |
| Listing data | Vehicle details, photos, price, description, location (county) | You provide it when creating an ad |
| Contact data | Phone number (optional, if you add it to a listing) | You provide it voluntarily |
| Usage data | Pages visited, search queries, filters applied, time on site | Collected automatically |
| Technical data | IP address, browser type and version, device type, referrer URL | Collected automatically |
| Communications | Messages sent via the in-platform messaging system | You and the other party generate it |
| Payment records | Transaction reference, amount, date (no card details — we use third-party processors) | Payment processor provides a reference |
We do not collect special category data (Article 9 GDPR) such as health, biometric, or racial data.
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and manage your account | Art. 6(1)(b) — Performance of contract |
| Display your vehicle listing to other users | Art. 6(1)(b) — Performance of contract |
| Enable buyer–seller messaging | Art. 6(1)(b) — Performance of contract |
| Process listing fees and payments | Art. 6(1)(b) — Performance of contract; Art. 6(1)(c) — Legal obligation (tax records) |
| Detect and prevent fraud, curbstoning, and policy violations | Art. 6(1)(f) — Legitimate interests (protecting users and the integrity of the marketplace) |
| Comply with Consumer Rights Act 2022, Data Protection Act 2018, and other Irish/EU law | Art. 6(1)(c) — Legal obligation |
| Improve platform performance and fix bugs | Art. 6(1)(f) — Legitimate interests |
| Analyse how the site is used (Vercel Analytics) | Art. 6(1)(a) — Consent (you can withdraw via the cookie banner) |
| Send service notifications (e.g. listing expiry, new message) | Art. 6(1)(b) — Performance of contract |
| Send marketing emails | Art. 6(1)(a) — Consent (opt-in only; not currently active) |
Where we rely on legitimate interests (Art. 6(1)(f)), we have carried out a balancing test and concluded our interests do not override your rights. You have the right to object to any legitimate-interests processing — see section 7.
We do not sell personal data. We share data only as described below.
| Recipient | Purpose | Location & Safeguard |
|---|---|---|
| Other Motohive users | Your listing and (if provided) phone number are visible to users browsing the platform | EEA |
| Amazon Web Services (AWS) | Database (DynamoDB) and file storage (S3) — our eu-west-1 region is located in Dublin, Ireland | Ireland (EEA) — no transfer outside EEA |
| Vercel Inc. | Website hosting, deployment, and edge network | USA — EU–US Data Privacy Framework + Standard Contractual Clauses (SCCs) |
| Google LLC | OAuth 2.0 sign-in (Google Sign-In) | USA — EU–US Data Privacy Framework + SCCs |
| Vercel Analytics / Speed Insights | Anonymised usage and performance analytics (only if you consent to analytics cookies) | USA — SCCs; data is aggregated and not linked to individuals |
| Law enforcement / regulatory bodies | Where required by Irish or EU law, or in response to a valid legal request (e.g. Garda, DPC, CCPC) | Ireland / EEA |
| Data type | Retention period | Reason |
|---|---|---|
| Account profile | Until you delete your account, then 30 days in backup | To restore accidentally deleted accounts |
| Active vehicle listings | Until you remove the listing or account | Service delivery |
| Expired / removed listings | 90 days after removal | Fraud investigation and dispute resolution |
| In-platform messages | 12 months after the last message in a thread | Consumer dispute resolution (CRA 2022) |
| Payment / transaction records | 7 years from the date of transaction | Irish tax law (Taxes Consolidation Act 1997) |
| Server access logs (IP, request) | 90 days | Security monitoring |
| Analytics data (aggregated) | 26 months | Vercel Analytics default; no personal identifiers retained after anonymisation |
We implement technical and organisational measures appropriate to the risk, including:
• HTTPS/TLS encryption for all data in transit.
• Data at rest encrypted by AWS (AES-256).
• AWS S3 pre-signed URLs for vehicle images — links expire after one hour.
• Authentication via OAuth 2.0 (Google) — we never store your Google password.
• Role-based access controls: only authorised personnel and automated processes can access the database.
• Regular dependency updates and security patching.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the DPC within 72 hours and, where required, notify affected individuals without undue delay.
You have the following rights. To exercise any of them, email privacy@motohive.ie.
| Right | What it means |
|---|---|
| Access (Art. 15) | Request a copy of the personal data we hold about you. |
| Rectification (Art. 16) | Ask us to correct inaccurate or incomplete data. |
| Erasure (Art. 17) | Ask us to delete your data where there is no legitimate reason to continue processing it. |
| Restriction (Art. 18) | Ask us to suspend processing while a dispute is resolved. |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format, or have it transferred to another controller. |
| Object (Art. 21) | Object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds. |
| Withdraw consent (Art. 7(3)) | Where processing is based on consent (e.g. analytics cookies), withdraw it at any time via the cookie banner — without affecting prior processing. |
| Lodge a complaint | Contact the DPC at www.dataprotection.ie at any time. |
We do not use solely automated decision-making or profiling that produces legal or similarly significant effects (GDPR Art. 22).
This notice covers our use of cookies and similar technologies in accordance with the ePrivacy Regulations (S.I. No. 336/2011, implementing EU Directive 2002/58/EC as amended) and GDPR.
Cookies are small text files stored on your device when you visit a website. Similar technologies include localStorage (browser storage) and session identifiers embedded in URLs.
| Name / Type | Category | Purpose | Duration | Set by |
|---|---|---|---|---|
next-auth.session-token | Strictly Necessary | Maintains your authenticated session after sign-in | Session / 30 days | Motohive (NextAuth.js) |
next-auth.csrf-token | Strictly Necessary | Protects against cross-site request forgery | Session | Motohive (NextAuth.js) |
next-auth.callback-url | Strictly Necessary | Remembers where to redirect you after sign-in | Session | Motohive (NextAuth.js) |
motohive_cookie_consent (localStorage) | Strictly Necessary | Stores your cookie preference so we don't show the banner on every visit | Persistent (no expiry) | Motohive |
__vercel_live_token | Strictly Necessary | Used by Vercel to serve the site; contains no personal data | Session | Vercel |
_va (Vercel Analytics) | Analytics | Tracks anonymised page views and navigation to help us improve the site | Up to 24 hours | Vercel Analytics |
Speed Insights beacon | Analytics | Measures page load performance (Core Web Vitals); no persistent identifier | Session | Vercel Speed Insights |
Strictly necessary cookies are set without your consent because they are essential for the site to function. All other cookies are only set after you click 'Accept all cookies' in the banner.
You can change your preference at any time by clearing your browser's localStorage for motohive.ie — the consent banner will re-appear on your next visit.
You can also control cookies through your browser settings. Note that disabling strictly necessary cookies will break authentication. See your browser's help pages for guidance.
Motohive is not directed at or intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@motohive.ie and we will delete it promptly.
We may update this Privacy Policy and Cookie Notice from time to time. We will post the revised version on this page with an updated 'Last updated' date. If changes are material, we will notify you by email (if we hold your address) or by a prominent notice on the site at least 14 days before the change takes effect.
For privacy matters: privacy@motohive.ie
For general enquiries: contact@motohive.ie
This document is governed by Irish law and the laws of the European Union, in particular the General Data Protection Regulation (EU) 2016/679, the Data Protection Act 2018, and the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336/2011).
