Privacy Policy

This policy applies to zencarauction.com and to the dealer console behind it. It covers three groups of people: visitors who browse the public pages without an account, named logins belonging to a registered dealer company, and the individuals a dealer names to us in the course of a shipment — consignees, notify parties and the people listed on export documents.

Accounts on this platform belong to companies, not to individuals. Where we describe "your data" below, information about the company and information about the individual operating a login are held together, because a bid, an invoice and a payment are simultaneously a company record and an act by a person.

We are the controller of the data described here. Where a dealer uploads information about a third party — a consignee in the destination country, for example — the dealer is responsible for having the right to give it to us, and we process it on the dealer's instructions in order to complete that shipment.

Company and account details: company name, trading address, country, the import or trading licence details you register with us, the names, email addresses and telephone numbers of the logins you create, and the internal role and approval settings you assign them.

Authentication and security records: your password in hashed form, two-factor enrolment secrets and backup codes, active session records, the browser identifier we store to recognise a device you have signed in from before, and a log of sign-in attempts and their outcome. Sign-in records include the IP address the request presented and the browser's user-agent string.

Trading records: the bids you place, the vehicles you win, invoices issued to you, wallet movements and balances, security deposits held and released, coupons granted and spent, and the bank details you register for withdrawals.

Shipping and export records: the destination country and port you select, consignee and notify-party details, and the documents produced for export and customs clearance.

Support records: messages and attachments exchanged with our support team, including the internal notes our staff add to a thread.

Technical records: server logs of requests to the site, and — for visitors without an account — a hashed identifier derived from a cookie, used only to count free market-price lookups. We do not store the raw identifier alongside the lookup.

We do not ask for, and have no use for, special category data: health, biometrics, political opinions, religion or trade union membership. Please do not send it to us in a support message.

To operate your account and the platform: to authenticate you, to enforce the bid limit and security deposit rules your tier carries, to place bids with Japanese auction houses on your instruction, to issue and settle invoices, and to arrange export and shipping.

To keep the platform and your balance safe: to detect sign-ins from an unfamiliar device and tell you about them, to rate-limit sign-in attempts against a password-guessing attack, to require a second factor where your account settings demand one, and to keep an accountable record when a member of our support staff opens your account on your behalf.

To meet our obligations: to issue compliant invoices and keep the accounting records Japanese law requires, to produce the export and customs documents a shipment needs, and to respond to lawful requests from a public authority.

To communicate with you: about your bids, invoices, payments and shipments, about security events on your account, and — only where you have not switched it off in your notification preferences — about the platform itself.

To improve the service: understanding which parts of the platform dealers use, and where they get stuck. We do this from our own records; the site loads no third-party analytics, advertising or social media tracking.

As a company established in Japan we handle personal information in accordance with the Act on the Protection of Personal Information (APPI). Where a dealer is established in the European Economic Area or the United Kingdom, we additionally rely on the following bases under the GDPR.

Performance of a contract: everything necessary to operate your account, place your bids, invoice you and ship your vehicles.

Legal obligation: accounting, tax and export records we are required to create and retain.

Legitimate interests: securing the platform and our users' balances, preventing fraud and abuse, keeping an audit trail of administrative actions, and improving the service. We have considered your interests in each case and limited what we keep accordingly.

Consent: only for optional platform communications you may switch off at any time in your notification preferences. Withdrawing it does not affect anything we are obliged to send you about a bid, an invoice or a security event on your account.

Japanese auction houses and their operators, to the extent needed to register a bid and complete a purchase on your behalf. A purchase is made in our name at the auction, so the auction house does not receive your company details as a matter of course, but it does receive what a specific transaction requires.

Transport, inspection, forwarding and shipping partners, who need the vehicle details, the destination and the consignee information to move and clear the vehicle.

Banks and payment providers, to receive your deposits and to pay your withdrawals to the account you register.

Government and customs authorities in Japan and in the destination country, where export, import or tax rules require it.

Companies in the Car From Japan group, which operates this platform and provides its support, accounting and engineering functions.

Service providers who process data on our behalf under contract: cloud hosting and storage, email delivery, error monitoring and machine translation of Japanese auction text. They may use the data only to provide that service to us.

We do not sell personal information, and we do not share it with advertising networks or data brokers. We may disclose it where the law requires, or to establish or defend a legal claim.

The platform runs on cloud infrastructure in Japan, and Japan is where your account and trading records are stored. Support and engineering staff in the Car From Japan group may access them from other countries in the course of their work.

Shipping a vehicle necessarily sends data to the destination country: a consignee's name and address reach the port, the carrier and the customs authority there. Selecting a destination is an instruction to send that data.

Where we transfer personal data out of the EEA or the UK, we do so under the European Commission's standard contractual clauses or an applicable adequacy decision. Japan holds an adequacy decision from the European Commission.

Trading records — bids, invoices, wallet movements and shipping documents — are kept for as long as Japanese accounting and tax law requires us to hold the underlying books and vouchers, which is currently seven years from the end of the relevant fiscal year, and then deleted or anonymised.

Account and login details are kept while the account is open and for the retention period above where they form part of a transaction record. Closing an account removes access to it; it does not erase records we are required to keep.

Security and audit records are kept on a shorter clock: sign-in events and session records long enough to investigate an incident, and the record of a support member accessing an account on your behalf for as long as we may need to answer for that access. The latter is append-only by design and is not deleted on request while the underlying transaction records remain.

Support conversations are kept for as long as the account is open, so that a question asked this year can be answered against what we told you last year.

Server logs and the hashed identifier used to count free market-price lookups are kept for a short period measured in weeks, not years.

Passwords are stored hashed and are never recoverable in plain text, by us or by anyone else. Two-factor authentication is available on every account by email code or authenticator app, and is required before money leaves the platform.

Access by our own staff is governed by roles and scopes rather than by trust: a staff member sees only the dealers their role and assigned territory cover. Where a support member needs to see your account as you see it, the session is read-only, requires a stated reason, and is recorded permanently.

Documents that belong to a single dealer — invoices, support attachments, order paperwork — are served from private storage through an authenticated request, not from a public address that anyone holding the link could open.

No system is perfectly secure. If a breach affects your personal data and is likely to present a risk to you, we will notify you and the relevant authority within the time the applicable law requires.

You can ask us for a copy of the personal data we hold about you, to correct it if it is wrong, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent, you can withdraw it.

Most of this is immediate and needs no request: your company profile, your logins and their permissions, your notification preferences, your bank details and your trading history are all visible and editable in the dealer console.

Deletion has a limit we would rather state plainly than discover together: we cannot delete a record we are legally required to keep, such as an issued invoice or the accounting entry behind a payment. We will delete what we can and tell you what we cannot, and why.

Write to the address at the foot of this page to make a request. We will verify that the request comes from you before acting on it, and we will answer within one month. If you are not satisfied, you may complain to the Personal Information Protection Commission in Japan or to your local supervisory authority.

This is a platform for licensed businesses. It is not directed at children, we do not knowingly collect data from anyone under 18, and an account may only be operated by an adult authorised by the registered company. If you believe a child has provided us with personal data, contact us and we will delete it.

We update this policy when the platform changes in a way that affects it. The date at the top of the page is the date of the current version.

Where a change materially affects how we use data about you, we will tell you through the platform or by email before it takes effect, rather than relying on you to notice the date.