Controller
M Owners (mowners.ro), a non-profit association registered in Romania. For privacy matters write to privacy@mowners.ro. The full legal name, registered address and registry number are listed in the Imprint.
Personal data we process
When you join the community: email address, username, display name, optional phone number, optional Instagram handle, optional short bio, optional profile photo, password (stored only as a salted hash), language preference, VIN of one BMW M car (used only to verify you are an M owner). When you take part: car photos you upload, listings, RSVP records for events. When you visit anonymously: IP address (used by our hosting provider for security, never stored by us); the strict-necessary session cookie if you sign in; aggregated, anonymous visit metrics collected at the edge by Cloudflare Web Analytics (no cookies, no IP storage, no persistent identifiers, no cross-site tracking).
Why we process it
To operate the members-only community (account, cars, events). To moderate user submissions before publishing them. To prevent abuse (rate limiting on sign-in/sign-up). To comply with legal obligations (DSA notice-and-action, NGO accounting).
Legal basis (GDPR Art. 6)
Contract (Art. 6(1)(b)) for the account, cars and listings you ask us to host. Legitimate interests (Art. 6(1)(f)) for security, abuse prevention and aggregated, anonymous visit counting via Cloudflare Web Analytics. Consent (Art. 6(1)(a)) is not currently relied on: we do not run any optional cookies today.
Who else sees it
Cloudflare, Inc. (United States) hosts the site, the database and the image storage (D1, R2, Workers). Cloudflare is bound by GDPR Standard Contractual Clauses and the EU-US Data Privacy Framework. No data is shared with anyone else without your consent or a legal obligation.
How long we keep it
Your account and the content you submit are kept until you delete your account from your profile page. Cars are deleted with the account. Server logs (access logs at Cloudflare) are retained per Cloudflare's policy (30 days). Listings are removed when you delete them or when the account is closed.
Your rights
You can access, correct and erase your data at any time from your profile page (Settings → Delete my account). You can also write to privacy@mowners.ro. We respond within 30 days. You have the right to object to processing based on legitimate interests and to lodge a complaint with the supervisory authority.
Complaints
The Romanian Data Protection Authority is ANSPDCP - B-dul G-ral. Gheorghe Magheru 28-30, Bucharest. www.dataprotection.ro.
Cookies
We use one strictly necessary cookie (the `token` session cookie) when you sign in, plus a language-preference cookie (`i18nextLng`). Our hosting provider (Cloudflare) collects aggregated, anonymous visit statistics at the edge - without setting cookies, without storing IP addresses and without persistent identifiers. We do not use marketing, advertising or third-party tracking cookies; if that ever changes, this page will be updated and granular consent will be requested before activation.