Who we are
Carlot ("Carlot", "we", "us") runs online auctions for cars sourced from the USA, UK and Canada for buyers in Nigeria. We are the data controller for the personal data described in this policy. We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and other applicable law.
Questions or requests about your data can go to carlotngn@gmail.com.
What we collect
When you join the waitlist
- Email address (required) and name (optional), which you type into the form.
- Your paddle number, the waitlist number we assign you.
- The date you signed up and that you signed up from this website.
Automatically, when you visit
- Technical data your browser sends with every request, such as your IP address, browser type and the pages you load. Our hosting provider and API keep this in server logs for security and to stop abuse, such as rate limiting repeated sign-ups.
When bidding opens
To register a bidder, take deposits and deliver cars we will also need details such as your phone number, delivery address, government ID (for identity and customs checks) and payment records. We will tell you exactly what we collect, and why, before you provide it.
How we use it
- To run the waitlist: save your spot, send your welcome email and tell you when bidding opens.
- To send updates about upcoming lots and auction dates. You can unsubscribe at any time.
- To keep the service secure: detect spam, fraud and abuse.
- To meet legal obligations, such as tax, customs and anti-money-laundering record keeping once auctions are live.
Our legal bases are your consent (waitlist and marketing emails), performance of a contract (when you register to bid or buy), our legitimate interests (security and improving the service) and legal obligation. We do not sell your personal data.
Stored on your device
After you join, this site saves your email, name and paddle number in your browser's local storage so it can show your paddle when you come back. It stays on your device and is not used for tracking. Clicking "Use a different email", or clearing your browser data, removes it. We do not use advertising or analytics cookies.
Who we share it with
We share personal data only with service providers that help us run Carlot, and only as much as they need:
- Hosting and infrastructure providers that run this website and our API.
- Our email delivery provider, which sends waitlist and update emails.
- Font providers (Google Fonts and Fontshare). Your browser loads fonts from their servers, which means they receive your IP address.
- Once auctions are live: payment processors, shipping agents and clearing agents handling your car.
- Authorities, where the law requires it.
WhatsApp group. If you join our WhatsApp community, WhatsApp (Meta) processes your data under its own privacy policy, and other members of the group can see your phone number and profile. We don't control that, so please only join if you're comfortable with it.
International transfers
Some of our providers store data outside Nigeria. Where they do, we rely on safeguards recognised under the NDPA, such as contractual protections, to keep your data protected to the same standard.
How long we keep it
We keep waitlist data until you unsubscribe or ask us to delete it, or until we close the waitlist. Server logs are kept for a short period, typically no more than 90 days. Records we must keep by law, such as transaction records, are kept for as long as the law requires.
Your rights
Under the NDPA you can:
- ask for a copy of the personal data we hold about you;
- ask us to correct or delete it;
- withdraw consent or object to processing, including unsubscribing from emails;
- ask us to restrict processing, or to send your data to you or another provider in a portable format.
Email carlotngn@gmail.com and we'll respond within 30 days. To delete your account, use our account deletion page. If you're not happy with our response, you can complain to the Nigeria Data Protection Commission (NDPC).
Security
We use encryption in transit (HTTPS), access controls and reputable providers to protect your data. No system is perfectly secure, so if we ever learn of a breach that affects you, we'll tell you and the NDPC as the law requires.
Children
Carlot is for adults. We don't knowingly collect data from anyone under 18.
Changes
We'll update this policy as Carlot grows, and in particular before auctions open. The date at the top shows the latest version. If we make a significant change we'll email people on the waitlist. See also our Terms and Conditions.