Privacy Policy

Last updated: 29 April 2026

 

Your privacy matters to us. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use Bucketlist – an enthusiast car marketplace operated by MB „Bucketlist", registered in Lithuania. The platform is localized for Lithuanian, Latvian, Estonian, Polish, Finnish, and German users.

 

1. Data Controller

The data controller responsible for your personal data is:

MB „Bucketlist“
Registration number: 307664932
Registered address: Klaipėdos r. sav., Kretingalės sen., Kunkių k., Dūmešio g. 10, LT-92382, Lithuania

Contact email: hello@bucketlist.lt


If you have any questions about how we handle your data, please contact us at the email above.

 

2. What Data We Collect

2.1 Information you provide

  • Listing data: car details, photos, price, and any other information you include in your submission.
  • Contact information: name, email address, and phone number provided when submitting a listing or contacting us.
  • Communications: messages sent to us via email, Instagram, or Facebook.

 

2.2 Data collected automatically

  • Usage data: IP address, browser type, device type, pages visited, and time spent on the platform.
  • Cookies and tracking technologies: see Section 6 for full details.

 

3. Legal Basis for Processing

We process your personal data on the following legal grounds under GDPR Article 6:

 

  • Contract (Art. 6(1)(b)): to publish and manage your listing and facilitate contact between buyers and sellers.
  • Legitimate interest (Art. 6(1)(f)): to operate and improve the platform, understand usage patterns, detect fraud, and ensure platform security.
  • Consent (Art. 6(1)(a)): for non-essential cookies and analytics. You may withdraw consent at any time without affecting the lawfulness of prior processing.
  • Legal obligation (Art. 6(1)(c)): where required by applicable law.

 

4. How We Use Your Data

  • To publish and manage your car listing on the platform.
  • To facilitate direct contact between buyers and sellers.
  • To respond to your enquiries and support requests.
  • To send service-related emails, such as listing approval or listing sold notifications.
  • To send our newsletter to subscribers who have opted in.
  • To understand how users interact with the platform and improve the user experience.
  • To comply with legal obligations.

 

5. Data Sharing and Third-Party Services

We do not sell your personal data. We use the following third-party services that may process your data on our behalf:

 

5.1 Analytics and performance

  • Google Analytics 4 (Google LLC): used to understand platform traffic and usage patterns. Data may be processed in the United States. Google participates in the EU-U.S. Data Privacy Framework. For more information, visit policies.google.com/privacy.
  • Vercel Analytics (Vercel Inc.): used for platform performance monitoring and aggregated usage statistics. For more information, visit vercel.com/legal/privacy-policy.
  • Hotjar (Hotjar Ltd.): used to understand user behaviour through heatmaps and session recordings. IP addresses are anonymised. Data may be processed outside the EU under Standard Contractual Clauses. For more information, visit hotjar.com/legal/privacy.

 

5.2 Email

  • Resend (Resend Inc.): used for transactional emails such as listing confirmations and notifications. Data may be processed in the United States under Standard Contractual Clauses. resend.com/privacy
  • Kit (formerly ConvertKit): used to send newsletters and service-related emails to subscribers who have opted in. Data is processed in the United States under Standard Contractual Clauses. For more information, visit kit.com/privacy.

 

5.3 Hosting and infrastructure

  • Supabase (Supabase Inc.): used as our primary database and backend infrastructure. Stores listing data, user account data, and platform content. Data may be processed in the United States and EU regions under Standard Contractual Clauses. supabase.com/privacy
  • Vercel Inc.: our platform is hosted on Vercel's infrastructure. Server locations may include the United States and Europe. For more information, visit vercel.com/legal/privacy-policy.


5.4 Authentication

  • Clerk (Clerk Inc.): handles user authentication and session management. May process email address and device data. Data may be processed in the United States under Standard Contractual Clauses. clerk.com/privacy


All third-party providers are bound by data processing agreements and may only use your data for the purposes we specify.

 

6. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the platform and understand how users interact with it.

 

  • Essential cookies: required for the platform to function correctly. These cannot be disabled.
  • Analytics cookies (Google Analytics 4): used to measure traffic and usage patterns. Requires your consent.
  • Behaviour tracking (Hotjar): used to analyse user interactions via heatmaps and session recordings. Requires your consent.
  • Performance monitoring (Vercel Analytics): aggregated, anonymised performance data. No individual tracking.

 

You can manage your cookie preferences through our cookie banner or by adjusting your browser settings. Disabling non-essential cookies will not affect your ability to use the platform.

 

7. Data Retention

  • Listing data (car details, photos, price): retained indefinitely as part of the platform archive. Once a listing is marked as sold or removed, seller contact information is deleted or hidden. Only vehicle data remains publicly visible.
  • Seller contact information: removed from public view once a listing is marked as sold or taken down. Retained internally only as long as necessary for legal or dispute resolution purposes.
  • Communications (email, Instagram, Facebook messages): retained for as long as necessary to resolve the matter, then deleted.
  • Newsletter subscriber data: retained until you unsubscribe. You can unsubscribe at any time via the link in any email.
  • Analytics and usage data: retained according to the respective third-party provider's retention policy. Aggregated or anonymised where possible.

 

8. Security

We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to addressing any breach promptly and in accordance with applicable law.

 

9. International Data Transfers

Some of our third-party service providers process data outside the European Economic Area (EEA), including in the United States. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or participation in recognised data privacy frameworks.

 

10. Your Rights

Under GDPR, you have the following rights regarding your personal data:

 

  • Right of access: request a copy of the personal data we hold about you.
  • Right to rectification: ask us to correct inaccurate or incomplete data.
  • Right to erasure: request deletion of your personal data in certain circumstances.
  • Right to restrict processing: ask us to limit how we use your data.
  • Right to data portability: request your data in a structured, machine-readable format.
  • Right to object: object to processing based on legitimate interests.
  • Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing. 

To exercise any of these rights, contact us at hello@bucketlist.lt. We will respond within 30 days.

 

11. Right to Lodge a Complaint

If you believe we are not handling your personal data in accordance with applicable law, you have the right to lodge a complaint with the relevant supervisory authority in your country:

 

  • Lithuania: State Data Protection Inspectorate (VDAI) – vdai.lrv.lt
  • Latvia: Data State Inspectorate – dvi.gov.lv
  • Estonia: Data Protection Inspectorate – aki.ee
  • Poland: Personal Data Protection Office (UODO) – uodo.gov.pl
  • Finland: Office of the Data Protection Ombudsman – tietosuoja.fi
  • Germany: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) – bfdi.bund.de

 

12. Minors

Bucketlist is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, please contact us at hello@bucketlist.lt and we will delete it promptly.

 

13. Automated Decision-Making

We use an automated tool to review submitted listings for potential errors or quality issues before publication. This does not produce legal or similarly significant effects – final decisions on listing approval are made by our team. We do not use automated profiling of users.

 

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through a notice on the platform. The date at the top of this document reflects the most recent revision.

 

15. Contact

For any questions, requests, or concerns regarding this Privacy Policy:

 

MB "Bucketlist"
Klaipėdos r. sav., Kretingalės sen., Kunkių k., Dūmešio g. 10, LT-92382, Lithuania

Email: hello@bucketlist.lt

Newsletter illustration

Chcesz więcej?

W naszym newsletterze dzielimy się ulubionymi ogłoszeniami, historiami z naszych garaży i opiniami, które prawdopodobnie Ci się nie spodobają. Po angielsku.

Zapisując się, akceptujesz Politykę prywatności