Privacy Policy and Cookie Policy

1. Data controller

2. Purpose and legal basis for processing personal data

We process personal data for the following purposes:

• Customer service and responding to inquiries: Handling quote requests and inquiries submitted via the form, email or phone.
• Calculating and preparing service quotes: Determining the vehicle's technical details (identifying the car model and engine type from the registration number in order to find the correct spare parts and service instructions).
• Performance of the service agreement: Carrying out service work, providing the inspection and pickup service, notifying you when the work is complete, and invoicing.
• Statutory obligations: Verifying obligations under accounting and consumer protection law, as well as service warranties (12 months / 15,000 km warranty).

Legal basis for processing (GDPR Article 6): Performance of a contract or pre-contractual measures at the data subject's request (Art. 6(1)(b)), the controller's legitimate interest in maintaining the customer relationship (Art. 6(1)(f)), and statutory obligation (Art. 6(1)(c)).

3. Data content of the register

Our register may process the following data:

• Basic information: Name, phone number, email address.
• Vehicle information: Registration number, make, model, model year and notes related to service history.
• Contact information: Selected service, message content, requested pickup service and the time of contact.
• Technical data: IP address and connection timestamp (for security purposes and to prevent spam).

4. Data retention period

We retain personal data only for as long as necessary to fulfil the purposes described in this policy. Contact requests are kept active for the duration of customer service and the service warranty period (12 months), after which unnecessary data is deleted or anonymised. Invoicing data is retained for the period required by accounting law (6 years from the end of the financial year).

5. Data disclosures and transfers

We do not sell, rent or disclose personal data to third parties for direct marketing purposes. Data is disclosed only:

• To authorities where required by law (e.g. to the inspection station in connection with the inspection service, or to tax authorities).
• To technical subcontractors and service providers who provide server hosting (secure Supabase PostgreSQL within the EU, Vercel hosting), bound by strict data processing agreements (DPAs).

Data is primarily processed within the European Union (EU) or the European Economic Area (EEA).

6. Register security principles

Data security is of the utmost importance to us. We protect personal data with appropriate technical and organisational measures:

• All web traffic is protected with modern SSL/TLS encryption (HTTPS).
• Databases are protected with strong passwords, firewalls and restricted access rights.
• Only designated personnel who need to process data for their job duties have access to the admin panel.

7. Rights of the data subject

Under the GDPR, you have the following rights:

You can exercise your rights by contacting us by email at korjaamo@boberauto.com. We respond to requests within one month.