Privacy policy

Who is responsible for your data

The controller of your personal data is Starmotors OÜ, Laki 7b, Tallinn 10621, Eesti.

• Email: info@starmotors.ee
• Phone: +372 5341 3968

You can write to us about any privacy matter at info@starmotors.ee — we reply within one month at the latest.

We process personal data in line with the EU General Data Protection Regulation (GDPR), the Estonian Personal Data Protection Act and the Estonian Electronic Communications Act.

What data we collect

1. Contact and booking form. When you send us an enquiry through the form, we store:

• your name;
• your email address;
• your phone number (optional);
• your car's registration number (optional);
• the service category and subcategory you selected;
• your message and anything you choose to share in it (for example a fault description, car model or mileage);
• the language of the enquiry and the date and time it was sent;
• your IP address and browser identifier (user agent) — used only for spam and abuse prevention.

The enquiry is saved in the website database and at the same time emailed to the Starmotors team who will get back to you.

2. Server logs. Our web server automatically records a technical entry for every request: IP address, date and time, the address requested, the referring page, browser and device type and the response code. These logs are used only for security, troubleshooting and keeping the service reliable.

3. Cookies and statistics. Necessary cookies are essential for the site to work. Statistics and marketing cookies are used only with your consent — see the “Cookies” section below.

We do not collect special categories of data (health, political or religious beliefs and the like) and we ask you not to send such details through the form.

What we use the data for

• Answering enquiries and booking appointments — to contact you, estimate the work, make an offer and agree a service slot.
• Providing and documenting the service — to keep a record of which car needed which work.
• Website security — preventing spam, bots and misuse, and fixing faults.
• Improving the website — aggregated statistics about which pages are popular and where visitors come from (only with your consent).
• Meeting legal obligations — for example accounting rules and consumer complaint handling.

We do not sell your data and we do not trade it with third parties for marketing. We do not carry out automated decision-making or profiling that produces legal effects for you.

Legal bases

• Pre-contractual steps and performance of a contract (GDPR Art. 6(1)(b)) — handling your enquiry, preparing an offer and agreeing a service appointment.
• Legitimate interest (GDPR Art. 6(1)(f)) — keeping the website and enquiries secure, preventing spam, troubleshooting and retaining business correspondence. We have balanced our interest against your rights and keep the data to the minimum needed.
• Consent (GDPR Art. 6(1)(a) and the Electronic Communications Act) — statistics and marketing cookies. You can withdraw consent at any time; this does not affect the lawfulness of processing carried out before the withdrawal.
• Legal obligation (GDPR Art. 6(1)(c)) — retention of accounting source documents and other statutory requirements.

Cookies

A cookie is a small text file that a website stores on your device. We use three kinds:

• Necessary — the site cannot work without them: security, form protection and remembering your cookie choice. They are always on and no consent is asked for them.
• Statistics — Google Analytics 4 helps us understand how the site is used. These load only if you allow them.
• Marketing — advertising measurement and remarketing. This category is off by default and is activated only with your explicit consent. If you do not enable it, we send Google a denying signal (ad_storage, ad_user_data and ad_personalization are set to “denied”).

We use Google Consent Mode v2: before consent is given, no Google script is loaded and no statistics cookie is set. You can change your choice at any time using the button in the site footer, or by clearing cookies in your browser settings.

If you allow statistics, we use Google Analytics 4 (measurement ID G-YDE6P0GW1N), operated by Google Ireland Limited. GA4 does not store your IP address in an identifiable form and we have not enabled advertising data sharing in that account. Google's own terms are available at policies.google.com/privacy.

Manage cookie preferences

Who we share data with

Only Starmotors staff who need your data for their work can access it. In addition we use carefully chosen processors:

• Zone Media OÜ — web hosting and email. The servers are located in Estonia, in the European Union.
• Google Ireland Limited — Google Analytics 4 visitor statistics, only with your consent.
• Accounting and legal service providers — only when and to the extent needed for an invoice or a legal claim.

We have data processing agreements with every processor and they may use the data only on our instructions. We also disclose data where the law requires it (for example a lawful request from a law-enforcement authority). Data is never sold or passed on to advertising networks.

Transfers outside the European Union

Our server and database are located in the European Union. The exception is Google Analytics: if you have allowed statistics, part of the data may be processed in the United States.

In that case Google Ireland Limited and its group rely on the EU–US Data Privacy Framework and on the European Commission's Standard Contractual Clauses (SCCs) together with additional safeguards. If you do not allow statistics cookies, no data is sent to Google.

How long we keep data

• Enquiries sent through the form — 3 years from the last contact, then deleted. This follows the general three-year limitation period, so that we can evidence claims if needed.
• Email correspondence — up to 3 years.
• Server logs — up to 6 months, then overwritten.
• Consent cookie (sm_consent) — 12 months, after which we ask for your choice again.
• Google Analytics 4 user and event data — up to 14 months; the cookies expire within 2 years, or earlier if you delete them.
• Accounting source documents — 7 years, as required by the Estonian Accounting Act.

When data is no longer needed and no retention obligation applies, we delete it or irreversibly anonymise it.

Your rights

The GDPR gives you the following rights:

• Access (Art. 15) — receive a copy of the data we process about you.
• Rectification (Art. 16) — have inaccurate data corrected.
• Erasure (Art. 17) — ask us to delete data that is no longer needed or that was processed on the basis of consent.
• Restriction (Art. 18) — ask us to pause processing, for example while a dispute is resolved.
• Data portability (Art. 20) — receive the data you provided in a machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interest.
• Not be subject to automated decisions (Art. 22) — we do not make such decisions.
• Withdraw consent — at any time and as easily as you gave it, using the cookie preferences button in the site footer.

To exercise your rights, write to info@starmotors.ee. We answer within one month; for complex requests we may extend that period by two months and will tell you in advance. We may ask for additional information to verify your identity.

Security

We protect your data with appropriate technical and organisational measures:

• all traffic to the website is encrypted (HTTPS/TLS);
• forms are protected by CSRF protection, a honeypot field and rate limiting;
• access to the database and the admin area is password-protected and limited to a small number of staff;
• servers and software are kept up to date and backups are stored in the EU.

If a data breach nevertheless occurs and is likely to put your rights at risk, we notify the supervisory authority (Andmekaitse Inspektsioon) within 72 hours and, where required, you personally.

Children

Our services and website are intended for adults. We do not knowingly collect data about children under the age of 13. If we learn that we have collected such data without a parent's consent, we delete it without delay.

Changes to this policy

If our services or the way we process data change, we update this document as well. The current version is always on this page and the date of the last change is shown above. Where a change is significant, we will ask for your consent again if that is required.

Complaints

If you believe we are processing your data unlawfully, please tell us first at info@starmotors.ee — most questions are resolved quickly.

You always have the right to contact the supervisory authority. In Estonia this is the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate):

• Tatari 39, 10134 Tallinn, Estonia
• Email: info@aki.ee
• Phone: +372 627 4135
• www.aki.ee

Get in touch

Questions about privacy, your data or cookies are always welcome.

• Starmotors OÜ, Laki 7b, Tallinn 10621, Eesti
• Email: info@starmotors.ee
• Phone: +372 5341 3968