Privacy Policy
Effective from: 01.04.2026 | Last updated: 16.07.2026
1. Data Controller
OÜ HMK Auto
Registry code: 11387918
Address: Männiku tee 104A, 11216 Tallinn, Estonia
Phone: +372 600 1600
Email: [email protected]
For data protection enquiries, please contact: Meelis Kuusk, [email protected].
2. What personal data we collect
When creating an account
- Name, email address, phone number
- Password (stored encrypted; we have no access to your password)
- Social media account data if you sign in via Google (name, email)
When placing an order
- Billing and shipping address
- Company details (business customers): company name, registry code, VAT number
- Selected shipping and payment method
When making a payment
- Data required to process the payment is forwarded to the payment service provider (see section 4)
- We do not store or see your bank card details
When using the online store
- IP address, device and browser type
- Visited pages and search queries (linked to your customer account when logged in)
- Cookies (see our Cookie Policy)
When contacting customer support
- Content of conversations (email, online store chat)
3. Why and on what basis we process your data
| Purpose | Legal basis (GDPR) | Explanation |
|---|---|---|
| Fulfilling orders and delivering goods | Performance of contract (Art 6(1)(b)) | Necessary for processing your order |
| Issuing invoices and accounting | Legal obligation (Art 6(1)(c)) | Estonian Accounting Act requires data retention |
| Managing your customer account | Performance of contract (Art 6(1)(b)) | Your account, purchase history and preferences |
| Providing customer support | Performance of contract (Art 6(1)(b)) | Responding to enquiries and resolving issues |
| Online store functionality | Legitimate interest (Art 6(1)(f)) | Shopping cart, language preference, login |
| Website analytics | Consent (Art 6(1)(a)) | Visitor statistics via Google Analytics - only with your consent |
| Product availability notifications | Legitimate interest (Art 6(1)(f)) | We notify you when a requested product arrives in stock |
| Fraud prevention | Legitimate interest (Art 6(1)(f)) | Detection of unusual orders |
| Linking search history to your customer account | Legitimate interest (Art 6(1)(f)) | Searches made while logged in are linked to your account for assortment planning and personalised offers |
4. Who we share your data with
We do not sell or share your personal data with third parties for marketing purposes. We only share data with partners necessary for fulfilling orders and operating the online store.
Payment services
| Partner | Purpose | Data shared |
|---|---|---|
| Maksekeskus AS (Everypay) | Bank links and card payments | Payment amount, order number, name |
| PayPal (Europe) | Alternative payment method | Email, name, payment amount |
Bank card details are processed solely by the payment service provider - we do not see or store them.
Shipping services
| Partner | Purpose | Data shared |
|---|---|---|
| Montonio | Parcel lockers (Omniva, Smartpost, DPD, etc.) | Name, phone, selected parcel locker |
| DHL Express | International shipping | Name, address, phone, email |
| Bentte OÜ | Courier service in Estonia | Name, address, phone |
Other service providers
| Partner | Purpose | Location |
|---|---|---|
| Google Analytics (Google LLC) | Website visitor statistics | USA* |
| Askly OÜ | Customer support chat | Estonia |
| Resend Inc | Order confirmation and notification emails | USA* |
| Zone Media OÜ | Server hosting | Estonia |
| Cloudflare Inc | Website security and performance (CDN) | USA* |
| Erply (Osaühing Erply) | Inventory and accounting software | Estonia |
* US-based service providers are covered by the EU-US Data Privacy Framework, which ensures an adequate level of data protection.
5. Data transfers outside the European Union
Your data is primarily processed within the European Union (Zone.ee servers in Estonia). Some service providers are based in the USA (Google, Resend, Cloudflare). These companies are certified under the EU-US Data Privacy Framework, which the European Commission has determined provides an adequate level of data protection.
6. Cookies
We use cookies for the operation of the online store (shopping cart, login, language preference) and, with your consent, for collecting visitor statistics.
You can change your cookie preferences at any time via the "Cookie settings" link in the website footer.
More information: Cookie Policy.
7. How long we retain your data
| Data | Retention period | Reason |
|---|---|---|
| Customer account data | Until account deletion | Service provision |
| Order data | 7 years | Accounting Act |
| Invoices and payment data | 7 years | Accounting Act |
| Purchase history | 3 years after last purchase | Handling warranty claims |
| Customer support conversations | 2 years | Service quality and dispute resolution |
| Analytics data (GA4) | 14 months | Google Analytics default period |
| Cookie consent | 12 months | We ask again after that |
| Search history linked to your account | 24 months | After that the link to your account is removed (data is anonymised) |
When you delete your account, we remove all personal data except data required by law (invoices, payments).
8. Your rights
You have the right at any time to:
- Access your data - ask what data we hold about you
- Rectify your data - most data can be edited in your account
- Erase your data - request deletion of your account and data (except data required by law)
- Restrict processing - for example, while we verify the accuracy of your data
- Data portability - receive your data in a machine-readable format
- Object - to data processed on the basis of legitimate interest
- Withdraw consent - for cookies and analytics, at any time
Contact: [email protected]. We will respond within 30 days.
9. Product availability notifications
If you subscribe to a product availability notification, we use your email address solely to notify you when the requested product arrives in stock. This is not a newsletter or marketing email. You can unsubscribe from notifications at any time.
10. Security
- All data is encrypted (HTTPS/TLS)
- Passwords are stored encrypted (bcrypt) - we have no access to your password
- Bank card details are not stored or processed by our systems
- The server is located in the European Union (Zone.ee, Estonia)
- Access to data is restricted to authorised HMK Auto staff only
- The online store is protected by Cloudflare security services (DDoS protection, firewall)
11. Children's data
The online store is not intended for persons under 18 years of age. We do not knowingly collect personal data from minors.
12. Changes
We reserve the right to update this privacy policy. In case of significant changes, we will notify registered customers by email. The current version is always available on this page.
13. Contact and complaints
OÜ HMK Auto
Meelis Kuusk
Email: [email protected]
Phone: +372 600 1600
If you believe your rights have been violated, you have the right to lodge a complaint with:
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tatari 39, 10134 Tallinn
Email: [email protected]
Website: www.aki.ee