Privacy policy

Who is responsible for your data.

What we collect and when.

We process the following categories of personal data:

• Inquiry form data, your full name, email address, phone number, vehicle of interest, preferred purchase method and the contents of your message. Provided by you, voluntarily, when you submit our inquiry form.
• Communication data, the contents of email or messaging correspondence with our team, including any documents you choose to share.
• Technical data, IP address, browser type and version, device and operating system, referrer URL, page-view timestamps and pages visited. Collected automatically by our web-server logs.
• Cookie data, only where you have consented. See our Cookie settings page for the full list.

Why we process your data.

We process your personal data only where one of the following legal bases under Article 6 of the GDPR applies:

• Pre-contractual steps (Art. 6(1)(b) GDPR), responding to your inquiry, preparing quotations, configuring a vehicle and concluding a purchase agreement.
• Legitimate interests (Art. 6(1)(f) GDPR), operating, maintaining and securing the website, preventing fraud, and improving our services.
• Legal obligations (Art. 6(1)(c) GDPR), bookkeeping, tax, customs and vehicle-registration obligations under Estonian and EU law.
• Consent (Art. 6(1)(a) GDPR), for non-essential cookies and any marketing communication you opt in to. You may withdraw consent at any time.

Who else sees your data.

We do not sell personal data. We share your data only with the following categories of recipients, and only as far as necessary for the purposes above:

• Logistics, customs and shipping partners involved in vehicle import and delivery.
• Vehicle registration authorities and tax authorities in your country of residence.
• Financial institutions and leasing partners (only where you choose bank financing).
• Professional advisers (auditors, lawyers, tax consultants) under contractual confidentiality.
• IT and hosting service providers acting as our processors under Article 28 GDPR.

Where data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or on an adequacy decision.

How long we keep it.

• Inquiries that do not lead to a contract, up to 24 months after last contact.
• Contract-related data, for the duration of the contract plus the statutory retention period (in Estonia, generally 7 years for accounting documents).
• Server logs, up to 30 days for security and diagnostics.
• Cookie data, see Cookie settings for individual durations.

What you can ask of us.

Under the GDPR (Regulation (EU) 2016/679) you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), notification (Art. 19), data portability (Art. 20), objection (Art. 21), the right not to be subject to solely automated decision-making (Art. 22) and the right to withdraw consent (Art. 7(3)). You also have the right to lodge a complaint with a supervisory authority (Art. 77), in Estonia, the Andmekaitse Inspektsioon (aki.ee).

To exercise any of these rights, write to info@kvakgrupp.ee. We will respond within one month.

How we protect data.

We apply appropriate technical and organisational measures, including TLS encryption, access controls, regular backups and confidentiality undertakings, to protect personal data against loss, alteration, unauthorised disclosure or access.

Keeping you informed.

We may update this privacy policy from time to time to reflect changes in our services or in applicable law. The "Last updated" date above always shows the latest revision. Material changes will be highlighted on this page.