Privacy policy and cookies

Who is responsible for your data

The data controller is BCA Autoekspert OU (registry code 11398264, VAT EE101173250), Telliskivi 57D, 10412 Tallinn, Estonia. The Avariiautoremont brand belongs to the same company.

For data protection questions write to info@bcaeteh.ee or call +372 509 8457. We reply within one month at the latest.

What data we collect

We do not collect more data than we need to answer your enquiry and carry out the work.

• Contact details you provide yourself through the form or by phone: name, phone number, e-mail.
• Vehicle details: registration number, make and model, damage description and photos.
• Insurance details: insurer, claim number and the documents needed for claims handling.
• Repair and billing data: work carried out, spare parts, invoices and payments.
• Technical data about your visit: IP address for a short time for security purposes, browser and device type, pages visited. Statistics and ad measurement data are collected only with your consent.
• Enquiry source: whether you reached the site via a Google ad, search, Maps or another link (e.g. the ad click ID gclid and UTM tags). It is saved with your enquiry so we know which ads bring customers.

Why and on what legal basis we process data

• Answering enquiries, quoting and carrying out repairs - performance of a contract or steps prior to entering into one (GDPR Art 6(1)(b)).
• Filing the damage report and handling the claim with the insurer - performance of a contract and your consent to act on your behalf.
• Accounting and keeping invoices - legal obligation (GDPR Art 6(1)(c), Estonian Accounting Act).
• Website security and prevention of misuse - our legitimate interest (GDPR Art 6(1)(f)).
• Statistics and ad measurement cookies - your consent (GDPR Art 6(1)(a)), which you can withdraw at any time.
• Recording the source of an enquiry (ad, search, Maps) - our legitimate interest in knowing which advertising works (GDPR Art 6(1)(f)).

Who we share data with

We do not sell or trade your data. We share it only where this is needed to do the work or required by law.

• The insurer handling your claim (If, ERGO, PZU, Salva, Seesam, BTA, Elama, Balcia, Swedbank, LHV and others) - as part of claims handling.
• Spare part suppliers and partners, to the extent needed for the repair.
• IT service providers acting as our processors: website hosting, security and storage of enquiries (Cloudflare, Inc., data stored in the European Union), delivery of form e-mails (Resend, Inc.), e-mail (Zoho) and, with your consent, Google Analytics and Google Ads (Google Ireland Limited).
• Our accountant and auditor, and where necessary a legal adviser.
• Public authorities where the law requires it.

How long we keep data

• Enquiries that did not lead to a contract - up to 12 months.
• Claims handling and repair documents - 7 years, because accounting and warranty claims relate to them.
• Accounting source documents - 7 years under the Estonian Accounting Act.
• Website statistics in Google Analytics - up to 14 months.
• Google Ads measurement data - under Google’s terms; cookies up to 90 days.
• Your cookie choice - 12 months, after which we ask again.

Transfers outside the European Union

Some of our service providers (Cloudflare, Resend, Google) are US companies or use servers located in the US. In those cases the transfer is based on the European Commission Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework. Claims handling and repair documents are kept within the European Union.

Your rights

The GDPR gives you the following rights. Exercising them is free of charge.

• Receive a copy of the data we process about you.
• Have inaccurate data corrected.
• Have your data erased where we have no lawful basis to keep it.
• Request restriction of processing or object to it.
• Receive your data in a machine-readable format and transfer it to another provider.
• Withdraw your consent at any time - this does not affect the lawfulness of processing carried out before the withdrawal.

Making a complaint

If you believe we are processing your data incorrectly, please tell us first at info@bcaeteh.ee - we will resolve it as quickly as we can. You always have the right to contact the Estonian Data Protection Inspectorate: Tatari 39, 10134 Tallinn, tel +372 627 4135, info@aki.ee, www.aki.ee.

Security

The website uses HTTPS encryption. Customer data is accessible only to staff who need it for their work. Photos and documents are stored in a protected environment and paper documents in a locked room.

Changes

When our services or the tools we use change, we update this page too. The current version is always here and its date is shown at the top of the page.

Cookies

A cookie is a small text file that a website stores on your device. Necessary cookies are always used; statistics and ad measurement cookies only with your consent. We do not use personalised advertising or remarketing. Some of the items below are stored in the browser storage (localStorage, sessionStorage) rather than in a cookie - the principle and your choice work the same way.

How to manage cookies

You can change your choice at any time using the "Cookie settings" button at the bottom of the page. Cookies can also be deleted in your browser settings - note that the site will then forget your earlier choices as well.