Privacy policy — KVAK Grupp OÜ

KVAK Grupp OÜ ("we", "us", "our") takes the privacy of every visitor seriously. This policy explains what personal data we collect, why we collect it, how long we keep it and what rights you have over it.

01 — Data controller

Who is responsible for your data.

Controller: KVAK Grupp OÜ
Address: Tallinn, Estonia
Email: info@kvakgrupp.ee

02 — Data we collect

What we collect and when.

We process the following categories of personal data:

Inquiry form data — your full name, email address, vehicle of interest, preferred battery configuration, preferred purchase method, preferred mileage and the contents of your message. Provided by you, voluntarily, when you submit our inquiry form.
Communication data — the contents of email or messaging correspondence with our team, including any documents you choose to share.
Technical data — IP address, browser type and version, device and operating system, referrer URL, page-view timestamps and pages visited. Collected automatically by our web server logs.
Cookie data — only where you have consented. See our Cookie settings page for the full list.

03 — Purposes and legal bases

Why we process your data.

We process your personal data only where one of the following legal bases under Article 6 of the GDPR applies:

Pre-contractual steps (Art. 6(1)(b) GDPR) — responding to your inquiry, preparing quotations, configuring a vehicle and concluding a purchase agreement.
Legitimate interests (Art. 6(1)(f) GDPR) — operating, maintaining and securing the website, preventing fraud, and improving our services.
Legal obligations (Art. 6(1)(c) GDPR) — bookkeeping, tax, customs and vehicle-registration obligations under Estonian and EU law.
Consent (Art. 6(1)(a) GDPR) — for non-essential cookies and any marketing communication you opt in to. You may withdraw consent at any time.

04 — Sharing your data

Who else sees your data.

We do not sell personal data. We share your data only with the following categories of recipients, and only as far as necessary for the purposes listed above:

Logistics, customs and shipping partners involved in vehicle import and delivery.
Vehicle registration authorities and tax authorities in your country of residence.
Financial institutions and leasing partners (only where you choose bank financing).
Professional advisers (auditors, lawyers, tax consultants) under contractual confidentiality.
IT and hosting service providers acting as our processors under Article 28 GDPR.

Where data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or on an adequacy decision.

05 — Storage duration

How long we keep it.

We retain personal data only as long as needed:

Inquiries that do not lead to a contract — up to 24 months after last contact.
Contract-related data — for the duration of the contract plus the statutory retention period (in Estonia, generally 7 years for accounting documents).
Server logs — up to 30 days for security and diagnostics.
Cookie data — see Cookie settings for individual durations.

06 — Your rights

What you can ask of us.

Under the GDPR (Regulation (EU) 2016/679) you have the following data subject rights:

Right of access (Art. 15 GDPR) — you may obtain confirmation as to whether or not we are processing your personal data and, where we are, a copy of that data together with information about the processing.
Right to rectification (Art. 16 GDPR) — you may have inaccurate personal data about you corrected and incomplete data completed.
Right to erasure ("right to be forgotten", Art. 17 GDPR) — you may have your personal data deleted where the conditions of Art. 17 are met.
Right to restriction of processing (Art. 18 GDPR) — you may require us to restrict the processing of your data in the cases set out in Art. 18.
Right to notification (Art. 19 GDPR) — we will notify each recipient to whom your data has been disclosed of any rectification, erasure or restriction carried out in accordance with Arts. 16–18, unless this proves impossible or involves disproportionate effort.
Right to data portability (Art. 20 GDPR) — you may receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another controller where technically feasible.
Right to object (Art. 21 GDPR) — you may object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of Art. 6(1)(e) or (f) GDPR, including profiling. You may object to processing for direct marketing purposes at any time, free of charge.
Right not to be subject to automated decision-making, including profiling (Art. 22 GDPR) — you have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. We do not perform such decision-making.
Right to withdraw consent (Art. 7(3) GDPR) — where processing is based on consent, you may withdraw that consent at any time, with effect for the future and without affecting the lawfulness of processing before withdrawal.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — in Estonia, the Andmekaitse Inspektsioon (aki.ee), or the supervisory authority of your habitual residence, place of work or place of the alleged infringement.

To exercise any of these rights, write to info@kvakgrupp.ee. We will respond within one month.

07 — Security

How we protect data.

We apply appropriate technical and organisational measures — including TLS encryption, access controls, regular backups and confidentiality undertakings — to protect personal data against loss, alteration, unauthorised disclosure or access.

08 — Changes to this policy

Keeping you informed.

We may update this privacy policy from time to time to reflect changes in our services or in applicable law. The "Last updated" date above always shows the latest revision. Material changes will be highlighted on this page.