Privacy policy

Last updated: October 23, 2025.
Effective from: August 26, 2025.

 

1. Introduction

This Privacy Policy describes how MARBELAUTO OÜ (registry code 17312034, hereinafter referred to as “we”) collects, uses, stores, and protects your personal data in connection with the use of the website https://1auto.ee and its subpages (hereinafter, the “Website”).
We respect your privacy and process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the applicable laws of the Republic of Estonia.

2. Data We Collect

We may collect and process the following types of data:

    • Contact details: name, email address, phone number.
    • Account details: username, password, company name, registration code, job position, authorization.
    • Listing data: information about vehicles, listings, and related files added by you.
    • Transaction data: billing and payment information (through secure payment service providers).
    • Technical data: IP address, device and browser type, operating system, usage statistics (e.g. which pages are visited).
    • Log data: system events (e.g. logins, activity history, technical errors) for security and auditing purposes.
    • Data collected via cookies: see the Cookie Policy.

3. How We Use Your Data

We use the collected data for the following purposes:

    • creating and managing user accounts;
    • enabling the addition, modification, and management of listings;
    • fulfilling contractual obligations and providing services;
    • billing and fulfilling accounting obligations;
    • customer communication (e.g. responding to inquiries, sending service notifications);
    • developing services and improving user experience;
    • marketing communications and newsletters (only with your consent);
    • fulfilling legal and audit requirements;
    • preventing fraud and ensuring security.

All data is used solely for the purposes for which it was collected.

4. Legal Basis for Processing Data

We process personal data on the following legal grounds:

    • Performance of a contract – when data processing is necessary for the use of our services;
    • Compliance with legal obligations – such as accounting and tax recordkeeping;
    • Legitimate interest – for service development, security, and prevention of misuse;
    • Consent – for example, for direct marketing or newsletter distribution.

5. Data Retention

We retain personal data only for as long as necessary to achieve the purposes for which it was collected or to comply with legal obligations.

    • Account data is retained until the account is deleted and for an additional archival period (up to 3 years).
    • Accounting and payment data are retained for the legally required period (7 years).
    • Log data is stored for up to 12 months for security and auditing purposes.

When data is no longer needed, we securely delete or anonymize it.

6. Data Sharing

Your data may be shared in the following cases:

    • when necessary for the provision of services (e.g. payment or IT partners);
    • for compliance with legal obligations (e.g. tax authorities, law enforcement agencies);
    • when you have given explicit consent (e.g. marketing partners).

We do not sell, rent, or transfer personal data to third parties for any other purposes.
All partners receiving data are required to comply with confidentiality and data protection obligations.

7. Third Parties and Data Transfers Outside the EU

Some partners (e.g. Google LLC, Meta Platforms Inc.) may process data outside the European Economic Area (EEA).
In such cases, we ensure that data transfers are carried out in accordance with GDPR requirements, using EU Standard Contractual Clauses or other appropriate safeguards.

8. Your Rights

You have the following rights:

    • Right of access – to obtain a copy of your personal data.
    • Right to rectification – to correct inaccurate or incomplete data.
    • Right to erasure – in certain cases, to have your data deleted (“right to be forgotten”).
    • Right to restrict processing – in certain cases, to limit the processing of your data.
    • Right to data portability – to receive your data in a machine-readable format and transfer it to another service provider.
    • Right to object to processing – including for direct marketing purposes.
    • Right to withdraw consent – when processing is based on your consent.
    • Right to lodge a complaint – with the Estonian Data Protection Inspectorate or your local supervisory authority.

All requests will be reviewed within a reasonable time, but no later than 30 calendar days.

9. Security

We implement appropriate technical and organizational measures (including access control, logging, and backups) to protect data against unauthorized access, alteration, disclosure, or destruction.
Our data processors and partners are required to maintain confidentiality and adhere to security standards.

10. Cookies

We use cookies to enhance the functionality of the Website, personalize content, and analyze traffic.
The use of cookies is described in a separate document – the Cookie Policy.
You can manage your cookie preferences in your web browser settings.

11. Privacy Policy Changes and Language

We may update this policy from time to time to reflect changes in legislation, technology, or our services.
These Terms may exist in multiple languages; in the event of discrepancies, the Estonian version shall prevail.
The latest version is always available on our Website.
We recommend reviewing the policy regularly.

 

For questions regarding the Privacy Policy or data processing, please contact us.

MARBELAUTO OÜ.
Registry code: 17312034.