Privacy Policy

1. General provisions

This privacy policy describes how personal data is collected, processed and stored on the website gpsauto.ee. Personal data is collected, processed and stored by the data controller Ravolar Grupp OÜ (trading as Mugav Auto, hereinafter “the data controller”).

A data subject under this policy is a customer or any other individual whose personal data the controller processes. We process personal data in accordance with the General Data Protection Regulation (GDPR) and Estonian law — lawfully, fairly and securely. For questions: klienditugi@mugavauto.ee

2. Data collection and processing

We collect only the data needed to provide our services.

Enquiries. Through the contact form and email we collect:

• first and last name;
• phone number;
• email address;
• vehicle details — make, model, year and registration number;
• visit source — how you reached our website (search engine, advertising, another website) and your earlier visits; it is added to your enquiry when you send it (see section 3).

Orders in the online shop. When you place an order, we collect your name, email address, phone number, delivery method and, where needed, delivery details (address or the selected parcel locker), the contents of the order and the payment result. Our systems do not see or store card or bank link details: the payment is processed by the payment service provider.

Installation booking. When you book, we collect your name, contact details, vehicle details and the selected time.

Demo access. When you request a demo, we collect your email address and create a temporary demo account. We use it only to provide demo access and to limit its use. The vehicles and routes shown in the demo are generated by code and contain no data about real people.

Tracking system account. After a purchase, we create a tracking system account for you (login details are sent by email). In the system we process the location and trip data of your vehicles and related settings solely to provide the service to you; this data is not used for any other purpose.

Providing data does not mean consent to every processing activity described in this policy. The data needed to fulfil an order is marked separately on the form; without it we cannot fulfil the order. Not providing optional data, or declining analytics, does not prevent you from buying. The data subject is responsible for the accuracy and completeness of the data they provide.

3. Cookies, visit source and statistics

We use three categories of cookies:

• Strictly necessary cookies — ensure the website works and is secure; they cannot be disabled.
• Analytics cookies — help us understand how visitors use the website so that we can keep improving it. Enabled only with your consent.
• Advertising cookies — used to show personalised ads and measure the effectiveness of campaigns. Enabled only with your consent.

Visit source. To know how clients find us, the website stores a short record in your browser's storage (not as a cookie): where you came from (e.g. a search engine or an ad), the campaign name, the landing page, the visit time and a random visitor number. Ad click identifiers are not stored without your consent. The record stays on your device for up to 12 months and reaches us only together with an enquiry you send yourself; it is not shared with anyone else.

Visit statistics. We collect general visit statistics without cookies to see how our websites are used. The statistics run on servers under our control and are not shared with third parties. While the “Visit source” switch is on, your visits are linked to the random visitor number described above.

You can switch off recording of the visit source with the “Visit source” switch at the bottom of this page: what is stored is deleted immediately and nothing new is recorded. The switch is independent of the cookie buttons and applies to each of our websites separately. You can change your cookie preferences at any time with the “Change cookie settings” button.

4. Legal basis and retention

The legal basis for processing personal data is Art. 6(1) GDPR:

• (a) the data subject’s consent (analytics and advertising cookies);
• (b) performance of a contract or pre-contractual measures at the data subject’s request (enquiries, fulfilling orders, bookings, demo access, providing the tracking system service);
• (c) compliance with the controller’s legal obligations (including accounting);
• (f) the controller’s legitimate interests — statistics on our own enquiries and visits (visit source, visit statistics) and fraud prevention. You can object to this processing at any time with the “Visit source” switch or by writing to us.

Retention periods, depending on the purpose:

• Enquiries — 12 months from receipt; client data — 12 months from the last contact. After that, the name, contact details and enquiry content are deleted; only anonymous statistics remain (website, enquiry type, date, source). Deleted data may remain in backups for up to 30 more days.
• Order data — for the period required by law for accounting records.
• Email address from a demo request — 1 year.
• Tracking system account — for as long as the service is provided; trip and location history — 2 years. After the service ends, the account and data are deleted unless the law requires longer retention.
• Visit source in your browser — up to 12 months
• Security — for the periods set by law
• Analytics and advertising cookies — according to each cookie’s lifetime (1–2 years)

5. Sharing data with third parties

We do not sell or transfer your personal data to third parties for commercial purposes. Data is processed only by our authorised service providers, to the extent needed to provide the service and with an obligation to protect it under the GDPR:

• providers of website hosting, receiving forms and enquiries, and email;
• payment service providers (to process the payment);
• delivery and parcel locker service providers (to deliver your order, we pass on the necessary delivery details);
• protection of forms against automated requests (bots) — technical data of the browser and device is processed for the check;
• providers of analytics and advertising services — only with your consent.

Payment and delivery service providers may act as independent controllers when performing their duties under the law. The tracking system, the demo environment and visit statistics run on servers under our control. Data is also disclosed where required by law or competent authorities. Where data is transferred outside the European Economic Area, we apply the safeguards required by the GDPR (e.g. standard contractual clauses); you can obtain information about them by writing to klienditugi@mugavauto.ee.

The controller applies appropriate organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure and other unlawful processing.

6. Your rights

Under the GDPR, you have the right to:

• Access — ask at any time which of your data we process.
• Rectification — request correction or completion of inaccurate or incomplete data.
• Erasure — request deletion of your data when there is no longer a legal basis for processing.
• Restriction of processing — request restriction of processing in certain cases.
• Objection — object to processing based on legitimate interests.
• Data portability — receive your data in a structured, machine-readable format.
• Withdrawal of consent — stop processing based on consent at any time; this does not affect the lawfulness of processing before withdrawal.

To exercise your rights, contact support: klienditugi@mugavauto.ee. We respond without undue delay and at the latest within one month of receiving the request; where necessary, this period may be extended under the conditions of Art. 12(3) GDPR. To protect your rights, you may lodge a complaint with the Estonian Data Protection Inspectorate: aki.ee

7. Final provisions

This privacy policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Estonian Personal Data Protection Act and other applicable law.

The data controller has the right to amend this privacy policy in whole or in part, notifying data subjects of changes through the website. Before using data for a new purpose, we will inform you and ensure a proper legal basis; where necessary, we will ask for new consent.