Your data. A clear agreement.

Who is responsible for your data?

The controller of personal data is RandKaar Solutions OÜ (registry code 17617162, address Pärnasalu tn 1-13, Räni alevik, Kambja vald, 61708 Tartu maakond). For data protection questions write to info@remondihinnad.ee.

What data do we collect?

When you send a request we store your vehicle details (make, model, year, fuel, mileage and, if you enter them, the gearbox and registration number), the selected services, the description, any photos you add, your name, email, phone number and chosen location. Sending a request creates an account for you; we store your password in hashed form and the time you accepted the terms of use. Before saving photos we remove their location and other metadata. We request your location through the browser only when you click “Use my location”. You can always choose a location on the map instead.

If you rate a workshop, we store the stars and comment. When you use the site, technical data (e.g. IP address, browser, page visited and time) is kept briefly in server logs for security.

If you use “Continue with Google”, we receive your name, email address and Google account identifier from Google. We store the identifier with your account to recognise you next time; your email address is then treated as confirmed, because Google has confirmed it. Google can see that you signed in to our site, and its processing is governed by Google's own privacy policy. Deleting your account also deletes the Google account identifier.

If you enter a registration number and use the search, we look the vehicle up in the Estonian Transport Administration's traffic register: vehicle type and category, make, model, year of first registration, fuel, engine size and power, and gearbox. We do not ask the register for the owner's or user's personal data. The details found fill in the form, you can change them before sending, and they are saved with the request when you send it. Searching for the same number again within an hour uses the answer already received.

Why and on what basis do we use data?

Sending your request to workshops, looking up vehicle details by registration number, showing replies, managing your account and service emails (confirming your account, password reset and notices about requests, quotes and choices): performance of a contract (Article 6(1)(b) of the General Data Protection Regulation).

Keeping the service secure, preventing spam and fraud, monitoring errors and anonymous visit statistics: our legitimate interest in keeping the service secure and working (Article 6(1)(f)).

Your name, email, phone number and location are needed so that workshops can reply to your request; without them a request cannot be sent. We do not use data for marketing or profiling and make no automated decisions that have legal or similarly significant effects on you.

Who sees your data?

Your request, its photos, your name, exact location and the registration number (if you entered it) are sent to approved matching workshops within the chosen radius so that they can reply. Only the workshop whose quote you choose sees your email and phone number. When using the data to communicate with you, the workshop is a controller in its own right. The workshop you rate sees your rating; the average of the stars is visible to customers who receive a quote from that workshop. The administrator can manage and delete requests.

Data is processed on our behalf by processors: Laravel Cloud (server, database and files; Laravel Holdings Inc., data stored in Frankfurt, Germany), Resend (sending emails), Cloudflare (site security and robot check), Google Workspace (emails sent to us) and Zone.eu (our server in Estonia, through which registration number searches reach the Transport Administration in encrypted form). When you search by registration number, we send the number to the Estonian Transport Administration, the controller of the traffic register, and receive the vehicle details in return. We do not sell data or share it for advertising.

Does data leave the European Union?

Laravel, Resend, Cloudflare and Google are US companies, so data may reach the United States. Transfers take place under the European Commission’s adequacy decision (EU–US Data Privacy Framework) where the company has joined it, or under the European Commission’s standard contractual clauses. Map tiles are provided by the OpenStreetMap Foundation in the United Kingdom, which is also covered by an adequacy decision.

How long do we keep data?

An open request closes automatically after 30 days; a week before, you get an email and can extend it. If the email address associated with a request is not confirmed, the request closes after 7 days. We delete the personal data of a closed request (name, contact details, description, photos, registration number and exact location) 24 months after it is closed; anonymised data remains (vehicle make, services, approximate area, prices and the workshop rating). A customer account that has not been used for 3 years is deleted together with its requests. You can delete your account and all your requests, including photos, yourself at any time in your account settings. Deleted data also disappears from backups within 7 days. Server logs are deleted automatically after a short time. We keep workshop data for as long as the account exists.

Cookies and maps

We use only cookies needed for the service to work: a session cookie for signing in and remembering your language, a security cookie protecting forms and, if you choose “Keep me signed in”, a persistent cookie. For site security we use Cloudflare’s network, which sets security cookies (__cf_bm and _cfuvid) in your browser to detect bots and attacks. Map tiles are loaded from OpenStreetMap, which sees your IP address. When you search for a location by address, the text you type goes through our server to the Land and Spatial Development Board’s address service In-ADS. When you choose a location on the map, with a town button or with the “Use my location” button, its approximate coordinates go to the same service so that we can show the name of the place (e.g. “Tartu linn”). Your IP address and other data are not passed to the Board, and the lookup is not linked to your account. We count visits anonymously: we store only a number per day and page. We do not use advertising or tracking cookies.

To keep robots out, the request form uses Cloudflare Turnstile, which processes your IP address and technical browser data during the check.

Workshop data

When a workshop registers we store the company name, registry code, address, location, phone number, email, services offered and the contact person’s name. The workshop’s email address is confirmed with a link, and we check the registry code using the public lookup service of the Business Register. We also store the time the workshop accepted the terms of use. The workshop’s name, address, phone number, email and average rating are visible to customers the workshop replies to. The legal basis is performance of a contract. We keep the data for as long as the account exists; when the account is closed we delete it together with the workshop’s replies.

To invite workshops, we use public data from the Business Register about companies whose field of activity is car repair: name, registry code, location, and the phone number and email address entered in the register. We use these contact details to invite workshops to join by phone or email. The basis is our legitimate interest in finding workshops for the site (Art 6(1)(f)). If you do not want us to contact you, reply “no thanks” to our email or write to info@remondihinnad.ee. We then keep only the company name and registry code, so that we do not contact you again. Other contact details are deleted within 12 months of the last contact.

Your rights

You have the right to request access to your data, its correction or deletion, restriction of processing and data portability, and to object to processing based on legitimate interest. You can view, change, download and delete much of your data yourself in your account. Otherwise write to info@remondihinnad.ee; we reply within one month at the latest. If you believe we breach data protection rules, you can contact the Estonian Data Protection Inspectorate (www.aki.ee, info@aki.ee).