Privacy Policy

1. Data Controller

RZ.Torski OÜ (trading as VINParts) Kirsi tn 8-18, 10616 Tallinn, Republic of Estonia Registry code: 16910388 Email: info@vinparts.ee Phone: +372 787 8822 Website: www.vinparts.ee This Privacy Policy explains what personal data RZ.Torski OÜ collects, for what purposes and on what legal bases it is processed, to whom it is disclosed, and what rights you have as a data subject. This Policy complies with Regulation (EU) 2016/679 (GDPR) and the Estonian Personal Data Protection Act (IKS).

2. Categories of Personal Data Collected

Identification data: first and last name, email address, phone number (legal basis: GDPR Art. 6(1)(b) — contract performance). Delivery data: delivery address, city, postcode, country (legal basis: GDPR Art. 6(1)(b)). Financial data: payment transaction reference and status — we do not accept online payments at the moment, so no payment data is collected. Before payments are connected we will update this section with the name of the payment provider. Technical data: IP address, browser type and version, browser language preference (only to show the site in a language you understand, not stored), device data, page visit log (legal basis: GDPR Art. 6(1)(f) — legitimate interest — security and fraud prevention). Behavioural data: cart contents, viewed products, search queries, clicks (legal basis: GDPR Art. 6(1)(b) and 6(1)(a) — consent for analytics cookies). Vehicle data: VIN code, make, model, year, registration plate (Estonian plates) — used solely to find compatible parts for your vehicle (legal basis: GDPR Art. 6(1)(b)). AI chat data: content of conversations with Otto the AI consultant, including parts queries — processed to provide the service, retained for 90 days (legal basis: GDPR Art. 6(1)(b)). Voice data: we save phone calls and voice conversations on the website as a text transcript, not an audio recording. We treat a person's voice as personal data. We disclose this at the start of the call. We keep transcripts only as long as necessary for the purpose. You have the right to a copy of the text transcript of your conversation (legal basis: GDPR Art. 6(1)(b)). More about our use of artificial intelligence: /en/ai Identity verification data (affiliate programme members only, for payouts from a certain level): first and last name; the document and face check is done by Veriff, we keep its result (status and date), the verification ID and the reason for a rejection (legal basis: GDPR Art. 6(1)(b) — performance of the contract with the partner). Technical record of the Otto voice window: while you use the Otto voice window, it reads a few technical signals from your device and sends them to our server — the browser type as a single word (home-screen shortcut, Safari, Chrome on iOS or other), whether the microphone is allowed, whether the microphone is delivering sound, the state of the browser's audio system and whether the tab is visible — as well as connection events with the voice service (opening, closing, error codes and short error messages, the silence timeout) together with the time of the event. The purpose is to find and fix voice problems. We do not store the raw browser description (userAgent), your name, account or a persistent identifier, and the record is not linked to you. The record is kept for 30 days.

3. Purposes of Processing and Legal Bases

Order fulfilment (GDPR Art. 6(1)(b)): receiving and confirming orders, arranging delivery, issuing invoices. Customer support (GDPR Art. 6(1)(b)): responding to queries, handling complaints and returns. Referral programme (GDPR Art. 6(1)(b)): tracking referral links, calculating and paying bonuses. Accounting (GDPR Art. 6(1)(c)): sales invoices and accounting records for 7 years as required by the Accounting Act. Analytics (GDPR Art. 6(1)(a) — consent): website usage analysis via Google Analytics GA4 in anonymised form. Marketing (GDPR Art. 6(1)(a) — consent): newsletters and promotional emails — only with separately given consent. Security (GDPR Art. 6(1)(f) — legitimate interest): fraud detection, system protection. VINParts Club / loyalty programme (GDPR Art. 6(1)(b)): managing VP Points, tracking loyalty status, calculating and crediting bonuses.

4. Legal Bases Summary (GDPR Art. 6)

Art. 6(1)(a) — consent: marketing emails, analytics cookies, marketing targeting. Consent can be withdrawn at any time. Art. 6(1)(b) — contract performance: all operations related to the purchase process — order, delivery, returns, customer support. Art. 6(1)(c) — legal obligation: retaining accounting records for 7 years (Accounting Act § 12), tax obligations. Art. 6(1)(f) — legitimate interest: fraud protection, system security, anonymised usage statistics.

5. Retention Periods

Accounting documents (invoices, payments): 7 years from the end of the financial year in which the transaction was recorded in the accounting register — Accounting Act § 12. Customer profile data: 3 years after the last order or account closure, whichever is earlier. Order history: 3 years after the last activity on the account (an order, cart or chat with Otto) — to support warranty and complaint rights. After that, the delivery address, phone and notes on orders are erased; the exception is an account with an unspent bonus balance or an open payout. Invoices of paid orders (including the buyer's name and contact details) and payments are kept as accounting documents (see above). AI chat logs (Otto): 90 days — to improve service quality. Referral programme data (unconfirmed partners): 90 days. Cookies: see the cookie table in section 11. GDPR requests (access, erasure requests): 3 years — to demonstrate compliance. Otto voice window technical record: 30 days — to find voice problems. After the retention period, data is deleted or anonymised.

6. Disclosure to Third Parties

7. International Data Transfers (GDPR Art. 44–46)

Some of our partners are located outside the European Economic Area (EEA), primarily in the United States. Such transfers are permitted only under Chapter V GDPR (Art. 44–49), i.e. where adequate protection is ensured (a European Commission adequacy decision or appropriate safeguards, e.g. standard contractual clauses under Art. 46(2)(c)). Anthropic PBC (USA) — your text conversations with Otto AI are sent to Anthropic's servers in the USA; so are emails you send us, when our staff translate them, and photos of documents (invoices, receipts) that our staff upload to the accounting assistant. OpenAI OpCo LLC (USA) — Otto voice conversation on the phone. Google LLC (USA) — Otto voice conversation on the website (Gemini Live), customer memory, image recognition, Google Analytics (anonymised), OAuth, fallback text chat and email translation, business email info@vinparts.ee (Gmail / Google Workspace). What you say aloud to Otto on the website, including a VIN or a car registration number, is also sent to Google (Gemini Live) as sound so that the conversation can be processed. If the OpenAI voice service is unavailable, the voice of a phone call may be processed by Google (Gemini Live) instead. Resend Inc (USA) — transactional emails. Twilio Inc. (USA) — SMS verification codes and carrying telephone calls (Otto phone conversation). National Highway Traffic Safety Administration (NHTSA, USA) — decoding a vehicle's VIN when you enter a VIN (the VIN is sent without your personal details). Railway Corporation (USA) — hosting of the website and database; the servers are in the EU (Netherlands), but the company is based in the USA, so in case of access from the USA the EU–US Data Privacy Framework applies where the recipient is certified, otherwise the EU standard contractual clauses apply (European Commission Decision 2021/914). For the safeguard used for a specific recipient, write to info@vinparts.ee.

8. Data Subject Rights (GDPR Art. 15–22)

Right of access (Art. 15): the right to know what data is processed about you, for what purposes and to whom it is disclosed. Right to rectification (Art. 16): the right to request correction of inaccurate data. Right to erasure / Right to be forgotten (Art. 17): the right to request deletion of data when there is no longer a legal basis for processing. Right to restriction of processing (Art. 18): the right to request suspension of data use in certain cases. Right to data portability (Art. 20): the right to receive your data in a machine-readable format and transfer it to another service provider. Right to object (Art. 21): the right to object to processing based on legitimate interests. Right to withdraw consent (Art. 7(3)): consent-based processing can be cancelled at any time — this does not affect the lawfulness of processing before withdrawal. Right not to be subject to automated decision-making (Art. 22): we do not make decisions based solely on automated processing that would significantly affect you.

9. Exercising Your Rights

To exercise your rights, send an email to info@vinparts.ee stating: • Type of request (access / rectification / erasure / etc.) • Your name and email address • Brief description of the request We will respond within 30 days of receiving the request (GDPR Art. 12(3)). In complex cases we may extend this by 2 months, notifying you accordingly. We may ask for additional proof to verify your identity. We will not disclose data without verification. In your profile settings you can download your data (GDPR portability) and delete your account.

10. Complaint to the Data Protection Inspectorate (AKI)

If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the supervisory authority: Estonian Data Protection Inspectorate (AKI) Tatari 39, 10134 Tallinn Email: info@aki.ee Phone: +372 627 4135 Website: www.aki.ee You may also submit a complaint via the AKI website. We recommend contacting us first to try to resolve the matter directly.

11. Cookie Policy

Cookie table (all cookies set by our site itself; HttpOnly means scripts cannot read them): Essential cookies (always set; no consent is requested because they are needed to provide a service you explicitly requested — second sentence of Article 5(3) of Directive 2002/58/EC; for personal data GDPR Art. 6(1)(b)): • authjs.session-token (over HTTPS: __Secure-authjs.session-token) — account sign-in session; HttpOnly; 30 days • authjs.csrf-token (over HTTPS: __Host-authjs.csrf-token) — protects the sign-in form against forged requests; HttpOnly; until the browser is closed • authjs.callback-url — returns you to the page after sign-in; HttpOnly; until the browser is closed • authjs.pkce.code_verifier and authjs.state — protect sign-in with Google; HttpOnly; 15 minutes • csrf_token — protects the order, contact, registration and withdrawal forms against forged requests; 1 hour • VINPARTS_LANG_CHOICE — the language you chose (language switcher, language bar or Otto voice command); contains only the language code; 180 days; set by us only, no third-party access • VINPARTS_LOCALE — page language for one session; until the browser is closed; us only Partner link: • affiliate_ref — set only when you open a link with the ?ref= parameter; holds the code of the partner whose link you followed, so that their reward for your order can be credited; HttpOnly; 180 days; us only. When you open the link we also record the IP address, browser type and the referring page, to protect against click fraud Automatic language: on your first visit, if you have not chosen a language, we show the site in the language preferred by your browser (Accept-Language header) if it is Estonian, Russian, Ukrainian or English, otherwise in Estonian. We use this value only to choose the language of the response; we do not store it or combine it with other data. You can change the language at any time with the switcher. Browser local storage (localStorage and sessionStorage — not cookies, but also records on your device that do not leave it, except the consent record described below): • vinparts_cookie_consent, vinparts_cookie_analytics, vinparts_cookie_marketing — your cookie choice; vinparts_cookie_anon — a random identifier. The choice is also recorded on our server as proof (identifier, choice, language and — if you are signed in — your account identifier; no name, e-mail or IP address is written there) • vinparts_cart — cart contents (erased on sign-out) • vinparts_wishlist, vinparts_compare_v1, vinparts_recently_viewed — wish list, comparison and recently viewed products • vinparts_selected_vehicle, regcheck_data, pending_garage_car — selected vehicle and plate-lookup data (until the tab is closed; erased on sign-out) • victor_v10, victor_session_id, vinparts_conversation_state, victor_triggers_v1, otto_bubble_seen_v2 — Otto conversation state and display settings • vinparts_notifications, vinparts_push_dismissed, vinparts_custom_avatar — profile notifications and picture (the picture is erased on sign-out) • otto-live-open, vp-standalone-launch, vp-chunk-reload, vp_tg_webapp — technical flags (Otto voice window state, opened-as-app marker, reload-loop guard, Telegram Mini App marker); until the tab is closed • _vsid — random visit identifier for the site's internal statistics (until the tab is closed) Analytical cookies (consent only, GDPR Art. 6(1)(a); the third-party script is loaded only after consent and only if the tool is switched on on our site): • _ga — Google Analytics GA4 user identifier — 2 years • _ga_XXXXXXXXXX — Google Analytics GA4 session state — 2 years • Hotjar: _hjSessionUser_XXXXXXX — 365 days; _hjSession_XXXXXXX — 30 minutes (extended with activity); plus short-lived technical cookies (_hjCookieTest, _hjTLDTest and others) and _hjHasCachedUserAttributes, _hjUserAttributesHash Marketing cookies (consent only, GDPR Art. 6(1)(a)): • _fbp — Facebook Pixel (Meta); usually up to 90 days, the period is set by Meta Technical cookies of our closed back-office (CRM) are set only for staff, not for site visitors. You can change cookie settings at any time in the cookie banner. Refusing essential cookies affects website functionality. Legal basis: Article 5(3) of Directive 2002/58/EC (as amended by Directive 2009/136/EC) and, for personal data, the General Data Protection Regulation (EU) 2016/679.

12. Changes to This Policy

We reserve the right to update this Privacy Policy. For significant changes, registered users will be notified by email at least 14 days in advance. The current version is always available at www.vinparts.ee/en/privacy. The date of changes is shown at the top of the page.