Privacy policy

1. Data controller

The controller of your personal data is Scalebaltic OÜ (registry code 17428133), . For any data-protection matter, contact us at [email protected] or +372 5866 7188.

2. What data we collect

We only collect the data you submit yourself through our forms (car valuation request, waiting list, contact form):

• name;
• email address and/or phone number;
• car and transaction details you choose to add (make, model, year, mileage, asking price, notes, desired car, budget);
• the content of any message you send us.

We use no tracking cookies and no third-party analytics, and our fonts are self-hosted (no Google font CDN). Standard server logs may briefly hold your IP address for security and troubleshooting.

If you reached us through an ad or a tagged link, we store that link’s campaign markers (e.g. the Google or Facebook click ID and the campaign name) with your enquiry, so we know which advertising brought it. They are read from the page address — nothing is stored on your device. The legal basis is our legitimate interest in knowing which marketing works (Art. 6(1)(f) GDPR).

3. Purpose and legal basis

We process your data to respond to your enquiry, provide our car-brokerage service, and communicate with you about a possible transaction. The legal basis is your consent (Art. 6(1)(a) GDPR) and taking steps at your request prior to entering a contract (Art. 6(1)(b) GDPR).

4. Who we share data with

We do not sell your data. We share it only with trusted providers acting as our processors:

• Brevo (Sendinblue SAS, France) — email delivery and enquiry handling;
• our web-hosting provider — storing the site and enquiries on a server located in the European Union.

In addition: if you reached us through a Google ad and your enquiry became a qualified sale enquiry, we send Google Ireland Limited (Ireland) that ad click’s identifier (gclid) and the time of the enquiry, so Google Ads can measure which advertising works. Your name, contact details and car details are never sent to Google. Google processes this data as an independent controller under its own privacy policy. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR), and you may object to it at any time.

We may also disclose data where required by law.

5. International transfers

Your data is processed within the European Economic Area (EEA). The only exception is the Google ad-click identifier described above: Google may process it outside the EEA (e.g. in the USA), relying on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.

6. How long we keep it

We keep your enquiry data for as long as needed to handle your request and for the duration of any resulting business relationship, and delete it within a reasonable time once it is no longer needed. You can ask us to delete your data at any time.

7. Your rights

You have the right to:

• access your data and receive a copy;
• have inaccurate data corrected;
• have your data erased and restrict processing;
• object to processing and request data portability;
• withdraw consent at any time (this does not affect processing carried out before withdrawal).

To exercise your rights, email [email protected]. If you believe your rights have been infringed, you may lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee).

8. Changes

We may update this privacy policy from time to time. The current version is always on this page, together with its update date.