Privacy policy

1. Data controller

The controller of your personal data is Eincar Grupp OÜ (trading as STEK Estonia), registry code 11289601, registered address Võruvälja tn 9, 50112 Tartu, Estonia, place of business Rehepapi tee 4, 61709 Tartu. Email info@stek.ee, phone +372 555 81 911.

2. What data we process

• Contact details: name, email, phone and company name if you represent a business.
• Vehicle details and request content: make, model, year, desired coverage, message text and uploaded photos.
• Order and payment data: products or course ordered, invoice details, payment amount, time and method, and the bank the payment was made through. We never see or store bank credentials or card details.
• Communication: emails, phone calls and conversations with the Website's AI assistant.
• Technical data: IP address, browser and device information, pages visited, cookies and event logs.

3. Purposes and legal bases

• Fulfilling orders, issuing invoices, registering you for a course and processing payments: performance of a contract (GDPR art 6(1)(b)) and our accounting obligations (art 6(1)(c)).
• Forwarding a quote request to installers: steps taken at your request prior to entering into a contract (art 6(1)(b)).
• Customer communication, answering enquiries and advice via the AI assistant: legitimate interest (art 6(1)(f)).
• Website performance, security and fraud prevention: legitimate interest (art 6(1)(f)).
• Analytics and marketing (cookies, advertising pixels): your consent (art 6(1)(a)), which you can withdraw at any time in the cookie settings.

4. Recipients and transfers

• STEK certified installers, to whom we forward your quote request together with your contact and vehicle details.
• AS LHV Pank, which processes bank link and payment link payments. The bank processes payment data as an independent controller under its own terms.
• Technical service providers: hosting and database, email delivery (Resend) and AI language models used to generate the assistant's replies (OpenAI, Google). They process data on our behalf as processors (art 28).
• Analytics and marketing: Google Analytics, Plausible, Meta Pixel and Meta Conversions API, and a session analytics tool that helps us understand how the Website is used.
• Our accountant, auditor, legal adviser and public authorities in cases provided by law.
• Some providers (Google, Meta, OpenAI) may process data outside the European Economic Area. In that case we rely on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework (art 46).

5. Retention periods

• Quote request and contact form data is kept for up to 24 months from submission.
• Order, invoice and payment data is kept for 7 years as required by the Estonian Accounting Act.
• AI assistant conversations are kept for up to 12 months to improve the service, after which they are deleted or anonymised.
• Analytics data is kept according to the provider's settings, in Google Analytics for up to 14 months.

6. Your rights

• The right to access your data and receive a copy of it (art 15).
• The right to rectification (art 16) and erasure (art 17), subject to statutory retention obligations.
• The right to restrict processing (art 18) and to data portability (art 20).
• The right to object (art 21), including to direct marketing.
• The right to withdraw consent at any time where processing is based on consent.
• The right to lodge a complaint with the Estonian Data Protection Inspectorate (Tatari 39, 10134 Tallinn, info@aki.ee).

7. Cookies and tracking technologies

We use cookies and similar technologies. We ask for your consent on your first visit and you can change your choices later via the cookie settings button on the Website.

• Necessary: remembering your cookie consent and core Website functions. These cannot be switched off.
• Analytics: Google Analytics (cookie _ga, up to 2 years) and Plausible (cookieless). They help us measure traffic and page usage.
• Marketing: Meta Pixel (cookie _fbp, 3 months) for measuring ad performance and interest-based advertising.
• Tracking: session analytics that records navigation and clicks on the page to improve the Website's usability.

Your consent choice is stored on your device for 12 months. You can also delete and block cookies in your browser settings.

8. Security

Data is transmitted over an encrypted connection (HTTPS) and access to the database is restricted and password-protected. We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure and destruction.

9. Contact

For data protection questions and to exercise your rights, write to info@stek.ee or by post to Eincar Grupp OÜ, Rehepapi tee 4, 61709 Tartu, Estonia. We reply within 30 days at the latest.

10. Changes

We may update this privacy policy when our services or the law change. The current version is always available on the Website together with its update date.