Privacy policy
In force from 18.10.2026.
Autojoy OÜ (registry code 14752838), located at Mäealuse tn 10, box 5, 12618 Tallinn, Estonia, operates the autotools online store at autotools.ee. We protect your personal data and process it in accordance with the General Data Protection Regulation (GDPR) and Estonian law.
This privacy policy explains what data we collect, what we use it for, who we share it with, and what rights you have.
Definitions
- Personal data - information that identifies a person directly or indirectly.
- Processing - any operation on personal data: collection, storage, modification, deletion.
- Controller - Autojoy OÜ, which decides why and how the data is processed.
What data we collect
- Contact and delivery details - name, email, phone, delivery and billing address; for company purchases also company name, registry code and VAT number.
- Order data - the goods bought, the amount, payment method, delivery method, order history.
- Payment data - we never see or store your bank or card details. They are handled by the payment service provider.
- Account data - if you sign in with a Google account, we receive your name and email address.
- Loyalty data - your tier and points, worked out from the orders you have paid for.
- Gift card recipients - if you send a gift card to someone, the name and email address you give us for them.
- Reviews - the rating and text you write. Your first name and the initial of your surname are shown with the review.
- Withdrawals and complaints - what you tell us when you withdraw from a contract or report a fault.
- Messages to us - what you write to us through the contact form or when you report a mistake on a product page, with the name, email, phone and order number you give and the product you report on. With a mistake report we also keep your connection's IP address, so the same product cannot be reported over and over.
- Technical data - pages viewed, device and browser type, IP address, and recordings of how pages are used, in which every input field is masked. This is collected only with your consent.
- Advertising data - collected only with your marketing consent: the ad you came from (a click identifier), cookies that tell your browser apart for Meta and Google, your IP address and browser type, and, when you buy, the order's number, products and value with your email address and phone number in hashed form.
Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Fulfilling and delivering your order | Performance of a contract |
| Your account and signing in | Performance of a contract |
| The loyalty programme | Performance of a contract |
| Delivering a gift card to its recipient | Legitimate interest |
| Accounting and tax records, checking a company's VAT number | Legal obligation |
| Withdrawals, complaints and customer support | Contract, legal obligation |
| Showing the reviews you write | Consent |
| Asking you to review what you bought | Legitimate interest |
| Counting sales and reviews | Legitimate interest |
| Store security and fraud prevention | Legitimate interest |
| Newsletter and offers | Consent |
| Analytics and usage measurement | Consent |
| Measuring our ads and showing ads that match your interests | Consent |
After a purchase we may email you asking how you liked what you bought. Every such email has a link that stops them, separately from the newsletter.
When an order is paid or a review is submitted, we record that it happened in our analytics: the order value and number of items, or the rating. No name, contact details or review text are recorded. If you consented to analytics, the paid order is also credited in Google Analytics to the visit it came from.
If you consented to marketing, a paid order is also reported to Meta and Google: its number, products and value, with your email address and phone number in hashed form (put through a one-way function), so they can link the purchase to the ad you saw. If you did not, neither receives anything about you. For collecting and sending this data, Meta Platforms Ireland Limited and Autojoy OÜ are joint controllers under Meta's Controller Addendum: we decide what our pages send, and Meta answers for how it uses the data for its ads. You can exercise your rights with either of us.
Who we share data with
We do not sell or rent your data. We share it only where it is needed to provide the service:
| Recipient | Purpose |
|---|---|
| Montonio Finance UAB | Payment handling |
| Montonio Finance OÜ | Delivery booking |
| Delivery partners (parcel machines and couriers) | Delivering the goods |
| Resend (Resend, Inc., USA) | Sending order emails, and newsletters with your consent |
| Amazon Web Services (European Union) | Hosting the online store and its data |
| Accounting software and service provider | Invoices and statutory bookkeeping |
| PostHog Cloud EU (Frankfurt) | Analytics with your consent; counting sales and reviews |
| Google Ireland Limited (Google Analytics) | Analytics with your consent: where visits come from, and which end in a purchase |
| Meta Platforms Ireland Limited (Facebook, Instagram) | Measuring our ads and showing ads that match your interests, with your consent |
| Google Ireland Limited (Google Ads) | Measuring our ads, with your consent |
| The European Commission's VIES service | Checking a company's VAT number |
| Apple (Apple Pay) and Google (Google Pay), through Montonio | Confirming a wallet payment, when you choose one at checkout |
At checkout your browser itself checks whether your device can pay with Apple Pay or Google Pay, so that only the ways to pay that work on your device are shown. No data is sent to anyone for this check. If you choose Apple Pay or Google Pay, the payment continues on Montonio's payment page and Apple or Google confirms it under their own privacy terms.
Data may also be disclosed where the law requires it, or in a merger or sale of the business.
AI assistants
An AI assistant such as Claude or ChatGPT can search our catalogue and put a basket together through a public endpoint at /mcp. The endpoint needs no sign-in, asks for no personal data and cannot see accounts, orders or anyone's details.
- IP address - to limit how many requests one caller can make, we count them by the IP address they come from. The count is kept only in the server's memory, covers at most the last hour and is not saved to a database. The legal basis is legitimate interest: store security.
- Basket - a basket the assistant builds holds only products and quantities, with no name or contact details. It becomes yours only when you open its link in your own browser. A basket nobody opens is set aside 30 days after it was last used and deleted 180 days after that, about 210 days after its last use.
- Server logs - as on every visit to the shop, our access logs record the IP address and time of each request; they are kept for 90 days. Application logs record which tool was called, not your IP address or what was searched for, and are kept for 30 days.
- The assistant itself - what you write to the assistant is processed by its provider under their own privacy terms. We receive only the requests it sends us, such as a search phrase.
Partner programme
If you apply to our partner programme or are one of our partners, we process the data below. The programme's own rules are in the partner programme terms.
- Application - name, email, phone, company, country, the kind and size of your audience, a link to your channel and your message. We use them to decide on the application. The legal basis is taking the steps you asked for before entering into a contract. Before approving an application we check the applicant against the EU sanctions list, which is a legal obligation. A rejected application is deleted after 12 months.
- Payout details - the company name, registry code, VAT number, IBAN and account holder's name a partner gives us, and for an entrepreneur account the declaration that it is one. We use them to pay commission and to draw up invoices and payment statements. The legal basis is the contract, and for accounting records a legal obligation. They go to our bank, our accounting software and service provider and, for an entrepreneur account, the Estonian Tax and Customs Board. Payout records are kept for 7 years, as the Accounting Act requires.
- Shoppers - if you use a partner's code on an order, the partner learns only that order's date, value and state, never who you are or what you bought. If we count visits to a partner's link, we count them per day and referring site, with no personal data.
How long we keep data
- Order and invoice data - 7 years, as required by the Accounting Act.
- Account data - until the account is deleted.
- Reviews - while the product is sold, or until you ask us to remove the review.
- Messages to us - 2 years after we have answered them; the IP address kept with a mistake report, up to 30 days.
- Newsletter data - until you withdraw consent.
- Analytics data - up to 14 months.
- Advertising data - with us, until the paid order is reported, and at most 30 days for an unpaid order; Meta keeps event data for up to two years.
Your rights
You have the right to:
- see the data we hold about you,
- have inaccurate data corrected,
- have your data erased,
- have processing restricted,
- receive your data in a machine-readable form and transfer it,
- object to processing based on legitimate interest,
- withdraw any consent at any time.
Withdrawing consent does not make processing that happened before the withdrawal unlawful. You can see and change your addresses and email preferences yourself on your account page.
To exercise these rights, write to info@autotools.ee. We answer within one month.
Cookies
Cookie use is described in the cookie policy. Analytics and marketing run only with your consent, and you can change that consent at any time using the Cookie settings button in the page footer.
Data security
We use technical and organisational safeguards: encrypted connections, restricted access to data and regular backups. No method of transmission is completely secure, so we cannot give an absolute guarantee.
When a page shows a discount code, we count how often each IP address asks for one, so that codes cannot be guessed by trying them. The count is kept only in the server's memory, covers at most the last hour and is never stored in a database. The legal basis is legitimate interest: store security.
Where data is held
The online store and its data are held in the European Union. Resend, which sends our emails, may process the recipient's address and the message in the United States, and Google may transfer analytics data to Google LLC there. With your marketing consent, Meta and Google may transfer advertising data to Meta Platforms, Inc. and Google LLC there. These transfers rely on appropriate safeguards, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.
Children's data
The online store is not aimed at people under 16 and we do not knowingly collect their data. If such data reaches us, we delete it.
Changes
We may update this privacy policy. A new version is published on this page with an updated effective date.
Contact and complaints
Controller: Autojoy OÜ, Mäealuse tn 10, box 5, 12618 Tallinn, Estonia. Email: info@autotools.ee. Phone: +372 5077886.
If you believe we process your data unlawfully, you may complain to the Estonian Data Protection Inspectorate (Tatari 39, 10134 Tallinn, info@aki.ee, +372 627 4135).