1. Data controller

CAAR Oy
Business ID: 3574361-3
Address: Vetokuja 2, 01610 Vantaa
Email: tietosuoja@caar.fi

CAAR Oy is responsible for the processing of your personal data and ensures that the processing of data is
lawful, secure and transparent.

2. Person responsible for data protection

Our company has a designated contact person responsible for data protection, whose task is to oversee
the processing of personal data and ensure compliance with the GDPR.

Contact details:
tietosuoja@caar.fi

3. Processing of personal data

We process your personal data for the following purposes:

• Customer relationship management: sales, purchases, test drives, financing, insurance and additional services.
  Legal basis: contract and statutory obligations.
• Marketing and communications: electronic direct marketing, campaigns, customer surveys and newsletters.
  Legal basis: consent or legitimate interest.
• Website and service analytics: monitoring site usage, cookie management, technical optimisation and security.
  Legal basis: legitimate interest and/or consent to cookies.
• Security and fraud prevention: monitoring of premises and services, prevention of fraud.
  Legal basis: legitimate interest and statutory obligation.
• Compliance with laws and regulatory obligations: accounting, records management, Traficom notifications.
  Legal basis: statutory obligation.

4. Personal data processed

The personal data varies depending on the situation, but may include:

• Customers and leads: name, address, email, phone, driving licence details,
  vehicle details, company details, financing and insurance details, communications and customer feedback.
• Website visitors: IP address, device and browser information, cookies and anonymised usage data.
• Service users: messages from chat services, WhatsApp contacts
  (only if the customer uses the application) and other information they provide.
• Other individuals: employees, drivers or service providers in situations related to their duties.

5. Retention period of personal data

The retention period is determined by the purpose of the processing and the requirements of the law.
Examples:

6. Sources of data

Personal data is obtained:

• From the customers themselves (forms, email, calls, chat, WhatsApp).
• From public registers and authorities (e.g. Traficom, the Population Information System,
  the credit information register).
• From service providers, such as analytics and marketing partners.
• From data collected via website tracking tools and cookies.

7. Data security

To protect personal data we use appropriate organisational and technical measures,
such as:

• Firewalls and encryption
• Managed access rights and access control
• Staff training and confidentiality obligations
• Regular data backups and deletion as needed

As the data controller, we ensure that access rights to servers and stored data
are handled confidentially.

8. Recipients of personal data

Data may be disclosed to:

• Authorities: Traficom and other authorities required by law.
• Financing and insurance companies: with the customer’s consent.
• Service providers and subcontractors: IT, analytics, marketing and cloud services,
  which act only as processors in accordance with the contract.
• Business arrangements: the sale, merger or other restructuring of the company, always in accordance with the GDPR.

As a rule, data is not transferred outside the EU/EEA, but if a transfer does take place,
adequate data protection is ensured, for example through standard contractual clauses or the customer’s
consent.

9. Rights of the data subject

The data subject has the right to:

• Access and obtain a copy of their own data
• Request the rectification or completion of their data
• Request the erasure of their data (the “right to be forgotten”)
• Restrict processing or object to direct marketing
• Transfer the data to another controller
• Withdraw any consent given at any time
• Lodge a complaint with the Office of the Data Protection Ombudsman
  (https://tietosuoja.fi)
• Requests can be sent by email to
  tietosuoja@caar.fi
  or by post to the company’s address at Vetokuja 2, 01610 Vantaa

10. Cookies and tracking

The site uses cookies and tracking technology for analytics, direct marketing and
improving the operation of the site. Users can manage their consents through the cookie policy.

11. Changes to the privacy policy

We reserve the right to update this privacy policy in the event of changes in legislation or
in our practices. The up-to-date version can always be found on our website.