Privacy policy
This policy explains what personal data we collect on allmotors.fi, what we use it for, which services store it and where, and how you can get at your own data. Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).
1 · Who is responsible
ALL Motors Oy (business ID 2773112-9, VAT number FI27731129) is the controller of the personal data described here.
Registered office and postal address: Valuraudantie 23, 00700 Helsinki.
We work from two locations, both part of the same company: Helsinki, Valuraudantie 23, 00700 Helsinki (info@allmotors.fi), and Nummela, Tervasuontie 2, 03100 Nummela (nummela@allmotors.fi). Phone +358 50 512 8450.
We have not appointed a data protection officer, as the scale of our activity does not require one. For anything privacy-related, write to info@allmotors.fi.
2 · What we collect
The enquiry and quote form is the only place a visitor gives us anything. The site has no user accounts, no payments, no file uploads, and no analytics or visitor tracking of any kind.
What you enter on the form
| Field | Required | Personal data |
|---|---|---|
| Name | yes | yes |
| Phone number | yes | yes |
| Email address | yes | yes |
| Workshop location | yes | no |
| Car make and model | no | indirectly |
| Year | no | no |
| Registration number | yes | yes — it identifies a vehicle and, through the register, its keeper |
| Mileage | yes | no |
| Free-text message | no | whatever you choose to write in it |
| Consent checkbox | yes | the consent record itself |
What is recorded automatically when you submit
- A salted SHA-256 hash of your IP address — never the address itself. Used only to limit how many submissions can come from one source. This is a deliberate design choice: the original address cannot be recovered from the hash.
- Your browser identifier (user-agent), truncated to 300 characters
- The timestamp of your consent
- Which page the enquiry was sent from
- The language you were using
- A spam score and the reasons behind it
We do not collect special-category data and never ask for it. The free-text box is open, though: please do not type health information or other sensitive details into it — tell us those on the phone instead.
3 · Why we use it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to your enquiry, quoting, and arranging the work | all form fields | Contract or pre-contractual steps (GDPR 6(1)(b)) |
| Preventing spam and abuse | IP hash, browser identifier, time spent on the form | Legitimate interest (GDPR 6(1)(f)) |
| Being able to show that consent was given | consent flag and timestamp | Legal obligation and accountability (GDPR 5(2)) |
| Remembering your chosen language | your browser's local storage | Strictly necessary for the site to work — no consent needed |
We do not use your data for marketing, we do not sell it, and we do not share it with third parties beyond the technical processing described in this policy. There is no automated decision-making and no profiling.
4 · The services we use and where your data sits
The site and the handling of enquiries run on Google cloud services. Below is the complete list of what each service receives and which region it runs in.
| Service | What it processes | Location |
|---|---|---|
| Google Cloud / Firebase — Firestore, Cloud Functions, Storage, Auth | all enquiry data | europe-north1, Finland — the data stays in the EU |
| Firebase Realtime Database | IP hashes and counters. No enquiry content | europe-west1, Belgium — EU. The service has no Nordic region |
| Firebase Hosting / CDN | server logs, which include visitors’ IP addresses | Google’s global edge network |
| Google (Gmail) and Microsoft 365 email | a copy of every enquiry is sent from a Google account to the workshop’s own mailboxes | Google and Microsoft, EU |
| bara-cookie (BARADATA) — cookie consent | your consent choices and the technical details needed to record them | BARADATA, Firebase platform |
| Google Maps embed | your IP address and device details — only if you press “Show map” yourself | |
| YouTube (youtube-nocookie.com) | your IP address — only if you start the video yourself | |
| Google reCAPTCHA Enterprise (App Check) | device and behaviour signals for bot detection | Not currently in use — it has not been switched on |
| GitLab CI — software development | source code only, no personal data | — |
Google and Microsoft act as processors on our behalf in these services, under their own data processing terms. The content of your enquiry is stored in the EU. Using the map, the video or the typefaces can involve a transfer outside the EU; those transfers rely on the European Commission’s standard contractual clauses and the EU–US Data Privacy Framework.
5 · The email copy of your enquiry
A copy of every enquiry is emailed to the workshop’s own mailbox so that someone actually sees it in time. That means your data sits in two places: the database, where it has an automatic deletion date, and the mailbox, where it is kept for 24 months, the same rule as in the database.
In practice the mailbox copy is what determines the real retention period. If you ask us to delete your data, we delete it from both.
6 · How long we keep it
| Data | Retention | How it happens |
|---|---|---|
| Enquiries in the database | 24 months | Automatic — every record is written with a deletion date and the database removes it on its own |
| The email copy | 24 months, the same rule as in the database | Manual — handled in the workshop’s mailbox |
| Administrative audit log | 90 days | Automatic, same mechanism |
| Server logs (IP addresses) | Google’s default period | Controlled by Google, not something we set |
7 · Security
The connection to the site is always encrypted (HTTPS, HSTS). The enquiry form has several server-side defences against spam and abuse: a hidden field, a check on how long the form took to fill in, and a submission-rate limit based on the IP hash.
Only named workshop staff can reach the database, each with their own login. A submitted enquiry cannot be edited after the fact — staff can only add their own notes to it.
8 · Your rights
You have the right to access your data, correct it, ask us to delete it, restrict or object to how we use it, take it elsewhere, and withdraw any consent you gave.
We will be straightforward about how that works: there is no self-service privacy portal on this site, and every request is handled by hand. Email info@allmotors.fi, and we will find your record and deal with it within one month at the latest. Deletion covers both the database and the email copy.
A submitted enquiry cannot technically be edited. If something in it is wrong, we delete the record and, if needed, enter it again correctly.
If you believe we are handling your data unlawfully, you can complain to the Office of the Data Protection Ombudsman (tietosuoja.fi). We would rather you came to us first.
9 · Cookies
The site has no analytics, no advertising pixels and no tracking, but we ask your consent before loading the map or the video. The separate Cookies sets out exactly what is stored in your browser and how to change your choice.
10 · Changes to this policy
If we change what we collect or which services we use, we update this policy and its date. We will note significant changes on the front page of the site.