Last updated: 3 September 2026
This policy explains how OnlyWorks OÜ collects, uses, stores and transfers the personal data of visitors to autopulse.ee, customers and persons contacting Auto Pulse.
1. Data controller
OnlyWorks OÜ
Registration number: 17132349
Registered address: Ümera tn 5-50, Lasnamäe linnaosa, 13816 Tallinn, Harju maakond, Estonia
Car service address: Pae 28, Tallinn, Estonia
Telephone: +372 5847 6264
WhatsApp: start a chat
Email: info@autopulse.ee
OnlyWorks OÜ is the controller of the processing described here unless otherwise specified in a particular case.
2. Data we process
Depending on the enquiry or service, we may process:
- first and last name;
- telephone number, email address and preferred contact method;
- vehicle registration number, VIN, make, model, year, equipment and mileage;
- information about faults, diagnostics, completed and recommended work;
- photographs and videos of the vehicle, its components, damage and instrument readings;
- booking, approval, order, warranty claim and complaint records;
- information about materials and installed parts;
- payment and accounting information required for invoicing and transaction confirmation;
- contents of emails, forms, telephone enquiries and messenger conversations;
- IP address, request time, browser, device, language, security logs and cookies;
- company and representative information when servicing a corporate vehicle.
Please do not provide information that is unnecessary for booking or delivering the service.
3. Sources of data
Data may be obtained:
- directly from the customer or their representative;
- through the website, email, telephone or WhatsApp;
- during vehicle inspection, diagnostics and servicing;
- from vehicle documents and materials provided by the customer;
- from parts suppliers and payment or accounting providers to the extent necessary for the transaction;
- automatically when the website is visited, subject to the selected cookie settings.
4. Purposes and legal bases
| Purpose | Primary legal basis |
|---|---|
| Responding to enquiries and arranging bookings | Steps before entering into a contract; legitimate interest in handling enquiries |
| Diagnostics, servicing, repairs and customer communication | Entering into and performing a contract |
| Approval of additional work and ordering parts | Performance of a contract |
| Invoicing, accounting and tax reporting | Compliance with a legal obligation |
| Service history and defence against claims | Performance of a contract and legitimate interest in documenting services |
| Photographing the vehicle’s condition for the order | Performance of a contract and legitimate interest in documenting condition and work |
| Website security, prevention of misuse and error diagnostics | Legitimate interest in security and reliable operation |
| Optional website analytics | User consent |
| Marketing communications | Consent, unless another legal basis applies |
| Handling complaints and establishing or defending claims | Legal obligation and legitimate interest |
Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect processing carried out before it.
5. Required information
Contact details and information identifying the vehicle and requested work are required for booking and performing the contract. Without them, Auto Pulse may be unable to confirm a booking, select parts, provide the service or issue a correct document.
Providing data for optional analytics and marketing is voluntary and is not a condition for receiving the main service.
6. Photographs and video
Auto Pulse may record mileage, vehicle contents, visible damage, component condition, diagnostic results and completed work. The material is used to perform the service, explain recommendations, prepare reports and handle possible claims.
Material identifying a customer or vehicle is not published in advertising or social media without separate permission unless publication is required by law.
7. Recipients
Where necessary, data may be received by:
- hosting, email, website and booking-system providers;
- communications and messenger providers chosen by the customer;
- accountants and accounting-service providers;
- banks and payment-service providers;
- parts suppliers for compatibility checks and order fulfilment;
- IT and security providers;
- legal, insurance and technical advisers;
- public authorities where disclosure is required by law;
- a new business owner in the event of a lawful reorganisation or business transfer.
Processors must act on OnlyWorks OÜ’s instructions, maintain confidentiality and apply appropriate safeguards.
8. Transfers outside the EEA
Some technology providers may process data outside the European Economic Area. GDPR safeguards are used in such cases, including a European Commission adequacy decision, Standard Contractual Clauses or another lawful basis. Information about a specific transfer may be requested by email.
When WhatsApp, Google Maps or another external service is used, its provider also processes data under its own privacy policy.
9. Retention periods
Data is retained only for as long as necessary:
- enquiries not resulting in an order — normally up to 2 years after the last substantive contact;
- bookings, approvals, service history and order materials — for the contractual relationship and the period necessary for possible claims;
- written complaints and evidence — until the case is closed and applicable limitation periods expire;
- primary accounting documents, contracts and records required to reconstruct transactions — normally 7 years after the end of the relevant financial year, or longer if required by law;
- marketing-consent data — until withdrawal or discontinuation of marketing;
- cookie choices — until the consent record expires or is changed;
- technical logs — for a limited period required for security, error investigation and misuse prevention.
Where several periods apply, data may be retained until the longest mandatory period expires. It is then deleted or irreversibly anonymised.
10. Automated decision-making
OnlyWorks OÜ does not make decisions producing legal or similarly significant effects solely through automated processing. Spam filtering and website security are not used to determine automatically whether a customer is entitled to a service.
11. Your rights
Where provided by the GDPR, you may:
- obtain information about processing and a copy of your data;
- request correction or completion;
- request deletion;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive data you provided in a portable format, where applicable;
- withdraw consent;
- lodge a complaint with a supervisory authority.
These rights are not absolute. For example, data cannot be deleted while accounting laws require its retention or while it is needed for a legal claim.
Contact info@autopulse.ee, stating which right you wish to exercise. Identity verification may be required before disclosure. A response will be provided within the GDPR deadline.
Estonian supervisory authority: Andmekaitse Inspektsioon — www.aki.ee.
12. Security
OnlyWorks OÜ applies proportionate organisational and technical safeguards, including access restrictions, account management, backups, software updates, secure data transmission and supplier oversight. Absolute security cannot be guaranteed, but risks are regularly assessed according to the nature of the information.
13. Cookies and external services
Details about cookie categories, external content and consent management are provided in the Cookie Policy. Optional analytics and marketing technologies must not be activated before consent.
14. Policy changes
This policy may be updated when services, processes, the website or legislation change. The current version and update date are published on autopulse.ee.
