Privacy Policy

The data controller is AutoNord Market Oy, 21120 Raisio, Finland, business ID 3647647-3, reachable at [email protected]. AutoNord is an online car marketplace operated in Finland.

Account details (name, email, phone, password hash); listing and vehicle data you submit; messages, enquiries, offers, bookings and contracts; and technical data (IP address, the approximate country and town described in the next section, browser, operating system and device type, the site you arrived from, the pages you open and when, and the cookies described below). We also store the vehicle content we read from a seller's own website when that seller has asked us to: the vehicle details, descriptions and photographs on the public pages at the address they gave us, together with the address each item came from and the time it was read. Those pages sometimes carry personal data — a named salesperson, their photograph, a direct phone number or an email address. We keep only what the listing needs and build no profile of anyone from it. We read only from a site the seller runs, never from another vehicle marketplace, and a dealership can stop the reading at any time in AutoNord Pro.

We estimate where a visit comes from — the country and, where our database has it, the town — from the IP address your connection presents. The lookup runs against a location database held on our own servers: no request goes to another company, and the lookup itself stores nothing. This is an estimate at town level, not a position. It describes the network a visit arrives on, which is often not where the person is, and we never treat it as more than an approximation. We do not collect satellite or device-level location and we do not ask your browser or your phone for it. If we offer a feature that needs your device's precise location, your browser asks you first and you can refuse; refusing costs you nothing but that feature. The estimated country and town are stored with the record of the page visit, whether or not you accepted analytics cookies. For a visitor who declined, it is kept against the one-day code described under Cookies and with no address. The IP address itself is stored only for a visitor who accepted analytics cookies, and it is erased after 90 days. We use the estimate to see which countries and towns our visitors come from, to present the service in a sensible language and market, to keep the service secure and investigate misuse, to measure and improve what we show, and — where a feature offers it — to put what is near you first, such as the sellers and cars closest to you, so that you do not have to type an address. You can always search by a place you choose instead. Separately, we turn a dealership's own business address into map coordinates through a map service, so that its branches can be shown on a map. That is a published business address, not a visitor's location.

To operate the marketplace, create and show listings, connect buyers with sellers, show a visitor what is near them, provide support, prevent fraud and abuse, and comply with legal obligations. Analytics cookies, session recordings and marketing are used only with your consent. Without consent we only count page visits anonymously, as described under Cookies. We also use service data to measure how the marketplace is used, to fix and improve it, to develop new features, and to produce statistics and market insight in a form that does not identify you.

Performance of a contract (your account and use of the service); our legitimate interests (security, fraud prevention, service improvement the anonymous count of page visits, and the country-and-town location estimate that tells us where our visitors come from); compliance with legal obligations; and your consent (non-essential cookies, analytics with session recordings, and marketing). Our legitimate interests also cover reading the vehicle pages a dealership has asked us to read, so that its cars reach AutoNord without being entered twice.

Parts of the service are automated. AI writes and translates listing text, describes images, reads a typed search sentence, produces price and market estimates, and answers questions about the catalogue. Automated rules rank what you see, flag suspicious activity, and limit how often a request may be repeated. What we send an AI provider is the content the task needs — the listing text, the search sentence, the question that was asked — and not your name, email address or account identifiers. We do not take decisions about you that produce legal effects, or similarly significant effects, by automated means alone. Where an automated check has limited or suspended an account, a person looks at it again on request: write to [email protected] and you will get an answer and the reasons for it.

We use a limited number of providers who process personal data on our behalf, and each receives only what its function needs. Today these are: server hosting and file storage in Germany; email delivery; AI providers that write the assistant's replies, listing descriptions, image descriptions and translations, reached through a routing service; a map service that turns a dealership's address into map coordinates; error and performance monitoring, which runs with personal-data collection switched off and strips cookies, authentication headers and request identifiers before anything leaves our servers; and analytics with session recordings on EU servers, only with your consent. The location estimate described above is not one of them: it runs against a database on our own servers and no request leaves us. Signing in with Google is optional. If you use it, Google confirms your identity to us and learns that you signed in to AutoNord; if you would rather it did not, use an email address and password instead. A seller you contact receives your enquiry and the contact details you send with it, and handles them as a controller in its own right, under its own privacy policy. We do not sell personal data and we do not share it with advertisers for their own purposes. We do not currently send your personal data to any vehicle-history, payment, insurance or financing provider; if that changes, this list is updated before the provider is switched on. We also disclose data where the law requires it — to an authority or a court, or where it is necessary to establish, exercise or defend a legal claim — and, if AutoNord is ever sold or merged, to the acquirer as part of the business, with this policy continuing to apply until you are told otherwise.

Hosting, file storage and analytics are in the EU. Some other providers are not. The AI models that answer a request are reached through a routing service and may run outside the EU/EEA, including in the United States and in China, and email delivery and error monitoring may involve providers established outside the EU/EEA. Where personal data reaches such a provider, the transfer is made under the European Commission's standard contractual clauses, or under the EU–US Data Privacy Framework where the provider is certified under it, together with the measures described in this policy — in particular that an AI provider receives the content of a request and not your account identity. To find out which mechanism applies to a particular provider, write to [email protected] and we will tell you.

We keep personal data only as long as necessary for the purposes above or as required by law. For example, accounting records are kept for the statutory period. Account data is deleted or anonymised on account closure, subject to those retention periods. The visit statistics — the page, the estimated country and town, the browser, operating system and device type, and the site you arrived from — are deleted after 90 days, whether or not you accepted analytics cookies. Where an IP address was recorded with them, which happens only with your consent, it is erased on the same schedule.

Traffic to AutoNord is encrypted in transit. Passwords are stored only as a hash and never in a form anyone can read back. Sensitive fields are encrypted at rest and backups are encrypted. Access to production data is limited to the people whose work needs it and is logged, and accounts that publish listings, handle customer data or change billing can be required to use a second factor. No service can promise that nothing will ever go wrong. If a breach occurs that is likely to put your rights and freedoms at risk, we notify the Data Protection Ombudsman within 72 hours of becoming aware of it, and we tell you directly where the law requires it.

Under the GDPR you may access, rectify, erase, restrict and port your data, object to processing, and withdraw consent at any time. This service already supports data export and erasure. To exercise your rights, contact [email protected]. Where we rely on legitimate interests you may object, and we stop unless we have compelling grounds that override your interests; where we rely on consent, withdrawing it does not affect what we did before you withdrew it.

Strictly-necessary cookies (authentication, session security, and your recorded cookie choice) require no consent. Non-essential cookies, analytics and marketing, are set only after you accept them in the cookie banner, and you can change your choice at any time. Analytics also includes a session recording of how the site is used (clicks, scrolling and moving between pages). Text you type into forms is masked and never recorded. Page visits are also counted for visitors who decline analytics: without any cookie or device storage, using a one-day code derived on our server from your IP address and browser type. The IP address is not stored and the day's key is deleted, so the count cannot be linked back to you. That count still records what the visit was — the page, the estimated country and town, the browser, operating system and device type, and the site you arrived from — because that is what a visit statistic is made of; none of it is kept with an address or with an identifier that outlives the day. If you accept analytics cookies, we also store your IP address with your page visits, to see where our visitors come from and to investigate misuse. It is erased after 90 days.

AutoNord is for adults buying and selling vehicles. It is not directed at children, and we do not knowingly collect personal data from a child under 16. If you believe a child has given us personal data, write to [email protected] and we will delete it.

For any privacy question or to exercise your rights, contact [email protected]. You also have the right to lodge a complaint with the supervisory authority: the Office of the Data Protection Ombudsman, Finland (tietosuoja.fi).