Effective from 23.03.2026
The privacy policy of TKM Auto OÜ (hereinafter TKM Auto) outlines the principles by which TKM Auto processes personal data.
This privacy policy applies to all natural persons who submit inquiries containing their personal data to TKM Auto by post, email, or telephone. It also applies to the processing of personal data of representatives of legal entity clients and business partners, as well as to individuals applying for employment at TKM Auto.
Information on how other TKM Auto group companies process personal data can be found on the respective company’s website.
TKM Auto reserves the right to amend or supplement this privacy policy at any time. The current privacy policy is always available on the TKM Auto website.
1. TKM Auto AS as Data Controller
The data controller is TKM Auto AS, registration code 11282852, address Gonsiori tn 2, Tallinn 10143. For questions related to the processing of personal data, please contact us at dpo@tkmgrupp.ee.
2. Legal Bases for Data Processing
- Consent – you have given explicit consent for the processing of your data.
- Performance or conclusion of a contract – e.g. establishing a contractual relationship with a business partner, where the representative’s data is necessary for concluding the contract or for communication.
- Legitimate interest – such as protecting the rights of TKM Auto or third parties, fulfilling contracts, handling debt claims, and resolving disputes.
- Legal obligation – fulfilling obligations arising from various laws (e.g. retention of accounting records, tax obligations, responding to inquiries from public authorities).
3. Sources of Data
TKM Auto collects personal data primarily from you directly — through declarations, forms, and correspondence submitted to TKM Auto. Data may also arise when you make payments or contact TKM Auto by email, post, or telephone.
In individual cases, TKM Auto may receive your personal data from third parties, primarily from its subsidiaries KIA AS, Viking Motors AS, Rohe Auto AS, SKO Motors OÜ, Verte Auto SIA or SIA Forum Auto, UAB Motus Auto and UAB KIA Auto, as well as through inquiries from public authorities or officials.
Data about job applicants may also be collected from recruitment companies, career portals, or databases where you have posted your CV (including, but not limited to, LinkedIn, MeetFrank, CV-Online, CV Keskus), or from a friend or acquaintance who referred you, a recruitment agency/consultant, or an educational institution or organization.
4. Data Categories and Purposes
TKM Auto adheres to the principle of data minimisation — we only process the data and to the extent necessary to achieve the specific purpose. TKM Auto processes the following data of natural persons related to business activities:
- Name, contact details (email, phone), job title;
- Association with a legal entity (right of representation, role in the contract);
- Content of communications (emails, contracts, meeting minutes, etc.);
- Where required by law or contractual need, personal identification code (e.g. for notarial documentation).
Purposes of processing:
- Establishing and fulfilling contractual relationships;
- Organising cooperation and communication;
- Invoicing and accounting;
- Resolving disputes, making or defending claims.
5. Data Retention Period
TKM Auto retains personal data for as long as necessary to fulfil the relevant purpose or a legal obligation, including:
- Contractual data – up to 10 years after the end of the contract;
- Communication data – up to 3 years after the last contact;
- Data related to legal claims – until the claim has expired or a final decision in the dispute has entered into force.
After the set period, personal data is automatically deleted, destroyed, or anonymised.
6. Use of Cookies
A cookie is a small text file that a web browser automatically saves to the user’s device. Cookies are used to collect information about how a user uses the website, with the aim of providing a better user experience.
We ask for your permission to use cookies that are not strictly necessary for the basic functioning of our website or for providing the service you have requested.
7. Personal Data of Job Applicants
When applying for a position at TKM Auto, the personal data submitted by the applicant is processed in order to assess their professional suitability and fit for the applied position. Data about the applicant may also be obtained from other sources such as public registers, referees, former employers, etc. A referee or former employer will only be contacted if the applicant has given consent to do so.
Personal data and documents related to an application are accessible only to authorised persons involved in the recruitment process. The data of a successful candidate is retained in accordance with the Employment Contracts Act, while data of unsuccessful candidates is retained for up to 1 year and 4 months from the date the recruitment decision is made. With the applicant’s consent, TKM Auto may retain the applicant’s personal data for up to 3 years for the purpose of sending future job offers.
8. Data Transfers
In certain cases, TKM Auto inevitably needs to transfer your personal data to third parties, categorised as follows:
a) Independent data controllers:
- Banks and payment service providers;
- Auditors and lawyers;
- TKM Grupp AS as the parent company of the group.
b) Business partners providing services to TKM Auto, who process personal data on behalf of TKM Auto and may only use your data for the agreed service and in limited circumstances. Such partners include:
- Various subcontractors;
- Postal and courier service providers;
- Security service providers;
- ICT service providers (incl. software maintenance and support);
- Debt collection service providers;
- Accounting service providers.
c) Public authorities and supervisory bodies, to whom TKM Auto transfers your personal data only when required by law, such as the Data Protection Inspectorate or a court.
TKM Auto does not transfer your personal data outside of Estonia, the European Union, or the European Economic Area, nor to a third country or international organisation whose level of data protection has not been deemed adequate by the European Commission. If such a transfer is unavoidable, it takes place only on an appropriate legal basis and with appropriate safeguards in place. Transfers to third countries not deemed adequate are generally carried out on the basis of standard contractual clauses adopted by the European Commission.
9. Protection of Personal Data
We aim to be a trustworthy partner for our clients and business partners and do everything in our power to keep your data safe.
TKM Auto uses up-to-date, adequate technical and organisational security measures when collecting, storing, and processing your personal data, protecting it against unauthorised access, modification, disclosure, or destruction. Only authorised persons have access to modify and process personal data.
10. Your Rights Regarding the Processing of Your Personal Data
- Right of access: You have the right to know whether personal data concerning you is being processed, what the purpose of processing is, and what categories of data are involved. Also, to whom the data is disclosed (especially recipients in third countries), how long the data is retained, and what your rights are regarding correction, deletion, and restriction of processing.
- Right to rectification: You have the right to request the correction of inaccurate or incomplete personal data concerning you.
- Right to erasure: In certain cases, you have the right to request that we delete your personal data — for example, if you withdraw your previously given consent and there is no other legal basis for processing.
- Right to restriction of processing: In certain cases, you have the right to restrict the processing of your personal data for a period of time (e.g. if you have objected to the processing).
- Right to object: You have the right to object to data processing based on TKM Auto’s legitimate interest, including profiling carried out on that legal basis. Upon such an objection, TKM Auto must cease processing your data, unless TKM Auto can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
- Right to data portability: Where processing is based on a contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to request that TKM Auto transfer the data directly to another service provider, where technically feasible.
Requests related to personal data processing should be submitted electronically to dpo@tkmgrupp.ee. To ensure the security of personal data processing, your request must be digitally signed.
TKM Auto has the right to respond to your request within 30 days of receipt. TKM Auto may decline your request if your identity cannot be verified, or if your requests are manifestly unfounded or excessive, particularly due to their repetitive nature. TKM Auto may also decline a request to restrict processing or delete data if the obligation to process arises from a valid contract, law, or is necessary for establishing, exercising, or defending legal claims in connection with the protection of persons and property. If TKM Auto is unable to fulfil your request, you will be notified promptly and no later than 30 days from receipt, stating the reason for refusal.
If you believe that TKM Auto is violating your rights in processing personal data, you have the right at any time to contact the TKM Grupp AS whistleblower line (vihje@tkmgrupp.ee), the Data Protection Inspectorate (www.aki.ee), or a court (www.kohus.ee).