Privacy Policy

Last updated: October 8, 2026

This privacy policy is prepared in accordance with GDPR (General Data Protection Regulation) and Latvian Personal Data Processing Law.

1. Data Controller

The website autopase.lv is operated by BALTIC ORANGES SIA, an information platform for used car search and verification in Latvia.

• Name: BALTIC ORANGES SIA
• Registration number: 40203707813
• Legal address: Anniņmuižas bulvāris 19 - 35, Riga LV-1067, Latvia
• Contacts: info@autopase.lv
• DVI: Data State Inspectorate of Latvia — dvi.gov.lv

ℹ️ We do not sell personal data and do not perform automated decision-making that would significantly affect you (GDPR Article 22).

2. What Data We Process and Why

2.1 Analytics Data

• Data: Page views, device type, browser, country (anonymized IP), session duration
• Purpose: Website improvement, error detection, usage statistics
• Legal basis: Consent (GDPR Art. 6(1)(a))
• Service provider: PostHog (EU instance) — privacy policy
• Retention: 90 days (anonymized history up to 2 years)

PostHog linking of visits across days, feature flags and session recording start only after consent. Until you choose, on the basis of our legitimate interest we anonymously — with no cookies and no identifier stored in the browser — count pages viewed, the referring site, campaign tags and on-site actions; the Reject button stops this. After rejection, or with Global Privacy Control, only anonymous audience counting operates, without analytics cookies, visited URL history, actions or a persistent profile. The daily server-side hash is not stored in the browser. Consent can be withdrawn immediately through Cookie settings in any site footer. The Cookie Policy explains anonymous counting and duplicate prevention.

2.2 Email Addresses

• Data: Email address, selected alert filters (brand, price, etc.)
• Purpose: Price alerts
• Legal basis: Consent (GDPR Art. 6(1)(a))
• Service provider: Railway Postgres (EU/US), email sending via Vercel Functions
• Retention: Until you unsubscribe or request deletion

2.3 VIN Numbers

• Data: Entered VIN number, check timestamp
• Purpose: Vehicle history checks, CSDD data queries
• Legal basis: Contract performance / service provision (GDPR Art. 6(1)(b))
• Service provider: carVertical, carVertical (if integrated), CSDD public API
• Retention: 7 days (session data), purchased report history up to 2 years (accounting)

2.4 Telegram Bot Data

• Data: Telegram user ID, selected filters (brand, price, region)
• Purpose: Car notifications, VIN checks via bot
• Legal basis: Consent (GDPR Art. 6(1)(a))
• Service provider: Telegram Bot API (Telegram Inc.), Railway Postgres (EU)
• Retention: Until you unsubscribe from bot or delete subscription (/stop command)

2.5 Listing Data

• Data: Publicly available used car listings from ss.lv, auto.lv, etc.
• Purpose: Information aggregation, price analysis, market reports
• Legal basis: Legitimate interests (GDPR Art. 6(1)(f)) — public data collection
• Service provider: Railway Postgres (EU), Vercel (global CDN)
• Retention: Up to 6 months after listing removal from source

2.6 Cookies

Necessary storage provides consent, authentication, security, locale and infrastructure. Analytics and optional functionality (passive search history, recently viewed cars and browsing preferences) are off by default. The first notice lets you accept all, reject optional or open settings; the choice can be changed at any time in the footer. More details: Cookie Policy.

2.7 Service and car-finding requests

If you fill in a car-finding or other service request, we receive your email, your phone number (if you give it), your answers in the form and your free text. We use them to find you a car and to contact you about this request in the channel you chose (phone, WhatsApp, Telegram or email); the legal basis is Article 6(1)(b) GDPR. We send options for up to 60 days or until you say "Stop". We send offers on delivery and discounts only if you ticked the box (basis: your consent, Article 6(1)(a)), and only via WhatsApp or email if we have already talked to you in that channel; you can opt out at any time by replying "Stop" or writing to info@autopase.lv. The request is seen by the AutoPase team and forwarded to the team's work chat; the team mailbox info@autopase.lv is processed by an AI assistant (OpenAI, USA); an artificial-intelligence tool (Anthropic, USA) helps search for offers and receives only the car requirements — without your contacts and without your free text. Who receives the data and on what basis is listed in table "4.1 Third parties". We do not pass your contacts to sellers. Car-finding requests where you did not reply to our messages and did not tick offers are deleted after 90 days; the others are reviewed after 360 days and deleted if no longer needed, together with the copies in email, the work chat and the conversation with you on the team's WhatsApp/Telegram phones.

The car-finding form keeps only these keys in your browser: ap_podbor_variant (A/B draw, 90 days), ap_podbor_sent_v1 (a note that a request was sent — without email or phone, 30 days), ap_podbor_draft_v1 (a draft of the closed answers, 14 days), ap_podbor_peek_dismissed_until (invitation closed, 7 days), ap_podbor_peek_timeouts (3 days) and, until the end of the session only, ap_podbor_peek_seen, ap_podbor_peek_ended_at, ap_podbor_compact. The key ap_podbor_variant is used to compare two versions of the invitation.

2.8 Plate check and valuation (CSDD)

• Data: the Latvian registration number you enter, the time of the request, the result and a hash of the IP address (we do not store the IP address itself). For a valuation the number travels only in the body of the request and does not appear in the page address or in analytics. When you check a plate (the «Check plate» button) the number is part of the page address and of the request address; if CSDD is unavailable it may be passed to the provider RegCheck, and it is kept in the request log
• Purpose: to find the make, model, year and technical data of the car from its plate, in order to show the check result or to select listings for a valuation; protecting the service from abuse (request limits)
• Legal basis: providing the service you asked for (GDPR Art. 6(1)(b)); protecting the service from abuse is a legitimate interest (GDPR Art. 6(1)(f))
• Recipients: CSDD (Ceļu satiksmes drošības direkcija) — an independent recipient of the number and the operator of the register, responsible for its own data. When you check a plate (but not for a valuation), if CSDD is unavailable the number may be passed to the paid provider RegCheck (table «4.1 Third-Party Service Providers»)
• Retention: the log of requests to the register (plate, IP hash, time, result; the entries about the outcome of a valuation do not contain the plate) is kept for up to 12 months and then deleted. The plate may belong to someone other than you. The record of the request is kept for 12 months so that, at CSDD's request, we can explain who made the request and why, and to protect the service from abuse (legitimate interest, GDPR Art. 6(1)(f)). The registry response is not written to the AutoPase database: it stays in server memory for up to 15 minutes, only for a repeat request from the same IP address, so that it does not use up the limit

3. Partner links (insurance)

• AutoPase shows partner links for which it may receive compensation.
• The partner receives the normal browser request only after you explicitly click the link.
• The partner becomes responsible for data you enter on its site.
• AutoPase sends no vehicle or personal fields: no plate, registration certificate number, VIN, personal code, name, e-mail or phone.
• The partner’s privacy terms apply after you leave AutoPase.
• AutoPase keeps its own aggregate click analytics under this policy.

4. Who We Share Your Data With

4.1 Third-Party Service Providers

ℹ️ Where the table says so, data processing agreements are in place with the service provider; for the others the basis of the transfer is stated in the table.

4.2 Legal Requirements

We may disclose your data if required by law, court order, or other lawful requests (e.g., law enforcement inquiries).

5. Data Retention

• Analytics data: 90 days (recent events), anonymized up to 2 years
• Email price alerts: Until unsubscribe or 2 years of inactivity
• VIN checks: 7 days (session data), payment history 7 years (legal requirement)
• Telegram subscriptions: Until /stop command or 1 year of inactivity
• Listing data: Up to 6 months after removal from source
• Service requests: car-finding requests you did not reply to — 90 days; other requests — reviewed after 360 days

After the retention period ends, data is deleted or anonymized.

6. Your Rights Under GDPR

6.1 Right to Access Your Data (Article 15)

You have the right to request a copy of all your personal data we hold. We will respond within 30 days (free of charge).

6.2 Right to Rectification (Article 16)

If your email address or other data is incorrect, you can request corrections.

6.3 Right to Erasure (Article 17 — "Right to be Forgotten")

You can request deletion of your data if:

• Data is no longer necessary for the original purpose
• You withdraw your consent (price alerts, Telegram bot)
• You object to processing and there are no overriding legitimate grounds to continue

⚠️ Exception: If data is required for legal obligations (e.g., payment history for accounting).

6.4 Right to Restrict Processing (Article 18)

You can request to suspend data processing (but not delete) if you contest the accuracy or lawfulness of the data.

6.5 Right to Data Portability (Article 20)

You can request to receive your data in a structured, machine-readable format (JSON, CSV) and transfer it to another service.

6.6 Right to Object (Article 21)

You can object to data processing based on legitimate interests (e.g., analytics). We will assess whether we have compelling legitimate grounds to continue.

6.7 Right to Lodge a Complaint

If you believe we violate GDPR, you can file a complaint with the Data State Inspectorate of Latvia:

• Address: Elijas Street 17, Riga, LV-1050
• Phone: +371 67 22 31 31
• Email: info@dvi.gov.lv
• Website: www.dvi.gov.lv

7. How to Exercise Your Rights

To exercise any of the above rights, write to:

• Email: info@autopase.lv (subject: "GDPR Request")
• Specify your email address or Telegram ID (for identification)
• Describe your request (access / deletion / correction, etc.)

We will respond within 30 days. If verification is needed, we may request a copy of your photo ID (for data protection purposes).

8. Children's Privacy

Our services are not intended for persons under 16 years old. We do not knowingly collect personal data from children without parental consent. If you discover that a child has provided us with data, please contact us — we will delete it.

9. Security

We use industry-standard security measures:

• HTTPS encryption for all connections
• Database encryption at rest
• Access control (only authorized employees)
• Regular security audits and updates

⚠️ However, no internet transmission method is 100% secure. We cannot guarantee absolute security.

10. International Data Transfers

Some of our service providers (Vercel, Railway) may process data outside the European Economic Area (EEA). In such cases:

• We use only GDPR-compliant services
• Standard Contractual Clauses (SCC)
• Data Processing Agreements (DPA)

11. Telegram Bot

By using our Telegram bot (@autopase_lv_bot), you agree to:

• Storage of your Telegram user ID (required for sending messages)
• Storage of your selected filters (brand, price, region)
• Receiving notifications about new listings or VIN checks

To stop: send /stop command to the bot. Your data will be deleted within 7 days.

12. Changes to This Privacy Policy

We may periodically update this privacy policy. Changes take effect from the moment they are published on this page. Significant changes will be notified via email (if you have a price alert) or through the Telegram bot.

Latest changes: September 30, 2026 — added the description of service and car-finding requests (recipients, retention periods, keys kept in the browser).

13. Contact

For questions about privacy or data processing:

• Email: info@autopase.lv
• Subject: "GDPR Request" or "Privacy"

14. Website Chat

Messages you send through the website chat, and the replies to them, are stored for 6 months from the date of the last message in the conversation, after which they are deleted automatically. Signed-in users can see their conversations in their account; guest conversations are linked to the browser. Messages are read by our staff and, when the assistant is enabled, by an automated assistant; they are used only to answer your question.

Related documents: Terms of Service • Cookie Policy