EN

Privacy policy

Last updated 15 August 2026. This notice explains what personal data Hontar Auto Oy collects through this website, what it is used for and what rights you have. It is published in four languages; if they differ, the Finnish version prevails.

1. Data controller

Hontar Auto Oy
Business ID (Y-tunnus) 3617687-6
Saranpääntie 52, 61380 Polvenkylä, Finland
Phone and WhatsApp: +358 46 592 4173

We have not appointed a data protection officer, and one is not required at our scale (Article 37 GDPR).

2. What we collect

Two forms on this site collect personal data: the car buy-out and part-exchange form, and the contact form on the contacts page.

The buy-out and part-exchange form asks for:

  • your name and phone number (required), and your email address and preferred contact method (optional);
  • details of the car: make, model, year, mileage, fuel, gearbox, engine size, condition, inspection status and, optionally, the VIN;
  • a free-text description of up to 3,000 characters — what goes in it is your choice;
  • 1–10 photographs (required) and, if you wish, one video;
  • the price you have in mind, if you give one.

The contact form asks for your name, phone number, email address and your message. Phone and email are each optional, but at least one of them is needed or we have no way to answer. The message is up to 3 000 characters and its content is your choice.

On both forms we also automatically record your IP address and the moment you gave consent.

3. Photo and video metadata

Worth reading if you plan to send a video. Photographs are re-encoded to JPEG on upload, which strips their EXIF metadata — including GPS location — so it never reaches us.

Videos, by contrast, are stored exactly as uploaded. If your video carries location or device metadata, that metadata is kept. If you would rather not share it, remove the metadata before sending, or send photographs only.

4. Technical data

Your IP address is stored with the request and used to prevent abuse: at most five submissions per hour are accepted from one address. We also log sign-in attempts to our administration interface (IP address, the username entered, browser identifier) in order to detect break-in attempts.

5. What we do not collect

This site has no analytics, no advertising pixels, no external fonts or content delivery networks, no user accounts and no cross-site tracking. The “Analytical” option in the cookie notice currently controls nothing, because no analytics tool is installed; it exists in case one is ever added.

6. Purposes and legal bases

  • Valuing your car and contacting you: consent (Article 6(1)(a) GDPR). Once a sale is being negotiated, processing rests on steps taken prior to entering a contract (Article 6(1)(b)).
  • Answering an enquiry sent through the contact form: consent (Article 6(1)(a)).
  • Preventing abuse and intrusion: legitimate interest (Article 6(1)(f)).
  • Accounting: if a purchase actually goes ahead, the resulting records are kept for the period the Finnish Accounting Act requires — six years from the end of the financial year (Article 6(1)(c)). Those records fall outside the two-year period in section 8.

We do not carry out automated decision-making or profiling.

7. Consent and withdrawing it

The consent box on the form is never pre-ticked, and the form cannot be submitted without it. We store the moment consent was given. You may withdraw it at any time using the contacts in section 13. Withdrawal does not affect the lawfulness of processing carried out beforehand.

8. How long we keep it

A buy-out request with every photo and video attached to it, and a message sent through the contact form, are deleted automatically 24 months after submission. The deletion runs as a scheduled job every night. We will also delete them sooner if you ask.

Two exceptions worth knowing about:

  • Accounting records from a completed purchase are kept for six years (section 6).
  • Backups. The database is backed up daily and media files weekly, and those copies are kept for 30 days. Deleted data may therefore still exist in a backup for up to 30 days after deletion. Backups are used for nothing except restoring the site.

Administration sign-in logs are deleted after 90 days.

9. Who we share it with

We do not sell your data and we do not share it for marketing. The following process it on our behalf:

  • Google (Gmail). A new request triggers an email notification to us containing your name, your phone number and links to the photographs you sent. That notification is relayed through Gmail, so Google acts as a processor.
  • Our hosting provider, Hetzner Online GmbH (Germany), whose Helsinki data centre holds the site and its data.

Transfers outside the EU: Google is a US company, and the transfer relies on the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework. The server itself is located in Finland.

10. How your uploaded files are stored

Photos and videos are stored at a random, unguessable web address. The address is never published and search engines are blocked from it, but the files are reachable without a password: anyone holding the exact address can open the file. This is why the notification described above contains links rather than attachments.

11. Third-party content — loaded only after you click

Car pages may embed a video (YouTube, via youtube-nocookie.com) and the contacts page a map (OpenStreetMap). Neither loads when the page opens. You see a placeholder and a button first; only when you press it is a connection made to the provider, at which point it sees your IP address and may set its own cookies under its own privacy policy. Your choice is remembered in your browser for 12 months.

12. Cookies and browser storage

We use only cookies that are strictly necessary for the site to work. None of them is used for tracking.

  • sessionid — session identifier.
  • csrftoken — protects forms against forged requests.
  • django_language — the language you chose; it expires when you close the browser.

In addition, the following is kept in your browser's own storage (localStorage) and is never sent to us:

  • hontar-consent — your cookie choice, 12 months.
  • hontar-embed-consent — your permission to load the map or a video, 12 months.
  • hontar.trade-in.draft — the draft you typed into the form: name, phone, email, VIN and description, so they are not lost if the page closes by accident. The draft stays on your own device only and is not sent to us until you submit the form. It is cleared automatically after a successful submission; otherwise it has no expiry, and you can remove it with your browser's “clear site data” function.

13. Your rights

You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, to object to processing, and to withdraw your consent.

Requests can be made by phone or WhatsApp on +358 46 592 4173, or by post to Hontar Auto Oy, Saranpääntie 52, 61380 Polvenkylä, Finland. We do not currently have a separate email address for data protection requests. We reply within one month. We may ask you to confirm your identity — for example with details from the original request — so that data is not disclosed to the wrong person.

14. Security

The site runs entirely over an encrypted HTTPS connection. The administration interface locks for an hour after five failed sign-in attempts. Uploaded files sit behind unguessable addresses and are blocked from search engines. Backups are held on the same server with access restricted to the administrator. Old requests are deleted automatically as described in section 8.

15. Right to lodge a complaint

If you believe your personal data is not being processed lawfully, you may lodge a complaint with the supervisory authority: Office of the Data Protection Ombudsman, P.O. Box 800, 00531 Helsinki, Finland, tietosuoja.fi. You may do so without contacting us first.

16. Children

This site is not directed at minors. Sending a buy-out request presumes that you own the vehicle or are authorised by its owner.

17. Changes to this notice

The date at the top shows when this notice was last changed. Material changes are published on this page.