Privacy Policy

1. Who is responsible for your data

The controller of your personal data under the General Data Protection Regulation (EU) 2016/679 ("GDPR") is BipFix ("we", "us").

BipFix is currently being registered as a private limited company (osaühing) in Estonia. Until the registration is completed, BipFix is operated by its founder as a natural person, who is the controller. Once the company is registered, this section will state its legal name, registry code and registered address.

For any question or request about your personal data, write to privacy@bipfix.com. We have not appointed a Data Protection Officer because we are not required to; requests sent to this address are handled directly by the people responsible for data protection at BipFix.

2. Who this policy applies to

This policy applies to the English, Estonian, Italian, European Portuguese and Russian versions of bipfix.com, to the BipFix mobile app and to everyone who uses them from the European Economic Area: drivers ("Customers"), repair shops and parts stores ("Partners") and their staff, and visitors of the website. It also applies to repair shops and parts stores that we contact about a partnership (section 3.8).

The Portuguese version of the website is intended for users in Brazil and is governed by a separate policy based on Brazilian law (LGPD).

3. What data we process, why, and on what legal basis

For each purpose we indicate the legal basis under Article 6(1) GDPR.

3.1 Your account

• Data: name, email address, phone number, password (stored only in encrypted/hashed form), preferred language and account type. For Partners also: business name, registry or VAT code, address, services offered, opening hours, logo and photos, and the name, email and role of staff members they add.
• Purpose: creating and managing your account and letting you use the platform.
• Legal basis: performance of a contract with you (Art. 6(1)(b)).

3.2 Repair requests, quotes, messages and reviews

• Data: vehicle details (make, model, year and, if you provide it, the licence plate), description of the problem, photos, voice messages, urgency, the address where the service is needed, quotes, chat messages, orders, service history and reviews.
• Purpose: sending your request to suitable Partners near you, letting Partners send quotes, enabling communication between you and the Partner, tracking the repair, and showing reviews on Partner profiles.
• Legal basis: performance of a contract (Art. 6(1)(b)). Publishing reviews together with the name shown in your account is based on our legitimate interest, and that of other drivers, in transparent information about repair shops (Art. 6(1)(f)).

3.3 Location

• Data: the address you enter and its geographic coordinates or, only if you allow it on your device, your current location.
• Purpose: matching you with Partners close to you and showing Partners on a map.
• Legal basis: performance of a contract (Art. 6(1)(b)). You can always type an address instead of sharing your device location.

3.4 Damage analysis and voice transcription with artificial intelligence

• Data: the photos of the damage and the voice messages you choose to send through these features.
• Purpose: producing an indicative description of the damage and a text transcription of voice messages, to help Partners prepare a quote. The result is only an aid: the price and the diagnosis are always decided by the Partner, and no decision with legal or similarly significant effects is made about you automatically (Art. 22).
• Legal basis: performance of a contract (Art. 6(1)(b)). The processing is carried out by Google (Gemini) on our behalf (see section 4).

3.5 Accident reports involving another vehicle

• If a user reports an accident on BipFix and provides details of the other vehicle involved (such as its licence plate and the other driver's name, email or phone number), we use those details to inform the other driver about the report and about how to follow up on the repair.
• Legal basis: the legitimate interest of both drivers in dealing with the consequences of the accident (Art. 6(1)(f)). If you received such a message and do not want to use BipFix, you can ask us to delete your details.

3.6 Service communications

• We send emails about your account and your requests, for example new quotes, accepted quotes, completed services and password recovery links.
• Legal basis: performance of a contract (Art. 6(1)(b)). We only send marketing messages to Customers who have given their consent (Art. 6(1)(a)), and you can unsubscribe at any time.

3.7 Security, website operation and visit summaries

• Technical data: IP address, browser and device type, pages requested and error reports, recorded in server logs to keep the platform secure, prevent fraud and abuse, and fix errors.
• Visit summaries (only if you accept cookies): if you click "Accept" in the cookie banner, the pages you visit and the time spent on each are kept temporarily in your browser tab (session storage, deleted when you close the tab) and sent to our server. The server combines them with the referring site (for example Google or Instagram), device and browser type, language and approximate city and country estimated from your IP address into a summary of the visit, which is emailed only to the BipFix team. We use it to understand how the website is used during our launch and to improve it. The summary shows the IP address only partially and it is not stored in our database. Visits by people logged in as BipFix administrators are excluded.
• Legal basis: for technical data, our legitimate interest in operating a secure website (Art. 6(1)(f)); for visit summaries, your consent (Art. 6(1)(a)), which you can withdraw at any time (see section 9) without affecting the lawfulness of processing before withdrawal.

3.8 Contacting repair shops and parts stores about a partnership

• Data: business name, business email, phone, website and registered address of repair shops and parts stores, taken from public sources such as the Estonian Business Register (äriregister) and the business's own website.
• Purpose: contacting the business once or a few times to present the BipFix partnership.
• Legal basis: our legitimate interest in offering our service to businesses (Art. 6(1)(f)). Every message explains how to stop receiving them; if you ask us to stop, we will not contact you again and will keep only what is needed to respect that request.

3.9 Analytics and session recording (only with your consent)

• If you accept analytics cookies in the cookie banner, we use Google Analytics to produce aggregated statistics and Microsoft Clarity to understand how pages are used (for example clicks, scrolling and anonymised session recordings).
• Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time without affecting the lawfulness of processing before withdrawal. Before you give consent, these tools run in a restricted mode without analytics cookies.

3.10 Legal obligations

• We keep accounting records and respond to lawful requests from public authorities where the law requires it (Art. 6(1)(c)).

4. Who receives your data

We share personal data only as far as necessary:

• Other users: the Customer and the Partner involved in the same request or order see each other's details needed to carry out the service (name, contact details, vehicle details and photos, address where relevant). Partner profiles and reviews are public.
• Hosting: our servers and database are located in the Netherlands (European Union).
• Resend (United States): sending of emails.
• Google (United States): Gemini artificial intelligence for damage analysis and voice transcription; Google Analytics (only with consent); Google Maps, shown on Partner profile pages.
• Microsoft (United States): Microsoft Clarity (only with consent).
• OpenStreetMap Foundation (United Kingdom): converting addresses into map coordinates (Nominatim service).
• Public authorities, when we are legally required to disclose data.

These service providers process data on our instructions under data processing terms that meet the requirements of Article 28 GDPR. We do not sell personal data.

5. Transfers outside the European Economic Area

Some of the providers above are located in the United States or the United Kingdom. Transfers to the United Kingdom rely on the European Commission's adequacy decision. Transfers to the United States rely on the EU-U.S. Data Privacy Framework adequacy decision where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for more information about these safeguards at privacy@bipfix.com.

6. How long we keep your data

• Account data: as long as your account is active. After you ask us to delete your account, we delete or anonymise your data within 30 days, except for the data listed below that we must or may keep for longer.
• Requests, quotes, orders and messages: as long as your account is active and up to 3 years after the last transaction, to deal with possible disputes and warranty claims.
• Accounting records: 7 years, as required by the Estonian Accounting Act.
• Server logs: up to 14 days.
• Visit summaries: deleted from the team mailbox after 12 months at the latest.
• Analytics (only with consent): according to the retention settings of Google Analytics and Microsoft Clarity, at most 14 months.
• Partnership contacts (section 3.8): until you ask us to stop contacting you, and at most 24 months after our last contact.

7. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy of it (Art. 15);
• have inaccurate or incomplete data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict the processing of your data (Art. 18);
• receive the data you provided to us in a structured, machine-readable format and have it transmitted to another controller (Art. 20);
• object at any time to processing based on our legitimate interest, and to direct marketing without having to give a reason (Art. 21);
• withdraw your consent at any time, where processing is based on consent (Art. 7(3)).

To exercise any of these rights, write to privacy@bipfix.com. We will reply without undue delay and at the latest within one month; this period may be extended by two further months for complex requests, in which case we will tell you why. Exercising your rights is free of charge. We may ask you to confirm your identity before acting on a request.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. In Estonia this is the Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee. We would appreciate the chance to address your concern first.

8. Is providing your data required?

The data marked as required when you register or send a request is needed to provide the service; without it we cannot create your account or process your request. Other data, such as your device location, analytics cookies or voice messages, is optional.

9. Cookies and similar technologies

We use technologies that store information in your browser that are strictly necessary for the website to work: keeping you logged in, remembering your language and remembering your cookie choice. These do not require consent. Analytics cookies (Google Analytics and Microsoft Clarity) and the visit summaries described in section 3.7 are only used if you click "Accept" in the cookie banner; if you reject or ignore the banner, they are not used.

To change your cookie choice, delete the data stored by bipfix.com in your browser settings; the cookie banner will appear again on your next visit.

10. Security

We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), hashed passwords, authentication-based access control, database-level isolation between accounts (row-level security), limited administrative access and hosting within the European Union.

11. Children

BipFix is not intended for people under 18 years of age, and we do not knowingly collect their personal data.

12. Changes to this policy

We may update this policy, for example when the company registration is completed or when we start using a new service provider. We will inform registered users of significant changes by email or with a notice on the platform before they take effect.

13. Contact

Questions and requests about your personal data: privacy@bipfix.com.