ENGLISH — PRIVACY POLICY
Last updated: 15 October 2026
1. General provisions
Dream Car OÜ respects the privacy of its customers and processes personal data in accordance with the European Union General Data Protection Regulation (GDPR), the Estonian Personal Data Protection Act and other applicable legislation.
This Privacy Policy explains what personal data we collect, for what purposes and on what legal grounds we process it, to whom the data may be disclosed, how long it is retained and what rights customers have in relation to their personal data.
This Privacy Policy applies to visitors, customers, registered users and persons submitting enquiries through the Dreamcar.ee online store.
2. Data controller
The controller of personal data is:
Dream Car OÜ
Registry code: 10644709
VAT number: EE100591778
Address: Reinu tee 31, 71020 Viljandi, Estonia
E-mail: e-pood@dreamcar.ee
Website: dreamcar.ee
For questions concerning the processing of personal data, please contact us at the e-mail address above.
3. Personal data we process
Depending on how the online store is used, we may process the following personal data:
Contact and customer information: name, e-mail address, telephone number, delivery and billing address, and contact details of a company representative.
Order information: products ordered, quantities, prices, order number, order date, payment method, delivery method, payment status, invoices and information relating to returns.
User account information: information provided during registration, account settings, order history and information necessary for authentication.
Customer communication: e-mails, enquiries, complaints, claims and notices of withdrawal.
Technical information: IP address, device and browser information, time of website use, cookie information and, where consent has been given, web analytics data.
We do not knowingly collect special categories of personal data unless this is necessary in a particular case and there is a lawful basis for doing so.
4. Purposes and legal grounds for processing
We process personal data for the following purposes:
| Purpose | Legal basis |
|---|---|
| Receiving and fulfilling orders | GDPR Art. 6(1)(b) – performance of a contract |
| Delivery of goods | Performance of a contract |
| Processing payments | Performance of a contract |
| Issuing and retaining invoices | GDPR Art. 6(1)(c) – legal obligation |
| Managing user accounts | Performance of a contract |
| Responding to customer enquiries | Performance of a contract, pre-contractual measures or legitimate interest |
| Handling returns and claims | Performance of a contract or legal obligation |
| Ensuring online store security | GDPR Art. 6(1)(f) – legitimate interest |
| Sending newsletters | Consent or, where permitted by law, the existing customer relationship exception |
| Use of analytics and marketing cookies | GDPR Art. 6(1)(a) – consent |
Where processing is based on legitimate interests, we take into account the rights and interests of the data subject.
5. Orders and payments
When an order is placed, we process the information provided by the customer in order to complete the purchase, confirm payment, issue an invoice and deliver the goods.
Payments are made using payment service solutions integrated with the online store, including bank links and other payment methods offered in the online store.
A payment service provider may process the information necessary to execute a payment as an independent data controller in accordance with its own privacy policy.
Dream Car OÜ processes payment information only to the extent necessary to fulfil the order, confirm payment and comply with accounting requirements.
6. Disclosure of personal data
Personal data may be disclosed to the following categories of recipients:
- Payment service providers and banks.
- Transport and courier companies.
- Web hosting and IT maintenance service providers.
- Accounting service providers.
- Web analytics service providers where such processing is permitted.
- Public authorities where disclosure is required by law.
We disclose only the information necessary for the provision of the relevant service.
Where a service provider processes personal data on behalf of Dream Car OÜ, the requirements of Article 28 of the GDPR are applied.
We do not sell our customers' personal data.
7. Retention of personal data
We retain personal data only for as long as necessary to achieve the purpose of processing or to comply with legal obligations.
Accounting documents: generally for seven years from the end of the relevant financial year.
Order information: for as long as necessary for the performance of the contract and the handling of possible claims or disputes. Data contained in accounting documents is retained for the period required by law.
User account information: for as long as the account is in use and, after closure of the account, only to the extent that there is a legal basis for further retention.
Customer enquiries and correspondence: for as long as necessary to resolve the enquiry and deal with possible legal claims.
Newsletter information: until consent is withdrawn or another applicable legal basis ceases to exist. Where necessary, we may retain minimal information to demonstrate an opt-out and prevent further marketing messages.
Technical information: for a reasonable period necessary to ensure the security and operation of the website.
Accounting documents are retained in accordance with § 12 of the Estonian Accounting Act.
8. Cookies and web analytics
Dreamcar.ee uses cookies for the operation of the online store and, with the visitor's consent, for analytics and marketing purposes.
Necessary cookies
Necessary cookies enable essential functions of the online store, including the shopping cart, user sessions, language preferences and security.
These cookies generally do not require separate consent.
Analytics cookies
The website uses Google Analytics technology to analyse website traffic and usage.
Analytics cookies and tracking technologies that require consent are used only after the visitor has given the relevant consent.
Marketing cookies
Marketing cookies may be used to measure advertising performance and display relevant offers.
Marketing cookies requiring consent are used only with the visitor's prior consent.
Changing cookie preferences
Visitors may refuse non-essential cookies.
Consent must be capable of being changed or withdrawn later as easily as it was given.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
A detailed list of cookies, their purposes, duration and third-party access must be made available to visitors.
9. Newsletters and direct marketing
If a customer subscribes to our newsletter, we use their e-mail address to send news and offers.
Subscription to the newsletter is voluntary.
Customers may unsubscribe at any time by using the unsubscribe option included in the message or by contacting e-pood@dreamcar.ee.
Where permitted by law, we may use the electronic contact details of an existing customer to market our own similar products, provided that the customer has been given an appropriate opportunity to object to such use.
Opting out of direct marketing is free of charge.
10. Transfers outside the European Economic Area
Some services used by the online store, including Google services, may involve the transfer of personal data or access to personal data from outside the European Economic Area.
In such cases, transfers must comply with Chapter V of the GDPR.
Transfers may be based on an adequacy decision of the European Commission or appropriate safeguards, including the European Commission's Standard Contractual Clauses.
Information about specific transfers and applicable safeguards can be requested at e-pood@dreamcar.ee.
11. Security of personal data
Dream Car OÜ implements appropriate technical and organisational measures to protect personal data.
These measures are intended to protect data against unauthorised access, disclosure, alteration, destruction and loss.
Access to personal data is restricted to persons who require it to perform their duties.
Security measures are reviewed and updated where necessary.
12. Rights of the data subject
Subject to the conditions set out in the GDPR, customers have the right to:
- Receive information about the processing of their personal data.
- Access their personal data.
- Request correction of inaccurate personal data.
- Request deletion of personal data.
- Request restriction of processing.
- Object to the processing of personal data.
- Receive their personal data in a structured, commonly used and machine-readable format and request its transfer where the legal requirements are met.
- Withdraw consent at any time.
- Lodge a complaint with a supervisory authority.
Where personal data is processed for direct marketing purposes, the customer has the right to object to such processing at any time.
The right to erasure is not absolute. For example, data that must be retained by law cannot be deleted at the customer's request.
13. Requests concerning personal data
To exercise their rights, customers may send a request to:
We will respond without undue delay and generally within one month of receiving the request.
In complex cases, the response period may be extended by up to two additional months under the conditions provided by law. The applicant will be informed of such an extension.
Where we have reasonable doubts concerning the identity of the person making the request, we may request additional information necessary to verify their identity.
14. Complaints
If a customer believes that their personal data has been processed unlawfully, they may contact Dream Car OÜ.
Customers also have the right to lodge a complaint with the Estonian Data Protection Inspectorate.
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Website: aki.ee
Customers also retain the right to use other legal remedies available to them.
15. Automated decision-making
Dream Car OÜ does not use solely automated decision-making in the ordinary processing of online store orders that would produce legal effects concerning a customer or similarly significantly affect them within the meaning of Article 22 of the GDPR.
16. Changes to this Privacy Policy
Dream Car OÜ may update this Privacy Policy if legislation, the operation of the online store or the services used change.
The current version will be published on Dreamcar.ee.
Where appropriate, customers will be separately informed of significant changes.