1. Who is responsible for your data
Last updated: 25 September 2026.
The controller of personal data processed through dartzmotorz.com is DARTZ Grupa OÜ, registry code 11553015, VAT number EE101277761, Maakri 19/1, 7th floor, 10145 Tallinn, Estonia. For any privacy question or request, contact us at [email protected] or +371 26522232.
2. What data we process and why
Contact enquiries: when you submit a contact form we process your name, country, email address, phone number where supplied, message and form variant so that we can reply and handle your enquiry. The legal basis is taking steps at your request before entering into a contract and our legitimate interest in responding to enquiries (GDPR Article 6(1)(b) and (f)).
With each enquiry we also store the submission time, the page the form was sent from and its title, the sanitised referrer, browser language preferences, browser timezone, browser-reported time, viewport/device class, user-agent, delivery status and Cloudflare request reference. The page, campaign, browser and device values are advisory client metadata reported by your browser. If you accepted campaign measurement (see section 6), the enquiry also includes the landing page and external referrer of your visit, the pages viewed during the visit, UTM campaign values and advertising click identifiers.
Cloudflare provides server-side country, region, city, timezone and network provider (autonomous system) metadata for security and operational context. We do not retain raw IP addresses or exact location data. Instead, we retain a keyed cryptographic hash of the IP address for rate limiting and abuse correlation; we do not store latitude, longitude or postal code. The legal basis for this security and abuse-prevention processing is our legitimate interest in protecting the Website and our mailbox (GDPR Article 6(1)(f)).
Website delivery and security: like any website, our hosting provider processes your IP address and technical request data to deliver pages and protect the Website against attacks. This processing is based on our legitimate interest in operating a secure website.
Website analytics: Google Analytics 4 receives page views and interaction events through Cloudflare Zaraz on every visit. Events can include the page path, the type and label of a clicked link, the destination path or website, and browser or device context. We do not send contact form fields, enquiry messages or visitor contact details as analytics event parameters. Cloudflare is configured to hide the originating IP address before sending events to Google.
3. How enquiries are stored and delivered
We do not sell contact enquiries or share their contents with advertisers.
4. Service providers and international transfers
The Website, its contact form, database and notification e-mails are provided by Cloudflare, Inc. and its group companies, which act as our processor. Cloudflare may process data outside the European Economic Area, including in the United States. Such transfers are protected by the EU–U.S. Data Privacy Framework and the European Commission’s Standard Contractual Clauses included in Cloudflare’s data processing terms.
Google Analytics 4 is provided by Google and receives the website analytics events described above through Cloudflare Zaraz. Google may process analytics data outside the European Economic Area under its applicable data processing terms.
5. How long we keep data
Enquiries and their metadata are deleted after 24 months. Your privacy choice (cc_cookie) is kept for 6 months. Optional campaign attribution in session storage is deleted when you close the browser tab or withdraw consent. Google Analytics data follows the retention settings of the GA4 property and Google's applicable terms. Longer storage applies only where required by law or to establish, exercise or defend legal claims.
6. Cookies and similar technologies
The Website uses Google Analytics 4 through Cloudflare Zaraz to measure page views and site interactions on every visit, including when you choose “Necessary only”. Google Analytics may use browser storage to recognise visits. Meta Pixel and Conversions API measure advertising activity only after you accept the Advertising preference. The privacy banner controls optional advertising and campaign attribution; you can change that choice at any time via “Cookie settings” in the website footer.
Always active: the “cc_cookie” cookie stores your privacy choice for 6 months; Cloudflare Turnstile protects the contact form against automated spam when you submit an enquiry; Google Analytics 4 measures page views and site interactions. Cloudflare is configured not to pass your originating IP address to Google Analytics.
Optional advertising: after you accept Advertising, Meta receives page views, vehicle views, enquiry starts, contact actions and confirmed enquiry events through Meta Pixel and its connected Conversions API. Technical data may include browser and network information, page URLs and advertising cookie identifiers (_fbp and _fbc). We do not send enquiry text, names, email addresses or phone numbers as event parameters. You can withdraw this preference through Cookie settings.
Contact form defaults: to preselect your country and phone dialling code, the contact form asks our hosting provider Cloudflare which country your connection comes from. This country code is only used in your browser to prefill the form, is not stored, and can be changed by you.
Optional campaign attribution (only with your consent, GDPR Article 6(1)(a)): the “dartz:attribution:v1” session storage entry remembers the page you landed on, the website or campaign that referred you (including campaign parameters and advertising click identifiers) and the pages you view during your visit. It stays in your browser tab, is deleted when you close the tab or withdraw consent, and is sent to us only if you submit an enquiry, so that the enquiry can be credited to the right source. This choice is separate from the Google Analytics 4 measurement described above.
Campaign parameters in link addresses: if you arrive through a link that contains campaign parameters (such as utm_campaign or an advertising click identifier), these parameters are kept in the addresses of the links you follow on the Website and are included with an enquiry sent from such a page. This does not store anything on your device and applies regardless of your privacy choice.
7. Your rights
You have the right to request access to your personal data, its correction or deletion, restriction of processing and data portability, and to object to processing based on our legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting processing carried out before withdrawal. To request access, correction or deletion of contact-enquiry data, email [email protected].
You also have the right to lodge a complaint with a data protection supervisory authority, in particular the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the authority in your country of residence.
8. Security
The Website is served only over encrypted HTTPS connections. Access to enquiry data is limited to authorised DARTZ staff, IP addresses are stored only as keyed hashes, and enquiries are deleted automatically after the retention period.
9. Changes to this policy
We may update this policy when our services or legal requirements change. The current version is always published on this page with its date, and material changes will be highlighted on the Website.