Here you will find information about how Auto-Bon Baltic OÜ (registry code 11515090, address Jälgimäe tee 1, 76406 Saku Municipality, Harju County, hereinafter referred to as Auto-Bon or us) processes your personal data as the data controller when you use the Peugeot e-store at https://peugeotstore.lt.

Please note that this e-store Privacy Policy only describes how we process your personal data when you use the Peugeot e-store. We may also process your personal data in other situations, such as when you use the features offered on our website, contact us or purchase a Peugeot vehicle otherwise than through the e-store.

When you use the e-store, we process your personal data as joint controllers with our resellers (hereinafter referred to as the Sellers). This means that you can contact either us or the Seller with any questions you may have about the processing of your personal data when using the e-store. Please note that after the entry into the Order Agreement in the e-store, the Sellers will continue to process your personal data as independent controllers. You can find the contact details of other joint controllers (the resellers) here.

We process personal data only to the extent necessary for the fulfilment of our defined purposes and in doing so, we comply with all applicable laws and regulations, in particular the General Data Protection Regulation (EU) 2016/679 (hereinafter referred to as the GDPR).

If you have any questions regarding the processing of your personal data or if you wish to exercise your rights as described below please contact us by e-mail at [insert e-mail address].

Terms used in the Privacy Policy that are not defined herein should be understood as defined in the terms and conditions of the e-store (hereinafter referred to as the Terms and Conditions). The concepts related to the processing of personal data (such as independent controller, joint controller or processor, personal data, processing, etc.) should be understood as defined in the GDPR.

WHAT PERSONAL DATA WE PROCESS, WHY AND ON WHAT LEGAL BASIS?

We will only process the personal data that you have provided to us in the e-store and that is necessary for the use of the e-store – in particular, to enable you to enter into an Order Agreement and a Vehicle sales agreement with the Seller – to which you have consented or for which we have a legitimate interest.

We process your personal data for the following purposes and on the following legal bases:

Personal data processed	Purpose of processing of personal data	Legal basis for personal data processing
Personal data processed as joint controllers with the Sellers
In the case of a Buyer who is a natural person: first and last name, personal identification code, contact details (e-mail address, address), vehicle details	To enable to enter into an Order Agreement and a Vehicle sales agreement via the e-store, including the transfer of their personal data to the Sellers for the same purpose and to use the payment solution service	Processing is necessary for taking the steps necessary for the entry into and performance of the contract (Article 6(1)(b) of the GDPR)
In the case of a representative and a contact person of a Buyer who is a legal person: first and last name, business address, business e-mail address	To enable to enter into an Order Agreement and a Vehicle sales agreement via the e-store, including the transfer of their personal data to the Sellers for the same purpose and to use the payment solution service	Processing is necessary for our legitimate interests and those of the Seller in order to enter into a contract with a Buyer who is a legal person and who you represent (Article 6(1)(f) of the GDPR)
Telephone number	If the phone number is provided, to enable contacting the Buyer or its representative or contract person in relation to the conclusion of the Order Agreement	Processing is based on your consent (Article 6(1)(a) of the GDPR)
Personal data processed by Auto-Bon as an independent controller
E-mail address	Making marketing offers	Processing is based on your consent (Article 6(1)(a) of the GDPR)
All the above personal data	Defending our rights (e.g., filing a claim or defending against a claim) if necessary	Processing is necessary for the purposes of the legitimate interest to protect our rights in the event of a possible dispute (Article 6(1)(f) of the GDPR)

If we process personal data on the basis of our legitimate interest, we have first carried out a proper balancing of opposing interests to assess whether our interest in processing the personal data outweighs your interests and the rights and freedoms for which the personal data are protected. You can always object to such processing. You can read more about exercising your rights below.

If we process personal data on the basis of your consent, you always have the right to withdraw your consent (e.g., by clicking on the link at the end of the offer or by sending us an e-mail). However, please note that the withdrawal of consent does not affect the lawfulness of the processing that took place prior to the withdrawal.

WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

Sellers. As you enter into an Order Agreement and Vehicle sales agreement with the Seller, we will share any personal data you provide to us with the Seller. Please note that after the entry into the Order Agreement in the e-store, the Sellers will continue to process your personal data as independent controllers according to their privacy policy.

Processors. Some of our service providers may have access to your personal data when they provide services to us in support of our day-to-day business (e.g., IT solution providers). Such service providers process personal data as processors only at our request and on our behalf and we remain responsible for them.

Third parties. In addition to Sellers and processors, in certain cases we may also need to share your personal data with third parties who process your personal data as independent controllers. Such third parties include:

• the payment solution service provider
• our auditors, legal service providers and other consultants, if the sharing of personal data is necessary in the context of a service provided to us;
• supervisory and other authorities if we receive a request from them that requires us to share your personal data.

We may also need to provide access to your personal data if this is relevant in connection with our restructuring, merger, acquisition, sale or other transaction or in connection with the assignment of claims.

We will share your personal data with third parties only if we have a legal basis to do so.

We do not process personal data in countries outside the European Economic Area or in countries that do not have adequate level of protection for personal data as assessed by the European Commission. In the event that this should be necessary, we will ensure that appropriate safeguards are in place as required by the GDPR (e.g., Standard Contractual Clauses adopted by the European Commission).

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

If you enter into a contract with the Seller, your personal data will be retained as specified in the Seller’s or our general privacy policy. Normally, we will keep your personal data for as long as it is necessary to fulfil the purpose for which the personal data is processed. We often need to retain personal data in accordance with the time limits set out in applicable legislation. If we no longer need to store personal data, we will delete it or make it anonymous. 

WHAT ARE YOUR RIGHTS WITH REGARD TO YOUR PERSONAL DATA?

If you have any questions about the processing of your personal data or if you wish to exercise any of the rights set out below, please contact us by e-mail at .

You have various rights with respect to your personal data, but please be aware that these rights are not absolute and we may not always be obliged or able to take the action you request. You have the following rights in relation to your personal data.

• You may request us to provide you with a confirmation of the processing of your personal data and a copy of any personal data we process about you. In order to do so, please explain in your request whether you want a confirmation regarding what personal data we hold about you and/or whether you want a copy of your personal data.

• You may request that your personal data be corrected. This assumes that your personal data is incorrect or incomplete. If this is the case, we will correct and/or complete your personal data as requested by you. In order to do so, we ask you to specify in your request which personal data need to be corrected.

• You may request the deletion of your personal data. You can request this if (i) we no longer need the personal data for the purposes for which we collected it; (ii) you withdraw your consent regarding the processing of your personal data and we have no other legal basis for their continued processing; (iii) you object to the processing of your personal data and we do not have compelling legitimate grounds to continue to process your personal data or you object to the processing of your personal data for direct marketing purposes; (iv) we have processed your personal data unlawfully; (v) the personal data needs to be deleted in order to comply with a legal obligation. However, if despite the foregoing, we need to continue to process personal data in order to comply with a legal obligation or to protect our rights, we may not be able to delete the personal data. In any case, we will explain why we cannot delete personal data.

• You may request us to restrict the processing of your personal data. You can request this if (i) you have pointed out that the personal data is inaccurate and we are verifying their accuracy; (ii) the processing of personal data is unlawful but you do not want the data deleted and request the processing to be restricted instead; (iii) we no longer need the personal data for the purposes of the processing but you need them for the purposes of preparing, submitting or defending legal claims; (iv) you have objected to the processing of personal data and we are verifying whether our legitimate grounds for processing outweigh the reasons for which you want the processing to be terminated. Even if the processing of personal data is restricted, we may process such data if (i) you have given your consent; (ii) the personal data is necessary for us to prepare, submit or defend legal claims; (iii) the personal data is necessary for us to protect the rights of a natural or legal person; or (iv) the processing of the personal data is necessary for an important public interest.

• You may request that we transfer your personal data. You may request that we issue your personal data in a structured, commonly used and machine-readable format which you can transfer to another controller (or request that we transfer the data) if the processing is based on your consent or a contract between us and the personal data are processed by automated means.

• You may object to the processing of personal data. You have the right to object to the processing of your personal data if we process the data on the basis of your or a third party’s legitimate interest. If you object, we will no longer process your personal data unless we can demonstrate that there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, filing or defence of legal claims.

• You may withdraw your consent given to the processing of your personal data. If your personal data are processed based on consent, you have the right to withdraw your consent at any time. However, please note that this does not affect the lawfulness of the processing that took place before the withdrawal of the consent.

We will respond to your request within one month, unless there are circumstances that require us to take longer to respond. In any case, we will notify you of such circumstances within one month.

You also have the right to file a complaint with the Estonian Data Protection Inspectorate if you believe that the processing of your personal data has not been carried out in accordance with applicable law and that your rights have been infringed (the address of the Data Protection Inspectorate is Tatari 39, 10134 Tallinn, Estonia, phone +372 627 4135, e-mail address: ). If your habitual residence, place of work or the place of the infringement is in another member state of the European Union, you also have the right to file a complaint with the data protection supervisory authority of that country. In Lithuania, it is the State Data Protection Inspection (the address of the State Data Protection Inspection is L. Sapiegos g. 17, 10312 Vilnius, phone +370 5212 7532, e-mail address: ).

CAN WE CHANGE THE PRIVACY POLICY?

Yes, but we will let you know via e-mail and the e-store if there are any changes.

The Privacy Policy was last updated on 3 March 2023