Privacy Policy

Last updated: 20 July 2026

This Privacy Policy explains how Profmotors OÜ, the operator of apshop.eu, collects, uses, stores, and shares personal data.

We process personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), the Estonian Personal Data Protection Act, and other applicable data protection laws.

1. Data controller

The controller responsible for processing your personal data is:

Questions or requests concerning your personal data may be sent to [email protected].

2. Personal data we collect

Depending on how you use the Website, we may collect the following categories of personal data:

2.1. Identification and contact data

• first and last name;
• email address;
• telephone number;
• billing and delivery address.

2.2. Order and transaction data

• products ordered;
• order number, date, value, and status;
• delivery method and tracking information;
• returns, refunds, complaints, and warranty claims;
• communications relating to an order.

2.3. Payment data

We process payment and transaction information such as the payment method, payment amount, payment status, and transaction reference.

Card payment information is processed by Stripe. Complete payment card details are not stored by Profmotors OÜ.

2.4. Business customer data

For business customers, we may also process:

• company name;
• registration number;
• VAT identification number;
• company address;
• representative’s name and contact details.

2.5. Account data

Where you create an account, we may process your account details, order history, saved addresses, and account preferences.

Passwords are stored in protected form and are not accessible to us as plain text.

2.6. Communications

When you contact us, we may process your message, contact details, attachments, and other information you choose to provide.

2.7. Technical and website usage data

When you use the Website, we may automatically receive:

• IP address;
• browser and device type;
• operating system;
• date and time of access;
• pages visited;
• referring website;
• cookie and similar technology identifiers;
• security and technical log information.

Further information is provided in our Cookie Policy.

3. Sources of personal data

We generally receive personal data:

• directly from you when you place an order, create an account, contact us, or subscribe to marketing;
• automatically from your device when you use the Website;
• from payment service providers concerning the status of a payment;
• from delivery companies concerning the delivery or return of an order;
• from public registers where necessary to verify business customer information.

4. Purposes and legal bases

We process personal data for the following purposes.

4.1. Processing and delivering orders

We use your information to:

• accept and process orders;
• receive and confirm payments;
• arrange delivery;
• send order and delivery updates;
• process returns and refunds;
• provide customer support;
• handle complaints and claims.

Legal basis: performance of a contract or taking steps at your request before entering into a contract, under Article 6(1)(b) GDPR.

4.2. Accounting, taxation, and legal compliance

We process order, payment, invoice, and business customer information to:

• issue and retain invoices;
• maintain accounting records;
• comply with tax, consumer protection, and other legal obligations;
• respond to lawful requests from public authorities.

Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR.

4.3. Website security and fraud prevention

We may process technical, payment, order, and communication data to:

• protect the Website and user accounts;
• detect and prevent fraudulent orders;
• investigate security incidents;
• prevent misuse of our services.

Legal basis: our legitimate interests in protecting our Website, customers, transactions, and business under Article 6(1)(f) GDPR.

4.4. Establishing and defending legal claims

We may retain and use relevant order, payment, delivery, return, and communication data where necessary to establish, exercise, or defend legal claims.

Legal basis: our legitimate interest in protecting and enforcing our legal rights under Article 6(1)(f) GDPR.

4.5. Marketing communications

We send promotional emails only where you have provided the required consent.

Legal basis: your consent under Article 6(1)(a) GDPR.

You may withdraw your consent at any time by using the unsubscribe link in a marketing email or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

4.6. Cookies and analytics

Cookies that are strictly necessary for the operation, security, checkout, and shopping-cart functions of the Website may be used without consent where permitted by law.

Analytics, advertising, and other non-essential cookies are used only after the required consent has been obtained.

More information about individual cookies, providers, purposes, and storage periods is available in our Cookie Policy.

5. Whether providing data is required

Information marked as required during checkout is necessary to conclude and perform the sales contract.

Without the required information, we may be unable to accept, process, deliver, or provide support for your order.

Providing data for marketing purposes is voluntary and is not required to place an order.

6. Recipients of personal data

We disclose personal data only where necessary for the purposes described in this Privacy Policy. Recipients may include:

• Stripe and other payment service providers used to process payments;
• delivery companies, including DPD, SmartPosti, Omniva, Packeta, Posti, and relevant national postal services;
• website hosting, IT maintenance, cybersecurity, and technical service providers;
• email and customer communication service providers;
• accounting and professional advisory service providers;
• manufacturers or authorised service workshops where necessary to handle a product claim;
• public authorities, courts, law-enforcement bodies, tax authorities, or regulators where disclosure is required by law;
• legal advisers, insurers, or debt-collection service providers where necessary to establish or defend legal claims.

Service providers acting on our behalf may process personal data only for the agreed purposes and subject to appropriate data protection obligations.

We do not sell your personal data. We do not disclose your data to third parties for their own independent marketing purposes. Where an email service provider is used to send marketing communications, it processes the data on our instructions.

7. International data transfers

Some service providers may process personal data outside Estonia or outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we use or require an appropriate transfer mechanism under GDPR, such as:

• a European Commission adequacy decision;
• European Commission Standard Contractual Clauses;
• the EU–US Data Privacy Framework, where applicable; or
• another legally recognised transfer safeguard.

Stripe may process data internationally and uses recognised transfer mechanisms described in its privacy and data-transfer documentation. You may contact us at [email protected] for further information about the safeguards applicable to a particular transfer.

8. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with legal obligations.

8.1. Order and accounting records

Order, invoice, payment, and accounting records are generally retained for seven years from the end of the financial year in which the relevant transaction was recorded.

8.2. Customer account data

Account data is retained while your account remains active. After an account is closed, data that is no longer required will be deleted or anonymised. Information may be retained for longer where required for accounting, legal compliance, fraud prevention, or the establishment or defence of legal claims.

8.3. Customer communications

General enquiries and customer service messages are normally retained for up to two years after the matter has been closed. Messages connected with an order, complaint, refund, legal claim, or accounting document may be retained for the period applicable to the underlying matter.

8.4. Marketing data

Marketing contact information is retained until consent is withdrawn or the marketing activity ends. We may retain a minimal record of withdrawal or objection to ensure that no further marketing communications are sent.

8.5. Technical and security data

Technical and security logs are retained only for as long as reasonably necessary to maintain security, investigate incidents, resolve technical problems, and protect legal rights. Cookie storage periods are described in the Cookie Policy and the Website’s cookie consent interface.

9. Your data protection rights

Subject to the conditions and limitations provided by GDPR, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of your data;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• receive personal data in a structured, commonly used, machine-readable format;
• request that data be transmitted to another controller where technically feasible;
• withdraw consent at any time;
• lodge a complaint with a competent data protection authority;
• seek a judicial remedy.

The right to deletion is not absolute. We may retain information where processing is required by law or necessary for legal claims.

To exercise your rights, contact us at [email protected]. We may request additional information where reasonably necessary to confirm your identity and protect your data from unauthorised disclosure.

We will respond without undue delay and normally within one month after receiving your request. Where permitted by GDPR, this period may be extended by up to two additional months due to the complexity or number of requests. We will notify you of any extension and explain the reason.

Requests are normally handled free of charge. A reasonable fee may be charged, or a request may be refused, where it is manifestly unfounded or excessive as permitted by GDPR.

10. Right to complain

You may lodge a complaint with the Estonian supervisory authority:

You may also contact a competent supervisory authority in another European Union Member State, particularly in the country of your habitual residence or place of work. We encourage you to contact us first so that we have an opportunity to resolve your concern.

11. Automated decision-making

Profmotors OÜ does not use personal data to make solely automated decisions that produce legal or similarly significant effects concerning you.

Payment service providers may use automated security and fraud-prevention systems in accordance with their own privacy policies.

12. Data security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. Access to personal data is limited to persons and service providers who require it for their duties.

13. Cookies

The Website uses cookies and similar technologies for functions such as:

• maintaining the shopping cart;
• remembering user preferences;
• securing the Website;
• processing checkout;
• measuring Website use, where consent has been provided;
• supporting advertising or marketing, where consent has been provided.

Detailed information about the cookies used on the Website is provided in our Cookie Policy. You can review or change your cookie preferences through the cookie settings available on the Website.

14. Third-party websites

The Website may contain links to websites or services operated by third parties.

We are not responsible for the privacy practices of third-party websites that we do not control. You should review the privacy policy of the relevant third party before providing personal data.

15. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our processing activities, service providers, Website functions, or applicable law. The current version will be published on the Website with an updated revision date.

Where a change materially affects how we process personal data, we will provide an additional notice where required by law.

16. Contact

For questions, requests, or complaints relating to this Privacy Policy or the processing of your personal data, contact: