Updated October 23, 2026

This notice explains what personal data we collect on restyling.fi, what we use it for, how long we keep it and what rights you have. It covers the website and its forms, and follows Article 13 of the EU General Data Protection Regulation (GDPR).

1. Controller

For anything concerning this notice or your own data, write to info@restyling.fi.

We have not appointed a data protection officer; the scale of our activity does not require one.

2. What we collect

2.1 Contact form

The form on the Contact us page asks for:

• namerequired
• email addressrequired
• phone number
• car brand and model
• year
• message
• a photo of the vehicle, if you attach one

2.2 PPF consultation questionnaire

The PPF consultation page has a questionnaire that helps us recommend the right protection for your car. We ask for the car’s brand, model and year, whether the car has already been delivered to you, its color, how many kilometers you drive per year, where you mostly drive, what describes the use of the car, how long you plan to keep it, your previous experience with PPF, what you expect from the protection, and any additional details. At the end we ask for your name and email address so that we can reply, and your phone number if you wish to give one.

2.3 Technical data saved with the forms

When you send a form we store, besides your answers, the time of sending, the page the form was sent from, the language of the page and the IP address the form was sent from. The IP address is used only to prevent spam and abuse.

2.4 Website statistics

We measure the use of the site with our own tool, Pulse. It uses no cookies, stores nothing in your browser and builds no device fingerprint that could identify you later. Your IP address is never stored: it is used in the server’s memory to compute a daily-changing identifier and an approximate location, and is then discarded.

The statistics contain the browser name and version, operating system, device type, screen size, page language, the page path without query parameters, where the visit came from, campaign tags (utm), country, region and city, and the names of events such as a form submission or a button click.

2.5 Server logs

The server keeps standard log entries: IP address, time, the address requested and the browser identifier. These are needed for security and for troubleshooting.

2.6 Cookies and browser storage

The site uses no cookies. The Pulse statistics tool stores nothing in your browser either (section 2.4), and there are no advertising trackers and no Google Analytics.

Your browser stores only a few notes, and each one carries out a choice you made:

• loovl-teema: when you pick the light theme at the top of the site, this note remembers your choice for your next visit. The dark theme is the default and is not stored: when you switch back to it, the note is removed.
• loovl-syksy-2026: when you close the autumn offer window on the home page or press one of its buttons, the window does not open again.
• loovl-ppfetu-2027: the same for the PPF-ETU offer window shown on the home page from November 1, 2026, to March 31, 2027.
• loovl_quiz:…: in the PPF questionnaire, your browser’s session storage (sessionStorage) marks a question you have answered so that the same step is not counted twice in the statistics. The note is removed when you close the tab.

The notes hold only a short value, 1 or vaalea. They contain no personal data, are not sent to us and are not used for tracking. That is why the site has no cookie banner.

If you start a YouTube video on the site, YouTube also stores its own entries in your browser storage. They are described in section 7.

3. Why we use the data and on what legal basis

Purpose	Legal basis
Answering inquiries and requests for quotes, planning and agreeing on the work	Steps taken at your request before entering into a contract, GDPR Article 6(1)(b)
Website statistics and improving the site	Our legitimate interest in understanding how the site is used and which pages need work, GDPR Article 6(1)(f). The statistics do not identify individual visitors
Server logs, prevention of spam and abuse	Our legitimate interest in keeping the site working and secure, GDPR Article 6(1)(f)

We do not use the data for direct marketing and we send no newsletters.

4. How long we keep the data

Data	Retention period
Form submissions in the website database	24 months from sending, after which they are deleted automatically
Photos attached to a form	24 months, deleted together with the form data
Email in the info@restyling.fi mailbox	No longer than 24 months from your last contact
Website statistics	No longer than 25 months
Server logs	No longer than 5 weeks
Theme choice loovl-teema in your browser storage	Until you switch back to the dark theme or clear your browser data
Offer window notes loovl-syksy-2026 and loovl-ppfetu-2027 in your browser storage	Until you clear your browser data. The autumn offer ends on October 31, 2026, and PPF-ETU on March 31, 2027, after which the site no longer reads the note
PPF questionnaire notes in your browser’s session storage	Until you close the tab
YouTube’s entries in your browser storage, if you start a video	Until YouTube removes them or you clear your browser data

If your inquiry leads to an order, the data related to it is kept for as long as the law requires, for example as accounting records.

5. Who receives the data

We do not sell your data and do not pass it on for marketing purposes. The following partners process data on our behalf:

Partner	Role	Location
Loovl OÜ (registry code 17497447)	Website and email maintenance, technical support	Estonia
Hetzner Online GmbH	Server hosting	The server is located in Helsinki
Pulse Analytics (Loovl OÜ)	Website statistics	On the same server in Helsinki

Data may also be disclosed to an authority where the law requires it.

6. Transfers outside the EU and the EEA

The data you give on the forms, your email messages and the website statistics are not transferred outside the EU and the EEA. The site, the email and the statistics are on the same server in Helsinki, and technical maintenance is done from Estonia.

Third-party content embedded on the site is the exception, described in the next section.

7. Embedded content and outside services

YouTube videos

Videos do not load automatically. In place of the video there is a still image and a button, and nothing about you reaches YouTube before you press it. When you press the button, the video is loaded from YouTube. YouTube then receives your IP address and information about your browser, and stores its own entries in your browser storage (for example yt-icons-last-purged and YtIdbMeta). These entries belong to YouTube, and we do not read them. You can remove them by clearing your browser data. Google’s privacy policy applies to YouTube’s processing.

Map

The map on the Contact us page is our own image on our own server, so looking at it sends nothing outside. Only when you press the Directions button do you move to Google Maps or Apple Maps, where that service’s own privacy policy applies.

Instagram

The Instagram photos on the Contact us page are stored on our own server: the site fetches them from our own Instagram account through Instagram’s official interface, so looking at them sends nothing outside and your browser does not connect to Instagram. Only when you press a photo or the Follow us on Instagram button do you move to Instagram. Meta, which runs Instagram, then receives your IP address and information about your browser, and Meta’s privacy policy applies to its processing.

Customer reviews

The customer reviews shown on the site are reviews published on Google: the reviewer’s name, date, stars and text. They are stored on our own server, so looking at them does not connect your browser to Google. Only when you press the All reviews on Google link do you move to Google.

WhatsApp and email

The WhatsApp buttons open WhatsApp with a message already written, for example with the car model and package name. Nothing is sent until you send the message yourself in WhatsApp. WhatsApp’s privacy policy then applies. The email buttons open your own email program, and the message goes to info@restyling.fi.

Fonts

The fonts used on the site are served from our own server, not from Google.

8. How the data is protected

• The connection to the site is encrypted (HTTPS).
• The data sits on a server in Helsinki, and only the site administrators can reach it.
• Photos attached to a form are stored outside the public part of the site, so they cannot be reached by guessing an address. They can only be downloaded from the site’s admin panel.
• Email traffic is encrypted and the mailboxes are password-protected.

9. Your rights

You have the right to:

• find out whether we process personal data concerning you, and to receive a copy of it;
• have corrected data that is inaccurate or incomplete;
• have erased data that is no longer needed for the purpose it was collected for;
• restrict processing, for example while the accuracy of the data is being checked;
• object to processing based on our legitimate interest, such as website statistics;
• port the data you gave us to another system in a machine-readable format.

Send your request to info@restyling.fi. We reply within one month. If the request is unusually extensive, the period may be extended by two months, and we will tell you if that happens. We may ask you to confirm your identity so that data is not given to the wrong person.

Please note that the website statistics cannot identify you and an individual visitor cannot be looked up in them, so in practice these rights cannot be applied to the statistics.

10. Right to lodge a complaint

If you believe we process your personal data unlawfully, you may lodge a complaint with the data protection authority. We hope you will contact us first so that we can put things right.

11. Is giving the data mandatory

Giving your data is not required by law or by a contract; it is entirely voluntary. Name and email address are required on the form for a simple reason: without them we cannot reply to you. You can leave the other fields empty. If you would rather not fill in a form, you can call us or send an email.

12. Automated decision-making and profiling

We make no automated decisions and do not profile visitors. The answers to the PPF questionnaire are read by a person, and the recommendation is given by a person.

13. Changes to this notice

We update this notice whenever the site or the processing changes. The version in force is always the one on this page, and the date of the update is shown at the top.