Privacy policy

Effective 3 October 2026

1. Data controller

The controller is Prism Hooldus OÜ, registry code 16894703, Läänemere tee 62, 13914 Tallinn, Estonia. Data enquiries: info@prism.ee, +372 354 8514. Sharing an operator with AbiKuller does not automatically combine the two services’ accounts or requests.

2. Data we process

Account data includes name, email, phone, password hash and language. Workshop data includes business details, address, contacts, description, services, photos and availability. Vehicle and request data includes registration number, make, model, user-provided specifications, problem description, photos, chosen location and time. We also process offers, bookings, reviews, support enquiries, subscription information, technical logs and a device token when push notifications are enabled. Do not upload documents or photos containing unrelated personal data that is unnecessary for the request. We obtain workshops’ public contact details (company name, registry code, email, county) from e-Business Register open data.

3. Purposes and legal bases

Creating accounts, forwarding requests, displaying offers and handling bookings requires processing for performance of a contract or steps requested before entering one: GDPR Article 6(1)(b). Invoicing and mandatory accounting rely on a legal obligation, Article 6(1)(c). Service security, investigation of abuse and legitimate claims rely on legitimate interests, Article 6(1)(f), taking users’ rights into account. Optional processing requiring consent relies on Article 6(1)(a); consent can be withdrawn. Device permissions for notifications or location can be disabled in settings. The basis for using these contacts to send a one-off business offer is legitimate interest, Article 6(1)(f); the email includes a free unsubscribe link and an opt-out may also be sent to info@remondikoda.ee, after which we will not write to that address again.

4. Who can see information

Suitable workshops see the information needed to respond to a request. Customer contact details are shared with the selected workshop after booking confirmation. Published workshop profiles, services, reviews and ratings are public. Passwords, card payment details and non-public account data are not published. Workshops are independently responsible for data received and processed to perform repairs.

5. Service providers

Subscriptions are paid through Stripe: card details go to Stripe, while the platform keeps payment identifiers and status. Google Firebase Cloud Messaging and Apple Push Notification service deliver app notifications when the relevant channel is enabled. The service uses server infrastructure, email and the operator’s accounting system. External Google font loading on web pages may transmit the IP address and request details to the provider; fonts are included locally in the mobile build. Data may be shared with an accountant, legal adviser or authorities where a legal basis exists. Transfers outside the EEA take place only under an applicable lawful mechanism, including an adequacy decision or standard contractual clauses and necessary supplementary measures. Data is not sold.

6. Retention and deletion

Account data and operational history are used while the account is active and the data is needed for the service. Account deletion removes account credentials and contact data; the other party’s minimum completed-booking history remains without the deleted user’s contact details. This does not delete records lawfully held by the workshop itself. Accounting documents are retained for seven years from the end of the relevant financial year under §12 of the Accounting Act. Records relating to a specific dispute may be retained as necessary until resolution and expiry of the applicable claim protection period. Records required by law are not used for marketing.

7. Technical storage and security

Service connections use HTTPS; passwords are stored as hashes. Staff access is limited to service duties. Session data and the chosen language are stored in the browser or app to support sign-in and the interface. The platform does not make an automated decision about repairs or workshop selection on a user’s behalf. Offer ranking is explained in the terms; the customer chooses the workshop.

8. Rights and contact

You may request access, a copy, rectification, deletion or restriction, object to processing based on legitimate interests and exercise portability where the law provides for it. Write to info@prism.ee from the account email address. We normally respond within one month; any lawful extension is explained. You may contact the Estonian Data Protection Inspectorate at aki.ee. Close your account through Profile → Account → Delete account or the account deletion page. Complete or cancel confirmed unfinished bookings first; contact the operator if this is not possible.