At Veho Oy Ab we are committed to complying with the EU General Data Protection Regulation and other privacy legislation, and to processing your personal data in accordance with good data protection practices. This privacy notice applies to all Veho Group companies in Finland, Sweden, Estonia, Lithuania, and Latvia that act as data controllers when processing personal data.
This privacy notice helps you understand what personal data Veho collects about you, why, and how we use your personal data. You will also find information about your rights as a data subject and how you can exercise them.
1. What personal data do we process?
We collect your personal data when you become our customer, use our services, participate in our events, test drive a car, or otherwise interact with us by submitting a contact request, subscribing to a newsletter, or registering as a service user.
We mainly obtain the personal data we process from you, as well as by collecting information about your purchases and use of Veho’s services. We may also receive personal data from external sources, such as partners or service providers. For companies, we may also process financial information, such as credit or payment capacity data.
2. Data you provide
Below is a list of personal data you provide. We process this data for the purposes defined below and only to the extent necessary for each purpose.
- Name, address, email address, and/or phone number
- Personal identity code if needed for identification
- Date of birth
- Driving license information
- Information about vehicles you own or use, including registration and chassis numbers
- Information about products and services you have purchased, offers made to you, and contracts
- Payment and billing information
- Information related to registration for our services, such as username and password
- Marketing permissions and prohibitions
- Responses to surveys and questionnaires
- Customer feedback and other contacts
- For business customers: organization, job title or position, company financial and billing information, contact person’s name, title, and contact details, as well as the company representative’s name and personal identity code
Data from other sources:
In addition to the data you provide, we may obtain information from private registry services and official registers, such as the Population Information System and Traficom. If necessary, we check your or your company’s credit information before concluding a contract.
For website visitors and users of our digital services, we collect behavioral data, such as cookie data and information from partners about marketing target groups. This data is not combined with customer data.
We also receive information from car manufacturers (e.g., Mercedes-Benz, Daimler, smart, BYD), as well as car dealers and service representatives.
3. Cookies
We collect information about the use of our websites and digital services using various cookies and similar technologies. Cookies are small files placed on the user’s device by a website, application, or advertisement. A cookie contains a browser-specific identifier that allows our website and services to recognize the browser and remember your previous visits.
With cookies and similar technologies, we collect the following information: IP address, browser used by the visitor, device operating system, screen resolution, the page from which the visitor arrived, which of our web pages the visitor has browsed, how and when.
Some cookies are essential for the website to function properly and cannot be refused. For other cookies, you can choose which ones you allow. More information about the purposes of different cookie types can be found in the Cookie Settings at the bottom of Veho’s website. You can modify your cookie choices at any time in the Cookie Settings.
Analytics and performance cookies:
Veho uses analytics cookies to measure website traffic and sources, and performance cookies via third parties to collect statistics on site usage and communication reach. This helps us continuously improve the site and communication for users’ benefit.
Veho collects personal data:
- When you provide information via forms, chat, newsletter subscriptions, or requests for quotes
- During website visits and service use (e.g., browsing, downloading brochures)
- From public sources or third parties within legal limits (e.g., trade register, analytics services)
With your consent, Veho may use information stored on your device or browser to create personalized advertising profiles, provide relevant content, and measure advertising effectiveness. Data may also be used for internal business management reports.
Veho sends marketing messages that may use technology (e.g., web beacons, cookies) to track message openings and link clicks. When you follow a link in a marketing message, a cookie records which pages you view and what content you download.
4. Why do we need your data (purpose of processing)?
Sales of products and services and customer relationship management:
We process your data to order and deliver vehicles, services, and other products, or to rent them based on the contract between you and Veho, and to manage our contractual relationship with you. For this purpose, we often need to verify your identity, date of birth, and driving rights.
We also need your data to contact you regarding your orders, reservations, purchases, or rentals, or when you contact us for more information or to make an appointment. We call this customer communication. In these situations, the processing of your personal data is based on the contract between you and Veho or Veho’s legitimate interest in managing and maintaining the customer relationship. You can unsubscribe from customer communications via the unsubscribe link at the end of the message or by contacting [email protected].
Marketing:
We process personal data for various marketing purposes, such as direct marketing (e.g., newsletters), customer satisfaction surveys, competitions, and events. Most marketing communications are based on your consent, which you can withdraw at any time. For email marketing, you can withdraw your consent via the unsubscribe link at the end of the message. In other cases, please withdraw your consent by contacting [email protected].
Personal data also allows us to personalize and target offers to website visitors that we believe may interest them. Ads may be targeted using cookies based on your use of Veho’s website, provided you have given your consent as a website visitor. We also purchase advertising space online for ads that may be shown in external ad networks and social media. Advertising is purchased using both third-party predefined target groups and Veho’s own target groups.
Service and business development:
We use your personal data, based on our legitimate interest, to develop products, services, customer service, and sales, as well as to manage processes and reporting. For example, we produce reports and analyses on how customer feedback has been addressed and how our services could better meet customer expectations and needs.
We also process personal data to handle complaints and customer feedback. Feedback from customer satisfaction and reputation surveys is also used to improve services and business. You will receive an electronic customer satisfaction survey after dealing with Veho’s car sales or service. You can opt out of receiving customer satisfaction surveys by sending a message to [email protected].
Compliance with legal obligations and preparation for legal claims:
We are subject to various legal obligations that require the collection and retention of personal data, such as obligations under traffic insurance law, statutory accounting, and tax obligations. Data may also be processed to fulfill obligations related to sanctions, anti-money laundering, or anti-terrorism legislation.
We also process personal data to prepare for legal claims, such as product and defect liability claims.
Security and misuse:
We process necessary data to ensure the security of our services and communication networks. For example, we require login to our services, use necessary technologies to detect security threats, and use data collected by these technologies to investigate possible incidents.
If necessary, we also use personal data to prevent and investigate misuse of our services. These purposes are based on our legitimate interest.
Legal Grounds for Processing Personal Data
Ground: Consent
Description: The data subject gives voluntary, informed consent.
Typical Use Cases: Newsletters, marketing, profiling
Key Requirements: Clear request, proper documentation, easy withdrawal
Ground: Contract
Description: Processing is necessary for fulfilling a contract.
Typical Use Cases: Product delivery, service usage
Key Requirements: Only data essential for fulfilling the contract
Ground: Legal Obligation
Description: Processing is necessary to comply with a legal requirement.
Typical Use Cases: Accounting, taxation, regulatory reporting
Key Requirements: Based on national or EU legislation
Ground: Legitimate Interest
Description: The controller’s or a third party’s legitimate interest.
Typical Use Cases: Customer relationship management, direct marketing
Key Requirements: Must not override the rights of the data subject
5. How long do we retain your data?
Data is retained only as long as necessary for the purposes of processing personal data. Data deletion times and deletion practices are defined, and outdated or unnecessary personal data is deleted or anonymized. The retention period may vary by data category and is primarily determined by the statutory obligations described in section 2.4.
Accounting
Customer data related to invoicing and payments is retained for 7 years in accordance with the Accounting Act. This includes, for example, invoices, payment information, and financial data related to contracts.
Contract Data
Customer data related to contracts is generally retained for 10 years from the delivery of the car or the end of the contract, in order to fulfill contractual obligations and handle possible complaints.
Marketing
Customer data collected for marketing purposes is retained for 3 months to a maximum of 2 years from the last customer contact (e.g., request for quotation, test drive), unless the customer has withdrawn their marketing consent earlier.
Other Customer Data
Other customer data is retained for a maximum of 3 years.
6. Who processes your data?
Your data is processed only by individuals who have the right to process personal data, such as those working in car sales or maintenance, and other individuals who need to process your personal data due to their work duties.
Your personal data may also be transferred, based on a contract, to outsourced service providers for processing on our behalf. Service providers process your personal data in ways we define to provide our services, and they do not have the right to use your data for their own purposes.
We use external service providers for the following purposes: research activities, digital marketing, forming marketing target groups, payment processing, invoicing and debt collection, delivering and maintaining systems, and providing various technical platforms.
7. To whom is your data disclosed?
Disclosure of personal data refers to situations where your personal data is given to another data controller for their own independent use. We comply with applicable data protection legislation and its requirements when disclosing personal data.
Through us, it is possible to submit, for example, financing and insurance applications to our partners. If you fill out such an application on our website, we will disclose the personal data you provide to the relevant banks and insurance companies to initiate financing or insurance applications on your behalf, or to fulfill our obligations related to anti-money laundering and anti-terrorism legislation. In case of payment default situations, we also disclose your personal data to the debt collection companies we use.
Additionally, we disclose personal data to car manufacturers, for example, in matters related to the car and its maintenance or complaints. If necessary, we may also disclose data to dealers and service representatives if required to handle your case.
We also disclose personal data to Veho Group companies as needed.
Furthermore, we disclose necessary personal data to authorities (e.g., Traficom, police, or tax authorities) to fulfill statutory obligations and, for example, to investigate crimes.
Vehicles and products you purchase from us may include digital additional services and maintenance systems related to car use provided by car manufacturers, such as the Mercedes-Benz app, other manufacturer apps, or service network systems. Such services are subject to the privacy notice of each car manufacturer. We recommend reviewing the applicable privacy notice for more information on how the manufacturer processes your personal data.
8. Is your data transferred outside Europe?
We mainly process data within the European Union and the European Economic Area. However, some of our service providers may occasionally transfer personal data to their subcontractors located outside Europe, such as companies providing network traffic and other infrastructure services. In such cases, data is transferred especially to the United States.
We ensure that transfers are necessary and carried out in a controlled manner and in accordance with legal requirements. We ensure contractually that each data transfer has a legally required protection mechanism and that the mechanism is supplemented with appropriate safeguards to ensure confidentiality and compliance. The primary data transfer mechanism is the adequacy decisions made by the European Commission, i.e., for the United States, the Data Privacy Framework (Article 45 of the GDPR), and secondarily, the European Commission’s standard contractual clauses (Article 47 of the GDPR). You can review the standard contractual clauses on the EU website: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914.
9. Your rights
You can check what data Veho holds about you and request correction or updating of your data. If you have an OmaVeho account, you can view and update your own data by logging into the service. You can also request to review, update, or restrict your data using the data request form or by contacting [email protected].
In certain situations, you also have the right to object to the processing of your data, for example, for marketing purposes, or to request restriction of processing.
In certain situations, you have the right to request us to delete your data. For example, if we have processed your data based on your consent and you withdraw your consent, you can request us to delete your data. Upon your request, we will delete your data unless we are required to retain it due to accounting, tax, or consumer protection legislation.
If the processing of your personal data is based on consent or contract, you have the right to request us to transfer the data you have provided to us in a commonly used and machine-readable format and the right to transfer such data to another company.
If you have other questions about the processing of your data or wish to exercise other data subject rights, please send your inquiry to [email protected].
We hope you contact us if you have questions about the processing of your personal data or wish to give us feedback about it. If you suspect that your personal data has been processed in violation of data protection legislation, you have the right to file a complaint with the Data Protection Ombudsman, Data Protection Ombudsman’s Office, P.O. Box 800, 00531 Helsinki or tietosuoja.fi.
10. Changes to the privacy notice
We update this privacy notice as needed as our operations and services develop. Changes may also be based on changes in data protection legislation or best practices. We encourage you to regularly check the latest version of the privacy notice on our website.
For privacy-related requests, you can also use the information request form.
Please note that for security reasons, we may need to verify your identity before completing your request.
This privacy notice was updated on December 9, 2025.
