Last updated: 2 November 2026
This policy explains how personal data is processed when using CarWash by MrCAP Poordi services, carwash.mrcap.ee and its booking system.
1. Controller and contact details
The controller is Portimo OÜ. Service location: Poordi 3, 10156 Tallinn, Estonia. For privacy questions and requests: poordi@mrcap.ee, +372 5335 9694.
2. Data we process
Booking and service data may include your name, phone number, email, preferred language, vehicle registration, make and model, selected services, visit time, booking status and notes you provide. Billing data may include the recipient’s name, company registration and VAT numbers, address, invoice email, transaction and payment details. Please do not enter health information or other sensitive data that is unnecessary for the service.
Technical data needed for security and account operation may include IP address, browser details, session and authentication identifiers and security logs.
3. Purposes and legal bases
- Making, changing and cancelling bookings, providing services and sending visit-related notifications: performance of a contract or steps taken at your request before entering into a contract.
- Invoicing and retaining accounting records: compliance with legal obligations.
- Security, preventing misuse and handling claims: our legitimate interests in protecting customers and our business, balanced against your rights.
- Optional marketing and cookies requiring consent: your consent. Booking confirmations and service messages do not require marketing consent.
4. Signing in with Google or Facebook
Where available on the booking page, you may sign in with Google or Facebook. This is optional; you may also book without social sign-in.
With your permission, we receive an account identifier, your name and email address where provided by the service. We use these to identify you, prefill contact details and link your account to verified customer records. Our application does not store your profile picture. We do not request your password or access to your mailbox, friends list or social media posts.
Showing previous visits and vehicles requires a verified connection to the relevant customer records. Additional email verification may be required. Entering a name or phone number alone does not provide access to another customer’s data. Google and Meta also process data under their own policies: Google Privacy Policy and Meta Privacy Policy.
5. Booking and invoice communications
We use your contact details for booking confirmations, changes and visit-related communication. SMS notifications will be sent when the relevant feature and sending service are introduced. A booking management link is intended for its recipient only; do not share it publicly.
Company invoices may be sent to an accounting email according to your or the company’s instructions. Visit notifications go to the booking contact. Billing and visit contacts may therefore differ.
6. Service providers and disclosures
Authorised staff and providers access data only as needed for their tasks. Zone Media OÜ provides hosting and email. We use SmartAccounts for invoicing and transmit the data needed to handle invoices and payments. If you separately use the MrCAP mobile app or loyalty programme, the necessary data is processed through ClientCard. Social sign-in does not automatically enrol you in the loyalty programme.
Providers receive only data necessary for their tasks. Using Google or Meta may involve processing outside the European Economic Area under their applicable data protection terms and transfer mechanisms. See their policies for details. We do not sell personal data. Data is disclosed to public authorities only where there is an applicable legal basis and to the required extent.
7. Retention and security
Booking, customer and communication data is kept as long as needed to provide services, manage the customer relationship or handle claims. Retention needs are assessed against these purposes and applicable time limits; unnecessary data is deleted or anonymised. Accounting source documents are retained for seven years from the end of the financial year in which the transaction was recorded. Relevant data may be retained longer for legal claims or other legal obligations.
We use access restrictions and secure connections. Not every employee receives all administrative rights. Deleting an account does not delete invoices and transaction records that we must retain by law.
8. Cookies and external services
The website and booking system use necessary cookies or similar storage for functions such as language preferences, security and sign-in sessions. Depending on your choices, analytics, advertising and embedded YouTube, Instagram or other services may involve their cookies and data transfers.
You can manage cookies requiring consent using the website’s cookie settings where displayed and your browser settings. Blocking necessary cookies may prevent sign-in or booking. Simply using the website does not constitute consent to marketing.
9. Your rights and deleting your account
Subject to the applicable conditions, you may access your data, request correction, deletion or restriction, object to processing based on legitimate interests and obtain portable copies of data processed automatically on the basis of consent or a contract. You may withdraw consent at any time without affecting the lawfulness of earlier processing.
To request deletion of your account, social-account link or personal data, email poordi@mrcap.ee, preferably from the email used for your account. Identify the account or data concerned. We may verify your identity before disclosing or deleting data; we will not ask for your password. You may also revoke the connection in your Google or Facebook account settings, but this does not replace a deletion request to us.
We normally respond within one month. For complex requests, a legally permitted extension may be needed; we will explain the extension and its reasons. You may lodge a complaint with the Estonian Data Protection Inspectorate.
10. Updates
We update this policy when services or processing change. The current version and update date are published here. Where necessary, significant changes will also be communicated separately.
