Privacy Policy

1. General

1.1. General Information

This Privacy Policy explains how AS Hansabuss collects, uses, stores and protects personal data through the website hansabuss.fi (hereinafter referred to as the “Website”).

Personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Estonian and Finnish data protection legislation.

1.2. Data Controller

The controller responsible for processing personal data is:

AS Hansabuss
Reg. number: 10230847
Address: Paavli 6, 10412, Tallinn, Estonia
Email: info@hansabuss.fi
Website: https://hansabuss.fi

1.3. Personal Data Collected

AS Hansabuss collects personal data voluntarily provided by visitors through the Website’s contact form or by contacting the company directly.

Personal data collected through the contact form may include:

Full name
Email address
Telephone number
Message content and other information voluntarily provided in the inquiry

The Website uses the Contact Form 7 plugin to process contact form submissions.

In addition, technical and usage-related information may be collected through Google Analytics and Meta Pixel, subject to the user’s cookie consent preferences.

This information may include IP addresses, browser and device information, pages visited, website interactions, referral sources and online identifiers.

1.4. Purposes and Legal Bases of Processing

AS Hansabuss processes personal data for the following purposes:

Receiving and responding to inquiries submitted through the contact form.
Providing information about transport services and preparing requested offers.
Communicating with customers and potential customers.
Managing contractual and pre-contractual relationships.
Analysing Website traffic and improving usability through Google Analytics.
Measuring advertising performance and supporting advertising campaigns through Meta Pixel.
Maintaining Website security and technical functionality.
Complying with applicable legal obligations.

Depending on the processing activity, the legal basis may be:

Performance of a contract or pre-contractual measures: responding to transport service requests, preparing offers and providing agreed services.
Legitimate interests: managing general business correspondence and maintaining Website security, where such interests are not overridden by the rights and freedoms of the data subject.
Consent: using non-essential analytics and marketing cookies and sending consent-based marketing communications.
Legal obligations: processing required by applicable legislation.

Where processing is based on consent, users may withdraw their consent at any time without affecting the lawfulness of processing carried out before withdrawal.

1.5. Contact Form Processing

The Website uses the WordPress Contact Form 7 plugin to receive and process inquiries.

When a visitor submits the contact form, the information provided is used to respond to the inquiry, communicate with the sender and, where applicable, prepare a service offer.

Contact form submissions are generally forwarded to AS Hansabuss by email.

Contact Form 7 does not store submitted messages in the WordPress database by default. However, submitted information may be retained in email systems or stored through additional plugins or configurations.

Personal data submitted through the contact form is not used for direct marketing without an appropriate legal basis.

1.6. Sharing Personal Data

AS Hansabuss may share personal data with trusted service providers where necessary for Website operation, communication, analytics, advertising or the provision of requested services.

Depending on the services used, recipients may include:

Website hosting and technical maintenance providers.
Email hosting and communication service providers.
Google, as the provider of Google Analytics.
Meta Platforms, as the provider of Meta Pixel.
CookieYes, where personal data is processed in connection with cookie consent management.
Other authorised service providers supporting business operations.

Where service providers act as data processors, personal data is processed under appropriate contractual arrangements and in accordance with applicable data protection requirements.

Personal data may also be disclosed to competent authorities where required by law.

Further information about relevant service providers may be requested at info@hansabuss.fi.

1.7. International Data Transfers

Some service providers, including Google and Meta, may process personal data outside the European Economic Area (EEA).

Where personal data is transferred internationally, applicable GDPR transfer requirements must be met, including reliance on an applicable adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Information about relevant international data transfers and safeguards may be requested by contacting info@hansabuss.fi.

1.8. Data Retention

AS Hansabuss retains personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with applicable legal obligations.

Contact form inquiries and related correspondence are retained for the period reasonably necessary to handle the inquiry, manage any resulting customer relationship and establish, exercise or defend legal claims where applicable.

Accounting records and related documents may be retained for seven years where required by applicable accounting and tax legislation.

Analytics data is retained according to the settings configured in Google Analytics and applicable retention policies.

Cookie consent records are retained according to the configuration and applicable retention policies of the cookie consent management system.

When personal data is no longer required and no legal obligation justifies further retention, it will be deleted or anonymised.

1.9. Rights of Data Subjects

Under the GDPR, data subjects have the following rights, subject to applicable legal conditions:

The right to access their personal data.
The right to request correction of inaccurate or incomplete personal data.
The right to request deletion of personal data.
The right to request restriction of processing.
The right to object to processing based on legitimate interests or carried out for direct marketing.
The right to data portability where applicable.
The right to withdraw consent at any time where processing is based on consent.
The right to lodge a complaint with a competent data protection supervisory authority.

To exercise these rights, data subjects may contact AS Hansabuss at info@hansabuss.fi.

Requests will be handled in accordance with the GDPR, generally within one month of receipt, subject to any permitted extensions.

Data subjects may also contact the Estonian Data Protection Inspectorate at www.aki.ee, the Finnish Data Protection Ombudsman at tietosuoja.fi, or another competent supervisory authority.

1.10. Data Security

AS Hansabuss applies appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction.

Access to personal data is restricted to authorised personnel and service providers who require access for legitimate business purposes.

2. Cookie Policy

2.1. Use of Cookies

The Website uses cookies and similar technologies to support essential functionality, analyse website traffic and measure advertising performance.

Cookies are small text files stored on a user’s device when visiting a website. Similar technologies may also collect information about website interactions.

The Website uses Google Analytics for website analytics and Meta Pixel for advertising measurement and marketing purposes.

Cookie consent and preferences are managed through CookieYes.

Non-essential analytics and marketing cookies and similar tracking technologies are activated only after the user has provided the required consent.

2.2. Strictly Necessary Cookies

Strictly necessary cookies are used to enable essential Website functionality, maintain security and remember cookie consent preferences.

These cookies do not require consent where they are strictly necessary to provide a service explicitly requested by the user or otherwise qualify for an exemption under applicable law.

Disabling strictly necessary cookies may affect the proper functioning of certain Website features.

2.3. Google Analytics

The Website uses Google Analytics, a web analytics service provided by Google, to understand how visitors interact with the Website and to improve its content, functionality and performance.

Depending on the configuration, Google Analytics may process information such as:

Pages visited and time spent on the Website.
Interactions with Website content.
Browser and device information.
Approximate geographic location.
Traffic sources and referral information.
Online identifiers and technical usage information.

Google Analytics may use cookies including:

_ga: used to distinguish visitors.
_ga_*: used to maintain session and interaction information.

Google Analytics tracking that requires consent is activated only after the user has consented to analytics cookies through CookieYes.

Further information about Google’s privacy practices is available at https://policies.google.com/privacy.

2.4. Meta Pixel

The Website uses Meta Pixel, a tracking technology provided by Meta Platforms, to measure the effectiveness of advertising campaigns on Facebook and Instagram.

Meta Pixel helps AS Hansabuss understand how visitors interact with the Website after viewing or clicking advertisements.

Depending on the configuration, Meta Pixel may process information including:

Pages visited and Website interactions.
Browser and device information.
IP addresses and technical identifiers.
Referring URLs and advertising campaign information.
Events such as page views or completed contact form submissions, where configured.

Meta Pixel may use cookies including:

_fbp: used to identify browsers for advertising measurement.
_fbc: may store information associated with Facebook advertising clicks.

Meta Pixel tracking is activated only after the user has consented to marketing cookies through CookieYes.

Further information about Meta’s privacy practices is available at https://www.facebook.com/privacy/policy/.

2.5. CookieYes Consent Management

The Website uses CookieYes to manage cookie consent and preferences in accordance with applicable data protection and electronic privacy legislation.

CookieYes allows visitors to make choices about the use of non-essential cookies and similar tracking technologies.

When visiting the Website, users are presented with a cookie consent banner that allows them to:

Accept all cookies.
Reject non-essential cookies.
Customise cookie preferences by category.

CookieYes may use strictly necessary cookies to remember consent choices and support consent management.

Analytics and marketing tracking must remain disabled until the user has provided the corresponding consent.

Further information about CookieYes is available at https://www.cookieyes.com.

2.6. Types of Cookies Used

The Website uses or may use the following categories of cookies:

Strictly Necessary Cookies: required for essential Website functionality, security and storing privacy preferences.
Functional Cookies: used to remember user preferences and improve browsing convenience, where enabled.
Analytics Cookies: used by Google Analytics to understand Website usage and improve performance.
Marketing Cookies: used by Meta Pixel to measure advertising performance and support marketing activities.

Non-essential cookies are used only where the appropriate consent has been obtained.

2.7. Cookie Duration

Cookies may be session-based or persistent.

Session cookies are generally deleted when the browser session ends.

Persistent cookies remain on the user’s device until their configured expiry date or until manually deleted.

For example, depending on configuration, the Google Analytics _ga cookie typically has an expiration period of up to two years, while the Meta Pixel _fbp cookie typically has an expiration period of approximately three months.

Actual cookie names, purposes, providers and expiration periods may vary depending on Website configuration and third-party service updates.

Information about cookies detected on the Website may be provided through the CookieYes cookie declaration or cookie preference panel, where configured.

2.8. Managing and Withdrawing Cookie Consent

Users may change or withdraw their cookie consent at any time through the CookieYes cookie preference controls available on the Website.

Withdrawing consent does not affect the lawfulness of processing performed before the withdrawal.

Users may also manage, block or delete cookies through their web browser settings.

Rejecting non-essential cookies does not prevent access to the main content and essential functionality of the Website.

2.9. Third-Party Services

The Website uses third-party services, including Google Analytics and Meta Pixel, which may process personal data in accordance with their respective privacy policies and applicable legal requirements.

The processing of personal data by these providers may involve the use of cookies, online identifiers and international data transfers.

Users are encouraged to review the privacy policies of Google and Meta for additional information about their data processing practices.

2.10. Changes to the Cookie Policy

AS Hansabuss may update this Cookie Policy to reflect changes in Website technologies, cookie usage or applicable legal requirements.

The latest version will be published on the Website.

3. Changes to the Privacy Policy

AS Hansabuss may update this Privacy Policy to reflect changes in data processing activities, Website functionality or applicable legislation.

The latest version of this Privacy Policy will be made available on the Website.

4. Contact Information

For questions concerning this Privacy Policy, cookie usage, personal data processing or the exercise of data protection rights, please contact: