Privacy Policy (GDPR)

Controller: Thunderline OÜ trading as Thunderline
Website: thunderline.eu
Last updated: 21 October 2026

This policy explains how Thunderline OÜ ("we", "us") processes personal data when you use thunderline.eu, contact us (via our website, chatbot, phone, e-mail, machinery marketplaces or social media), or purchase excavator attachments and related services. We sell to businesses only (B2B).

1. Data controller

Legal name	Thunderline OÜ
Trading brand	Thunderline
Registry code	17399986
VAT	EE102950139
Address	Sepapaja tn 6, Lasnamäe, Tallinn 15551, Harju County, Estonia
Email	hello@thunderline.eu
Phone	+372 58326609

2. Personal data we process

Depending on how you interact with us, we may process:

• Business contact data (B2B): we sell exclusively to businesses. We therefore process the business contact details of company representatives (name, company, role/title, business e-mail, business phone, billing and delivery addresses) of customers, enquirers and suppliers.
• Business details: VAT number, order and quote history.
• Transaction data: products ordered, amounts in EUR, payment status (payment card details are handled by payment providers – we do not store full card numbers).
• Quote and contact form: name, company, VAT number, country, e-mail address and/or phone number, the machine/product you ask about, your message, and the page URL/product SKU the form was sent from. Advertising click identifiers and campaign parameters (gclid, UTM) are attached only if you have given marketing consent (see Section 7a). The form is delivered as an e-mail to hello@thunderline.eu (Google Workspace/Gmail).
• Enquiries via marketplaces and social media: if you contact us through a machinery marketplace (Mascus, Machineryline, Kleinanzeigen and similar machinery marketplaces) or send us a message on Facebook/Instagram (Meta Platforms Ireland Ltd.), we receive the contact details and the message you send through the platform. These are forwarded to hello@thunderline.eu.
• Website chatbot: the text of your conversation with the chatbot, the page URL you chat from, and any details you give (e.g. name, company, VAT number, machine, contact details). If you ask for a quote or a callback, the conversation is e-mailed to hello@thunderline.eu.
• AI phone assistant: when you call us, your phone number, your voice (call recording), a transcript of the call and an AI-generated summary (name, company, VAT number, country, machine and needs). See Section 3a.
• Business contact details from public sources: We may also process business contact details (name, role, company email and phone) of representatives of companies that we obtain from publicly available sources such as company websites, business registers and machinery marketplaces, based on our legitimate interest in B2B sales (Art. 6(1)(f) GDPR). We never use these data for advertising audiences. You can object at any time at hello@thunderline.eu.
• Customer register (CRM): enquiries and customers are logged in our customer register (Google Sheets) with the details above, quote/order status and follow-up notes.
• VAT number check: the result of the check of your VAT number in the EU VIES system (valid/invalid, registered name/address, date and consultation number).
• Communications: e-mails, call notes and support messages you send us.
• Technical data: IP address, browser type, device/approximate location, pages visited, cookies or similar technologies (see Section 7).
• Advertising and measurement data: advertising click identifiers (Google "gclid", "gbraid", "wbraid") and campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) from the link you used to reach our site, the landing page, your cookie-consent choices, and events such as page views, product views, add-to-cart, checkout started, purchase, quote/contact form submitted and click on our phone number.

We do not intentionally collect special-category (sensitive) personal data. Please don't enter such data in forms, the chat or calls.

3. Purposes and legal bases (GDPR Art. 6)

We sell to businesses only. Business contact details of company representatives are processed to take steps before entering into, and to perform, a contract with the company (Art. 6(1)(b)) and on the basis of our legitimate interest in communicating with our business customers, enquirers and suppliers (Art. 6(1)(f)).

Purpose	Legal basis
Process and deliver orders, invoices, shipping	Contract performance (Art. 6(1)(b))
Customer support and fitment enquiries	Contract / legitimate interests (Art. 6(1)(b)/(f))
Handling quote/contact form enquiries, preparing quotes	Pre-contractual steps at your request (Art. 6(1)(b)); for contact persons of a business: legitimate interests (Art. 6(1)(f))
Handling enquiries received via machinery marketplaces (Mascus, Machineryline, Kleinanzeigen) and messages via Facebook/Instagram	Pre-contractual steps (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) for B2B contact persons
Answering questions via the website chatbot; forwarding quote/callback requests from the chat to hello@thunderline.eu	Pre-contractual steps (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) for B2B contact persons
Handling phone enquiries via the AI phone assistant (recording, transcript, summary, callback by a person on request)	Pre-contractual steps (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) for B2B contact persons
Business contact details of company representatives from publicly available sources (company websites, business registers, machinery marketplaces) for B2B sales; never used for advertising audiences	Legitimate interests (Art. 6(1)(f)); you can object at any time at hello@thunderline.eu
Customer register (CRM): follow-up of enquiries, quotes and orders	Contract/pre-contractual steps (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f))
VIES check of the VAT number and keeping the result as documentation for reverse-charge invoicing of intra-EU supplies	Legal obligation (Art. 6(1)(c))
Accounting, tax and legal compliance	Legal obligation (Art. 6(1)(c))
Fraud prevention, IT security, dispute handling	Legitimate interests (Art. 6(1)(f))
Marketing e-mails (if any)	Consent (Art. 6(1)(a)) or soft opt-in where allowed; you may withdraw at any time
Website analytics (Shopify analytics)	Consent (Art. 6(1)(a)), given via our cookie banner
Advertising conversion measurement and optimisation (Google Ads), including storing click identifiers and remarketing audiences	Consent (Art. 6(1)(a)), given via our cookie banner (marketing)
Offline conversion import: telling Google Ads that an order which started from an ad click was paid (or later cancelled/refunded), using the click identifier, order reference, payment time and order value excl. VAT and freight	Consent (Art. 6(1)(a)) – only for orders where marketing consent was given and the click identifier was stored
Recording your cookie choices	Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f))
Strictly necessary cookies (cart, checkout, security, consent storage)	Contract (Art. 6(1)(b)) / legitimate interests (Art. 6(1)(f)); no consent needed

Legitimate interests are balanced against your rights; you may object where applicable (see Section 8).

3a. Website chatbot

Website chatbot. Our website has a chatbot that answers questions about our products and can pass on quote or callback requests. The chat window tells you that you are talking to an AI, not a person. We process the conversation text, the page URL and any details you give. The chatbot runs on Cloudflare Workers (Cloudflare, Inc.), and answers are generated by a language model from xAI (Grok API, SpaceXAI LLC, USA). With zero data retention enabled, the AI provider does not store chat content after generating the answer and does not use it for training. If you ask for a quote or a callback, the conversation is e-mailed to hello@thunderline.eu. Chat logs are kept for at most 90 days (see Section 6).

We use processors for hosting, AI chat and AI phone; where data is transferred outside the EEA, this is done on the basis of the EU Standard Contractual Clauses or an adequacy decision.

3b. AI phone assistant (Famulor)

Provider. Calls to our phone line may be answered by an AI phone assistant. It is operated by Famulor (BEK Service GmbH, Kempten, Germany) as our processor under a data processing agreement (Art. 28 GDPR).

Notice at the start of the call. At the start of each call you are told that the call is answered by an AI and that it is transcribed.

Purpose and data. We use the assistant to handle your enquiry: the call is recorded, transcribed and summarised (e.g. name, company, VAT number, country, machine, needs), and the summary is e-mailed to our team. If you ask, a person from our team calls you back.

Where the data is processed. Core data is stored in the EEA (Frankfurt, Germany). Telephony is provided by Twilio Ireland Limited. The conversation is processed by AI language model providers with EU processing. Speech-to-text (transcription) takes place in the EU only. Text-to-speech (the assistant's voice) may currently be processed in the USA (Soniox); this transfer is based on the EU Commission's Standard Contractual Clauses (Decision (EU) 2021/914).

Retention. Recordings, transcripts and call leads are deleted automatically after 1 month. A summary e-mailed to us becomes part of your enquiry and follows its retention period (see Section 6).

4. Who we share data with

We share personal data only where needed for the purposes above, with these categories of recipients:

• Hosting and security: Shopify (online shop, checkout, order data) and Cloudflare, Inc. (hosting of the website chatbot and of our internal customer-register tool at crm.thunderline.eu, security/network services). Shopify's services include spam protection of forms (hCaptcha, Intuition Machines, Inc., EU-U.S. Data Privacy Framework).
• AI services: SpaceXAI LLC (xAI, Grok API – language model for the website chatbot).
• E-mail delivery: Resend (Plus Five Five, Inc., USA): delivery of chat/contact enquiries to our inbox and of automatic confirmation e-mails (once live); DPF + SCCs.
• Phone / AI phone service: Famulor (BEK Service GmbH, Kempten, Germany): AI phone assistant (recording, transcription and summary of calls). Speech recognition and AI processing take place in the EU; voice synthesis (text-to-speech) by Soniox may currently be processed in the USA under EU Standard Contractual Clauses (see Section 3b).
• Google: Google Ireland Limited / Google LLC – Google Workspace/Gmail (e-mail, incl. form, chat and call summaries), Google Sheets (customer register), and, according to your cookie choices, Google Ads and Google Data Manager (the offline conversion import only covers orders with marketing consent, see Section 7a).
• Carrier (independent controller): Kühne+Nagel – for the CMR consignment note and DAP delivery of your order: the consignee's company name, delivery address, contact person, phone, delivery hours/unloading information, and goods data (model, weight, dimensions, value for cargo insurance). No VAT number or payment data.
• Suppliers/manufacturers (Promove, independent controller): as a rule no customer data. Per order only the model, quantity and destination country (end-use declaration). Where needed for collection/labelling: the customer's company name and delivery address. Never the VAT number, e-mail or payment data.
• Accounting and bank: our accounting system (Merit Aktiva) receives the company name, address, VAT number, VIES consultation number and order lines; our payment/bank provider (Wise, independent controller) and other payment service providers process payments for orders and invoices in EUR.
• VAT number verification: the European Commission (VIES system) receives the VAT number for verification.
• Platforms you contact us through (sources, independent controllers): machinery marketplaces (Mascus, Machineryline, Kleinanzeigen) and Facebook/Instagram (Meta Platforms Ireland Ltd.). When you send us an enquiry or message via these platforms, the platform processes your data as an independent controller under its own terms and privacy policy. For our Facebook/Instagram pages we are joint controller with Meta Platforms Ireland Ltd. for Page Insights statistics (Art. 26 GDPR, Page Insights Controller Addendum: https://www.facebook.com/legal/terms/page_controller_addendum). Meta is responsible for handling your rights in respect of these statistics.
• Professional advisers (accountants, lawyers) – where required.
• Authorities – e.g. tax authorities, when required by Estonian or EU law.

We do not sell personal data. We conclude data processing agreements with our processors.

5. International transfers

We aim to keep personal data in the EEA. Some providers (e.g. Shopify, Google, Cloudflare, xAI and Resend) may process data in the United States or other third countries. Where data is transferred outside the EEA, this is done on the basis of an EU Commission adequacy decision (for the United States: the EU-U.S. Data Privacy Framework for certified recipients) and/or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), plus supplementary measures where needed. Shopify transfers data within its group on the basis of Binding Corporate Rules. You can ask us for a copy of the relevant safeguards at hello@thunderline.eu.

6. Retention

• Enquiries without an order (form, chat, phone, marketplace/social media messages, CRM entries, e-mails): deleted 24 months after the last contact.
• Business contact details from public sources: deleted 24 months after collection or last contact if no order follows.
• Orders, invoices and related accounting records are kept for 7 years under the Estonian Accounting Act (Raamatupidamise seadus § 12). This includes the VIES check result kept as documentation for reverse-charge invoicing.
• Call recordings, transcripts and call logs (AI phone assistant): 1 month (automatic deletion) (see Section 3b).
• Chatbot logs: at most 90 days. Call summaries and chat conversations forwarded by e-mail are part of the enquiry and follow its retention period.
• AI provider of the chatbot (xAI): keeps no chat content with zero data retention enabled (30 days if zero data retention is not enabled).
• Advertising click identifiers and campaign parameters stored in your browser: 90 days from your last ad click, or until you withdraw consent (they are deleted from your browser as soon as consent is withdrawn).
• Click identifiers attached to an order or quote request: kept with the order/enquiry record and used for conversion import for up to 90 days after the click. The order record itself follows the accounting retention period.
• Cookie-consent record: Proof of your consent choice is kept for as long as needed to demonstrate consent (Art. 7(1) GDPR). Your choice is stored in a cookie for the period stated in the cookie list of our shop platform Shopify (https://www.shopify.com/legal/cookies). You can change it at any time via the cookie banner or by deleting cookies in your browser.
• Marketing consents / suppressions: until withdrawn, plus a short record to honour opt-outs.
• Technical logs: up to 30 days.

When data is no longer needed, we delete or anonymise it.

7. Cookies and similar technologies

We use Shopify's cookie banner. It is shown on the pages of our online store, not in the checkout; the choice you make on our store pages also applies in the checkout. Visitors from the EEA (and other regions where the law requires it) are asked for consent before any analytics or marketing cookies or similar technologies (including local storage) are used. You can choose Accept, Decline or set preferences per category (analytics, marketing, preferences). Strictly necessary technologies (cart, checkout, security, storing your consent choice) work without consent.

We use Google Consent Mode v2: until you consent, Google tags are set to "denied" for ad_storage, analytics_storage, ad_user_data and ad_personalization. In that state they don't set or read advertising/analytics cookies and only send limited, cookieless signals (for example that a page was viewed), which Google may use for aggregated modelling. Your choice updates these settings immediately.

You can change or withdraw your consent at any time via the cookie banner or by deleting cookies in your browser. Withdrawing consent doesn't affect processing carried out before the withdrawal.

Cookies and local storage used on thunderline.eu (measured on 21 October 2026, before and after "Accept"):

Name	Provider	Purpose	Lifetime	Category
_shopify_essential	Shopify	Cart, checkout, security, session; storage of your consent choice (see Shopify's cookie list)	1 year	Strictly necessary
localization, cart_currency	Shopify	Language/country and cart currency	1 year / 14 days	Strictly necessary
_shop_app_essential (shop.app)	Shopify (Shop Pay / Sign in with Shop)	Essential functions of Shop Pay / Sign in with Shop	1 year	Strictly necessary
_shopify_analytics	Shopify	Shop statistics	1 year	Analytics (consent)
_shopify_marketing	Shopify	Marketing attribution	1 year	Marketing (consent)
_gcl_au	Google	Google Ads conversion measurement	90 days	Marketing (consent)
_gcl_aw (cookie), _gcl_ls (local storage)	Google	Stores the Google Ads click identifier	90 days	Marketing (consent)
GCL_AW_P (google.com, googleadservices.com, doubleclick.net), IDE (doubleclick.net)	Google	Ad conversion measurement and remarketing	90 days (GCL_AW_P), up to 13 months (IDE)	Marketing (consent)
tl_attr_v1 (local storage)	Thunderline	Stores ad click identifiers and campaign parameters to attach them to your enquiry or order (Section 7a)	90 days	Marketing (consent)

Shopify's full cookie list: https://www.shopify.com/legal/cookies. Forms protected by hCaptcha may load hCaptcha's spam-protection script when you submit a form (strictly necessary).

7a. Advertising and conversion measurement

Google Ads. We advertise with Google Ads. If you reach our site through a Google ad, the link contains a click identifier (gclid, gbraid or wbraid). Only if you have accepted marketing cookies do we store this identifier, and the campaign parameters, in your browser for up to 90 days. We add them to a quote/contact form you send us and to your order. We use them to measure which ads lead to enquiries and paid orders ("conversion tracking").

Offline conversion import of paid orders. Only for orders where marketing consent was given and the click identifier was stored, we report to Google Ads orders that have actually been paid. We send the order reference, the click identifier, the time of payment, and the order value excluding VAT and freight. If an order is later cancelled or refunded, we send a correction. Unpaid orders (e.g. bank transfer not yet received) are not reported. Data is uploaded through Google Ads / Google Data Manager.

Legal basis. Google Ads conversion measurement on our website and the upload of paid orders to Google (click ID gclid/gbraid/wbraid, order ID, order value, time of payment) take place only with your marketing consent; the legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future.

Advertising audiences. Only customers and enquirers who have given marketing consent may be used for ad measurement or advertising audiences. We do not use any other contact lists for advertising.

Your choices. Decline or withdraw marketing/analytics consent via the cookie banner or by deleting cookies in your browser, and the above stops for the future. You can also manage ad personalisation at https://adssettings.google.com.

Google's role. For certain processing in connection with Google Ads, Google may act as a processor or as an independent/joint controller under its terms (https://business.safety.google/privacy/).

8. Your rights

Under GDPR you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase data ("right to be forgotten") in certain cases
• Restrict or object to processing
• Object at any time to the use of your data for direct marketing (Art. 21(2) GDPR) – we will then no longer use your data for this purpose
• Data portability (where applicable)
• Withdraw consent at any time (without affecting prior lawful processing)
• Lodge a complaint with a supervisory authority

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): https://www.aki.ee

To exercise your rights, e-mail hello@thunderline.eu. Requests are answered within one month of receipt. For complex or numerous requests we may extend this by two further months and will tell you within the first month (Art. 12(3) GDPR). We may need to verify your identity before responding. On a deletion request we delete your data from our mailbox, customer register (CRM), the AI phone service (Famulor) and the chatbot logs, except data we are required to keep under accounting law (see Section 6).

You can withdraw consent to cookies, analytics and advertising measurement at any time via the cookie banner or by deleting cookies in your browser, or by e-mailing hello@thunderline.eu.

8a. Required data, automated decisions, data protection officer

Is providing data required? Providing your data is voluntary, but without contact details we cannot answer your enquiry or deliver an order; the VAT number is required for B2B reverse-charge invoicing.

Automated decisions: Our AI chat and AI phone assistant only collect and summarise your request. No decision with legal or similarly significant effect is made solely by automated means (Art. 22 GDPR); prices, quotes and orders are always decided by a person.

Data protection officer: No data protection officer appointed (not required). Contact: hello@thunderline.eu.

9. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration. No online transmission is completely secure; please use strong unique passwords if you create an account.

10. Children

Our storefront is aimed at professional buyers. We do not knowingly collect personal data from children.

11. Changes

We may update this policy from time to time. The "Last updated" date above will be revised; material changes will be indicated on this page.

12. Contact

Privacy enquiries: hello@thunderline.eu · +372 58326609

Thunderline OÜ · Sepapaja tn 6, Lasnamäe, Tallinn 15551, Harju County, Estonia