Sign in

Privacy policy

Updated 30 September 2026

The Finnish version is the governing text.

1. Scope

This notice explains what personal data bilbil.fi processes, what it is used for, who it is disclosed to and what rights you have. It covers the service in all its language versions and on all devices, including the dealer sites on bilbil.fi subdomains. An updated notice takes effect when it is published on this page.

2. Data controller

The controller is Actus Analytics Group Oy (Finnish business ID 3647312-5, registered office in Espoo, Finland), which provides the bilbil.fi service. Contact for enquiries and data protection requests: info@bilbil.fi.

3. What data we process

We process data you provide yourself, data generated when you use the service, and data we obtain from public and other external sources.

Data you provide

  • Email address, language preference and account creation time, when you create an account.
  • Your Google account identifier, email address and name as passed on by Google, if you sign in with a Google account.
  • The details of a listing you post: the car details and photos, the town, the name shown in the listing and, if you choose, a phone number.
  • Cars you save and the searches you set up as alerts, together with their notification settings.
  • The content of a review or a reply, the email address, and the details you choose to show: name or nickname, town, and in a model review the car’s model year and kilometres driven.
  • The message and email address you send to a seller through a listing contact form.
  • The content of feedback or an enquiry when you contact us.

Data collected automatically

  • Technical log data, such as the IP address and browser and device details.
  • General-level location data. We do not collect the precise location of your device.
  • Data on the use of the service, such as pages and links opened. This is processed as statistical aggregates that are not linked to an individual user.

Data from other sources

We compile data from publicly available car listings and other public sources in the markets where the service operates. This data may contain personal data, such as the seller’s name or the vehicle’s registration number. A private seller’s name is not shown in the service. The data is used to present the listing, price and sales history of a vehicle.

4. Purposes and legal bases

Performance of the contract

  • Creating an account, signing in and managing the account.
  • Running saved cars, search alerts and your own listings.
  • Sending the email notifications you subscribe to.
  • Forwarding enquiries between buyer and seller.

Legal obligation

  • Responding to requests from authorities and complying with statutory retention obligations.
  • Handling reports of illegal content and giving reasons for the measures taken.

Legitimate interest

  • Providing a car information service, including showing listings and their price and sales history.
  • Keeping the service running, secure and available, and investigating incidents.
  • Detecting and preventing misuse, fraud and systematic harassment.
  • Checking listings and reviews before publication and enforcing the rules.
  • Developing the service and following its use in aggregate.
  • Establishing, exercising and defending legal claims.

Where processing is based on legitimate interest, we have weighed our interest against your rights. You can object to such processing on grounds relating to your particular situation.

Consent

If any processing requires consent, we ask for it separately. You can withdraw consent at any time, and withdrawal does not affect the lawfulness of processing carried out before it.

5. User account

If you create an account, we store your email address, language preference and the account creation time. This data is used for signing in and for delivering features you request, such as email notifications. Processing is based on providing the service (contract).

You can sign in with a one-time code sent to your email or with a Google account, and the service has no passwords. The code is valid for a short time, and a sign-in lasts at most 30 days at a time.

You can download your data and delete your account at any time on bilbil.fi/tili. Deletion permanently removes the account data and cannot be undone.

Signing in with a Google account

When you sign in with a Google account, Google passes on to us your Google account identifier, your email address, whether Google has verified the address, and the name on your Google profile. We store these linked to your account, together with the time the link was made and the time you last signed in with it. We do not store any other profile details Google passes on, nor Google access tokens. You are recognised by the Google account identifier, not by the email address.

The first time you sign in with Google, an account is created with the address Google has verified, or, if an account with that address has already been verified, the Google account is linked to it. Otherwise you first confirm an email address with a one-time code, and until then the details received from Google are kept for at most 10 minutes. When signed in, you can also link a Google account from your account settings. When a Google account is linked to an existing account, a notice is sent to the account’s email address. You can remove the link under Sign-in methods in your account settings, which deletes the details received from Google; they are also deleted when the account is deleted. We do not send Google any data about you. When you choose to sign in with Google, Google learns that you are signing in to this service and processes that under its own terms.

6. Emails

We send sign-in codes and the notifications you subscribe to, such as price-change alerts. Notifications are based on your subscription, and every message ends with an unsubscribe link; after an unsubscribe, no further subscribed messages are sent to the address. A message sent through a listing contact form is forwarded to the seller together with the sender’s email address, and a copy is retained, visible to the seller and also used for investigating misuse.

7. Data in car listings

bilbil.fi compiles and displays data from publicly available car listings. Listings may contain personal data, such as the seller's name or the vehicle's registration number; a private seller's name is not shown in the service. This data is processed on the basis of legitimate interest, in order to provide a car information service. If you would like data concerning you corrected or removed, or your vehicle's data hidden from the service, contact info@bilbil.fi.

8. Reviews

Sending a review, or a reply under one, requires an email address. The address is not published or disclosed to other users, and it is processed to confirm the review, to prevent duplicate reviews, to let the writer manage their own text, and to send notifications relating to the discussion. Only the details the writer has chosen to display are shown publicly.

To detect abuse and systematic harassment, the sender’s IP address is processed in a form from which the address cannot be recovered; the address itself is not stored. The basis for processing is legitimate interest in providing a trustworthy review service. You can delete your own review with the link in the publication email, and stop discussion notifications from the link at the end of every notification. A deleted review is not shown in the service and does not count towards the average, but the content is retained for investigating abuse.

9. Business accounts and staff cards

When a car dealer claims its dealer page, we process the names and email addresses of the dealer’s representatives and the contact details the dealer provides, in order to provide the business services. Processing is based on the agreement with the dealer; for the representatives’ data the basis is legitimate interest in managing the business relationship.

A dealer may publish details concerning its staff on its site, such as the name, role, contact details and photo. The details are provided by the dealer, which is responsible for having the right to publish them and for having informed the person; the basis for processing is legitimate interest in providing the service ordered by the dealer. The person is sent an invitation through which they can manage their own details, and the details are removed at the request of the dealer or the person.

10. Cookies and data stored in your browser

We do not use analytics, advertising or tracking cookies, and we do not share browsing data with ad networks. Signing in requires cookies needed to maintain the session and the signed-in state, an unfinished listing is remembered for a short time with a cookie, and the protections that keep the service secure may store necessary identifiers. These are strictly necessary for the service to work and stay secure, so no consent is requested for them.

Cars you save, your search history and interface choices are kept in your own browser. When you are signed in, saved cars are also stored in your account so they follow you across devices. Data stored in the browser is removed when you clear your browser data.

Transfer from the service’s previous address

The service has moved to a new address. When you open the service’s previous address in a browser you have used the service with, the data stored in that browser is carried over to the new address in the same browser: the cars you have saved, the cars you have viewed, your recent searches, and your choices of theme, list view and sort order. The data travels in the part of the address after the # sign, which the browser does not send to the server, and the new address accepts it only when you arrive from the previous address’s transfer page. It is combined with any data already stored at the new address, which stays as it is. Other data stored in the browser, such as contact details you have entered for a share image, is not transferred.

If you were signed in at the previous address, your sign-in moves with a one-time code that is valid for two minutes and works only in the same browser. If you are already signed in at the new address, that sign-in is kept. The new sign-in is linked to the previous one, so signing out at the new address ends both.

11. Recipients and disclosures

We do not sell personal data and we do not disclose it for marketing purposes. Data is processed on our behalf by technical service providers that handle hosting, storage, delivery, security and email sending. They act on our instructions and under a data processing agreement as required by the GDPR. In addition, data may be disclosed to:

  • a seller, when you send them a message through a listing contact form
  • an authority or a court where required by law
  • legal advisers, in order to establish or defend a legal claim
  • a buyer in connection with a business transfer, in which case the data continues to be processed in accordance with this notice

Data is processed primarily within the EU or EEA. Where data is transferred outside that area, the transfer is based on a European Commission adequacy decision or on standard contractual clauses together with any further safeguards required.

12. Retention period

Personal data is retained for as long as it is necessary for the purpose of the processing. A sold listing is removed from the listing pages after a short period determined by the type of seller. The listing, price and sales history concerning vehicles is retained permanently as part of the service’s content; hiding the data concerning a vehicle can be requested. Account data is kept until the account is deleted, and data published in the service by a user or a dealer until it is removed. Sign-in data expires automatically after a set period, and data stored in the browser is removed when the browser data is cleared. Technical log and monitoring data is retained only for as long as necessary for the operation and security of the service and for investigating misuse. Data may be kept longer than the above where the law requires it or where it is necessary for the establishment, exercise or defence of a legal claim.

13. Data security

We protect data with appropriate technical and organisational measures. Connections are encrypted, access to data is limited to the tasks that require it, and access requires authentication. Identifying data is stored in a protected form.

14. Automated decision-making

We do not make decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you. The service’s calculated estimates are statistical and are not decisions about you. Automated means are used in checking content and in preventing misuse; a review of a decision on a measure can be requested as described in the terms of use.

15. Your rights

You have the following rights under the GDPR:

  • To know whether we process data concerning you, and to obtain a copy of it.
  • To have inaccurate data corrected and incomplete data completed.
  • To have data erased where there is no longer a basis for processing it.
  • To have processing restricted.
  • To object to processing based on legitimate interest, on grounds relating to your particular situation.
  • To receive the data you have provided in a machine-readable format and transfer it to another controller.
  • To withdraw a consent you have given.

You can download your data and delete your account yourself on the account page. Other requests: info@bilbil.fi.

We respond within one month. Handling requests is free of charge; for a manifestly unfounded or excessively repetitive request we may charge a reasonable fee or decline to act on it. You can also lodge a complaint with the supervisory authority: Office of the Data Protection Ombudsman, PO Box 800, FI-00531 Helsinki, tietosuoja.fi.

16. Other things worth knowing

What you publish is visible to others

Your listings and reviews, and the details shown with them, are visible to everyone using the service and may appear in search engines. Consider what you write in free-text fields.

Another user’s data

When you receive another user’s data through the service, such as a name or an email address, you are independently responsible for it. Use the data only for the matter the enquiry concerned, and not, for example, for marketing without permission.

Data concerning third parties

If you give us data concerning another person, you are responsible for having the right to do so and for telling them how the data is processed.

External sites

The service contains links to external sites, such as listing sources, sellers’ own sites and partners. They process data according to their own notices, and we are not responsible for their processing.

Do you have to provide data

You can browse the service without creating an account. An email address is necessary for an account, search alerts, your own listing and a review: without one, those features cannot be used. Other details are voluntary.

Children

The service is not directed at children, and we do not knowingly collect personal data from children.

Staying signed in

You stay signed in on a device for at most 30 days, or until you sign out. While the session lasts, anyone with access to the same browser can see your account. On a shared or public device it is advisable to sign out after use.

17. Changes

This notice may be updated as the service develops. The version in force is always on this page, and the update date is shown at the top. Significant changes will be announced in the service.