Privacy Policy

This Policy explains what personal data we collect — on tirkomis.com, through our Telegram bot, from listings in Telegram channels and groups and at our private online auctions (sections 7–9) — why, whom we share it with and how long we keep it. Processing is carried out under the Law of Ukraine “On Personal Data Protection” No. 2297-VI of 01.06.2010.

By using the site and submitting a request you confirm that you have read this Policy. If you do not agree with it, please do not send us your data through the site's forms, the Telegram bot or auction registration.

Data you provide yourself:

• in request forms on a vehicle card (inspection, loan/leasing, price offer, trade-in, export, referral): your name and phone number are required, a comment is optional;
• in the financing calculator: the parameters you had on screen (product, down payment, term, rate, estimated payment) — they are attached to your loan request so that a manager does not have to ask again;
• in the buyer account (if you register): email, name, phone, your password as an irreversible hash, saved vehicles and saved searches. When you sign in with your phone number we text you a one-time code; the log of code deliveries (number, time, delivery status, hash of the IP address) is kept for 30 days;
• in the sell-your-vehicle form: details of the unit, your contacts and the photos and videos you upload. If you ticked the box in the form to accept the terms of the commission agreement and the public offer, we keep a record of this together with the request: the time, the page language, the versions of those documents you accepted and our details at that moment (no IP address is added to the record);
• in the AI assistant chat: the text of your message. Conversations are stored for quality control and may be attached to your request if you asked to be connected to a manager. If you agreed in the chat to a preliminary financing calculation, the preferences you mentioned (loan or leasing, down payment, term) are attached to your request so that a manager does not have to ask again;
• in a review: name, city (optional) and the text;
• to a manager — when you buy a vehicle and provide an identity document (passport or ID card) for the deal documents (in particular the proforma invoice): first and last name, document number and validity dates, nationality, date and place of birth, sex, issuing authority, personal number (if the document has one) and a photo of the data page; your address if you give it to us. This data is stored only in our CRM (not on the website) and is available to the manager handling you as a customer, senior and special sales managers, and management;
• to a manager — documents for a deal in which you buy or sell a vehicle through us, such as contracts, powers of attorney, vehicle or company documents, copies of identity documents. The manager attaches them to your customer record as a scan or photo (PDF or image); they are stored only in our CRM (not on the website) and are available to the manager handling you as a customer, senior and special sales managers, and management;
• documents that a manager attaches to a deal or to a vehicle record (such as the deal contract or photos of the vehicle registration certificate) are stored only in our CRM (not on the website) together with the deal or the vehicle and are available to CRM staff; they are not deleted together with your customer record.

Data collected automatically:

• IP address — to protect against spam and to rate-limit submissions;
• User-Agent string (browser and device);
• the page a request was sent from, the landing page, the referrer and advertising tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid) — to understand which channel brings customers;
• listing and link-page view counts and button clicks — anonymised, not linked to an individual.

• to contact you about your request and support the transaction;
• to run the buyer account, saved vehicles and saved searches;
• to send service messages about your requests and subscriptions;
• to protect the site from spam and automated submissions;
• to measure the performance of advertising channels in an aggregated form;
• to comply with the law — accounting and tax records for concluded transactions.

We do not take decisions about you by solely automated means and do not build profiles that would have legal consequences for you. At our private online auctions the system only determines the highest valid bid under the published rules, and the deal with the winner is completed by a manager (section 9).

We do not sell personal data. It is shared only to the extent needed for the stated purposes:

• our hosting provider — servers are located in the European Union (Frankfurt, Germany), where the database is stored as well;
• Cloudflare — domain services and protection of forms against automated submissions (Turnstile);
• Cloudflare and Google — email: messages to our @tirkomis.com addresses are received by Cloudflare and forwarded to our Gmail (Google) mailboxes, which we also reply from. This covers both your message and our reply;
• SMS Club (SMS Club LLC, Ukraine) — delivery of the one-time sign-in code to your number; only the phone number and the text of the code are transferred;
• Anthropic — processing of AI assistant requests: the text of your message is sent to the model to generate a reply; and recognition of photos of the registration certificate of a vehicle you sell through us: a manager may send the photos to the model to transfer the VIN, registration number, make and model, year, technical data (type, colour, fuel, engine capacity and power, emission class, weight), your name and address into the vehicle card and the deal documents (proforma invoice) — the recognised data is checked by a person; likewise, a manager may send a photo of a buyer's identity document (passport or ID card) to the model to transfer its data (section 2) into the customer record and the proforma invoice — the recognised data is checked by a person as well, and the photo is downscaled and stripped of location metadata before it is sent;
• baza-gai.com.ua (Ukraine) — a check of the registration number of a vehicle you sell through us: a manager may send the number to this service to get the make, model, year, colour and registration history from the public vehicle register of the Ministry of Internal Affairs of Ukraine; only the number is sent, and the result is checked by a person;
• the bank that services our current account — payment for placing a listing of machinery you sell through us by bank transfer to our account (IBAN): you make the transfer in your own bank using the payment details from your personal account or from a manager, so we do not receive your card details; we see the payer's name and the account the money came from only in our bank statement and use them only to find your transfer (by the payment purpose, amount and date) — we do not enter them into our CRM and keep only the invoice number, the amount, the status and the date;
• Telegram — delivery of new-request notifications to the responsible manager; conversations with our bot also run through Telegram (section 7);
• WhatsApp and Telegram — a manager's correspondence with participants of private online auctions, including sending the personal link (section 9);
• a partner bank or leasing company — only if you submitted a financing request, and only to the extent needed for a preliminary calculation;
• the other party to the deal (seller or buyer), carriers, insurance and service partners — only within the specific transaction you initiated;
• public authorities — solely in cases expressly provided for by law.

Embedded third-party content. The “About us” page shows a Google Maps map — it loads together with the page, so Google receives your IP address and browser data as soon as you open it. Listing pages may carry a YouTube video: it is shown behind a cover image hosted by us, and the YouTube player itself loads ONLY after you press “play”. Until then the page does not contact YouTube at all. By pressing “play” you pass YouTube (Google) your IP address, browser data and the address of the page you are watching from.

The site may use web analytics and advertising tags: Google Analytics, Google Tag Manager, Google Ads, Meta Pixel, TikTok Pixel and Microsoft Clarity. Which of them are switched on is decided by the site administration, so some may be inactive at the time of your visit.

Google tools load immediately but stay in consent-pending mode until you answer the banner (Google Consent Mode v2): no cookies, no identification — only an anonymous record that a page was viewed. After you choose “Accept all” they switch to full mode, including advertising and remarketing. Meta Pixel, TikTok Pixel and Microsoft Clarity (which records your actions on the page) are not loaded at all before consent — if you choose “Only essential”, their code never reaches the page.

The site uses the following cookies:

• essential — the buyer account session and a temporary marker during Google sign-in. Sign-in does not work without them;
• tk_utm — advertising tags and referrer, stored for up to 30 days;
• consent cookie — remembers your answer in the banner, stored for up to a year;
• analytics and advertising — set ONLY after your consent (“Accept all”) and belonging to the services listed in section 4: visit measurement, advertising and remarketing, on-page session recording. Retention is set by the respective service, typically up to two years. If you chose “Only essential”, they are not set;
• embedded video cookies — set ONLY if you press “play” on a YouTube video in a listing or an auction lot. We use youtube-nocookie mode, so YouTube sets no cookies before playback. These cookies belong to Google and do not depend on your banner answer: without the click there are none, after the click there are.

You can change your cookie choice at any time via the “Cookie settings” link in the footer. Essential cookies cannot be switched off, as the site would not work without them. Saved vehicles and comparisons are kept in your browser (localStorage) and are not sent to our servers until you sign in.

Private online auction pages set no cookies themselves and show no banner; YouTube cookies may appear there just as in listings — only if you press “play” on the lot's video. After you register for an auction yourself, the browser keeps your personal link in localStorage — see section 9 for details.

• requests and correspondence with a manager — for as long as the customer relationship requires, and for concluded transactions, for the period set by tax law;
• buyer account data — while the account exists; once it is deleted the data is erased or anonymised, and the phone number used for sign-in is unlinked from the account;
• a buyer's identity document (passport) data and photos, and the documents attached to your customer record — for as long as working with you as a customer and preparing the deal documents requires; when your customer record is deleted in the CRM they are permanently deleted, and at your request we delete them earlier unless the law requires us to keep them. The buyer details already printed in issued deal documents (proforma invoice) stay in those documents for the period set by tax law;
• records of listing placement payments (order number, amount, status and date; we do not receive card details) — for the period set by tax and accounting law; if you ask us to delete your data, these records are kept as financial records without your contact details;
• advertising tags — up to 30 days in the cookie and within the request they belong to.

Security: connections are encrypted (HTTPS), staff access is limited by role, actions on data are logged, passwords are stored as an irreversible hash, integration tokens are encrypted, and the database is backed up regularly.

Our Telegram bot does two things: it takes requests to find a vehicle and, if you have subscribed, sends you new vehicles from the catalogue.

Requests via the bot. The bot asks a few questions and, after the last answer, saves the request in our CRM:

• what you are looking for — the text you wrote;
• your phone number — the one you shared with the Telegram button or typed in;
• your name — as you gave it;
• your answer to whether you are looking urgently;
• your Telegram ID and username (@username), if you have one — so that a manager can reach you on Telegram and so that filling in the questionnaire again does not create a second request while the first one is still open.

An unfinished questionnaire is kept only in the bot's working memory and is not written to the database. A saved request is then handled the same way as a request from the site: purposes in section 3, recipients in section 4, retention in section 6.

Subscription to new vehicles. If you set up a subscription in the site's catalogue and followed its link to the bot, we store your Telegram ID, the name from your Telegram profile and the catalogue filter you chose, and send new matching vehicles to that chat. The /stop command switches off all your subscriptions at once; every digest message reminds you of it. If you block the bot, the digest stops as well.

Legal basis — your request: both the request and the subscription are needed to find and offer you a vehicle, i.e. they are steps taken at the data subject's request prior to entering into a transaction (Article 11(1)(3) of Law No. 2297-VI).

Retention. Requests from the bot are kept the same way as requests from the site (section 6). The /stop command switches off the digest but does not delete the record: your Telegram ID, name and filter stay in the database until you ask us to delete them.

How to request deletion. Contact us using the details in section 10 and give the phone number or @username you used with the bot, or, if you only subscribed to updates, the name on your Telegram profile and which vehicles you were following. We will delete or anonymise the request and the subscription data; before that we may ask you to confirm that the Telegram account is yours.

Conversations with the bot run through Telegram, so your messages to the bot are also processed by Telegram itself under its own privacy policy, which we have no control over.

To keep our vehicle catalogue complete and up to date, we automatically read Telegram channels and groups carrying vehicle-for-sale listings that are connected as sources in our CRM. Reading is done through a Telegram account connected to the CRM. The scanner sends nothing and does not mark messages as read.

What we store:

• the text of the listing as published — including phone numbers and names if the author put them there;
• the publication and edit dates, the message number in the channel and whether it contains photos or videos;
• photos, and occasionally videos, from the listing — we attach them to the card of the matching vehicle in our CRM; if that card is published, they are visible on the site as well.

The scanner does not store who wrote the message (the author's Telegram account, name or @username).

What we do with it. Depending on the CRM settings, the system matches listings to vehicles in our database by number, creates a draft card for a vehicle that is not yet in the database, adds photos and specifications to cards, and marks a vehicle as sold when a sold mark appears in the listing. Phone numbers and names from the text are not automatically copied into vehicle cards, client records or requests; the text itself is visible only to CRM staff with the appropriate permissions. The text is parsed by the program's own rules — without artificial intelligence and without being sent to third-party services.

Legal basis — our legitimate interest (Article 11(1)(6) of Law No. 2297-VI) in keeping an accurate catalogue of vehicles offered for sale. We consider that this interest does not override your fundamental rights and freedoms: the author published the listing precisely so that buyers would read it; we store only the published text, do not store who wrote it, do not use it for mailings and do not share the stored copies with anyone except the hosting provider described in section 4. You have the right to object to this processing (section 10).

Retention. Stored copies of listings have no automatic deletion period. If the author edits the listing in Telegram, our copy is updated when the scanner reads that post again. Deleting the post in Telegram does not by itself delete our copy.

How to request deletion. Contact us using the details in section 10 and include a link to the listing or its text. We will delete the stored copy and, where needed, the photos from it on the vehicle card. After that the scanner will not store this post again, even if it stays published in Telegram or gets edited. If the listing is published again as a separate post, that is a new post and needs a separate request. We cannot remove the post from the channel itself: only its author or the channel administrator can do that.

We run private online auctions for the sale of vehicles — one unit per auction. You can take part only via a link:

• via a personal link issued to you by our manager, who enters your participation details into our CRM;
• by registering yourself via the auction's public link: you enter your name (or company name) and WhatsApp number, and a personal link to your auction page is created for you straight away.

What we store:

• your name (or company name), phone number, company and country — whatever you entered yourself or gave to the manager — and the language of your auction page;
• the manager's internal note and, if you are already our customer, a connection between your participant record and your customer record in our CRM;
• the amount and time of each of your accepted bids, and the IP address and browser data (User-Agent string) it was placed from;
• when you first opened your auction page and when you were last on it;
• details of your link: when it was issued or reissued and, if it was revoked, when and why.

Bids the system did not accept (for example, too low) are not stored. Opening the public link without registering records nothing about you in our database. To protect the auction from abuse, the server limits request rates; these counters, keyed by IP address, live only in its working memory and are not written to the database.

Your personal link is the key to your auction page: anyone who has it can bid as you, so do not forward it to others. We do not store the link in readable form in our database: the system recognises it by its fingerprint (hash), and so that a manager can show you the same link again, the database may also hold an encrypted copy of it; each such display is logged. A link obtained through self-registration is not shown again by a manager unless the auction has already been cancelled. If the link is lost or has reached other people, contact the manager: they can issue a new one — the old one then stops working immediately, and your bids are kept.

The link in your browser. After self-registration, the browser you registered in keeps in its storage (localStorage) your personal link, a partly hidden copy of your number (the first three and the last two digits) and the record's expiry — the end of the auction plus 48 hours — so that you can reopen your page from the public link. When you open that public link again, the browser sends the stored link to our server to check whether it still works (such a check counts as a visit to your page), and forgets it if it no longer works or more than 48 hours have passed since the auction ended. The “Not me — forget this device” button deletes the record at once; if you never open the public link again, the record stays in the browser until you clear the site's data in your browser settings. When you press “Take part”, the browser tab (sessionStorage) also keeps a technical request ID and a short check value (hash) computed from your number — not the number itself — so that pressing the button again does not create a second participant; this data stays after registration too and disappears when you close the tab. The personal auction page itself writes nothing to your browser's storage; but its address is your personal link, so like any visited address it stays in your browser history: on someone else's or a shared device, delete it from the history.

Who sees what. Other participants never see your name, number or bids — only the number of participants and the current highest bid, without who placed it, and after the auction ends, the winning bid. A guest who opened the public link but has not registered sees only the vehicle, the starting price, the auction terms and the contact details — not the current bid or the number of participants. The site does not show your name or full number to anyone, including you: only in the browser you registered in does the public link page show the partly hidden copy of your number described above (“Registered as …”), and anyone who opens the public link in that browser will see it. In our CRM, participant data and the bid log are visible to the owner, administrators and senior sales managers, and also to the sales manager responsible for that auction; the IP addresses and browser data that bids were placed from are visible only to the owner, administrators and senior sales managers. Our staff receive notifications about bids, registrations and auction results via Telegram and as push notifications; the system does not add your name or phone number to them: a participant is referred to there only by a sequence number (e.g. “participant No. 3”).

No analytics or cookies. Auction pages contain no analytics, advertising tags or AI assistant and set no cookies themselves, so there is no cookie banner there. A YouTube video of the lot is shown the same way as in listings (section 4): the YouTube player loads only after you press “play”. YouTube (Google) then receives your IP address, browser data and only the address of our site (tirkomis.com) — not the address of your page, i.e. not your personal link; after that, YouTube may set its own cookies (section 5).

The number is not verified. A number entered during self-registration is not verified automatically, so before the deal is completed the manager may ask you to confirm your identity.

What we do with it. Participant data and bids are needed to run the auction and show you its status, to determine the winner and to contact you about the auction and the purchase. The winner is determined by the system under the rules shown on the auction page: the highest valid bid at the moment bidding actually ends wins. No deal is concluded automatically: a manager completes it, and the owner or an administrator may annul a bid, stating the reason. The time you opened your page shows the manager whether the link reached you. The IP address and browser data of bids are evidence in case of a dispute over bids; they also help spot abuse, such as several “participants” bidding from the same address.

Legal basis — steps taken at the data subject's request prior to entering into a transaction (Article 11(1)(3) of Law No. 2297-VI): taking part in an auction is your step towards buying a vehicle. If you register yourself, the basis is also your consent, which you give by registering (it is stated under the “Take part” button; Article 11(1)(1) of Law No. 2297-VI). You can withdraw your consent by contacting us using the details in section 10: we will then anonymise your participant record as described below, and you will no longer be able to bid. We process the IP address and browser data of bids on the basis of our legitimate interest (Article 11(1)(6) of Law No. 2297-VI) in having evidence in case of a dispute and protecting the auction from abuse. We consider that this interest does not override your fundamental rights and freedoms: this data is visible in the CRM only to the owner, administrators and senior sales managers, is not used for any other purpose and is deleted automatically 180 days after the auction ends or is cancelled. You have the right to object to this processing (section 10).

Retention. Participant data (name, number, company, country, language, note, connection to your customer record, page visit times and link details) is kept with the auction record — after the auction ends or is cancelled and after the link is revoked — until you ask us to delete it: it has no automatic deletion period. Bid amounts and times are kept without a time limit as the auction log. The IP addresses and browser data of bids are deleted automatically 180 days after the auction ends or is cancelled.

How to request deletion. Contact us using the details in section 10 and give the phone number you took part with (or the name you were registered under) and, if you remember, the vehicle or the date of the auction. Before anonymising the record, we may ask you to confirm that the number is yours. We will anonymise your participant record: your name is replaced with a marker, the phone number, company, country, note, the encrypted copy of your personal link and the connection to your customer record are deleted, and your personal link stops working for good. If your participant record was connected to your customer record in our CRM, only that connection is removed; the customer record itself is not changed — its data is kept under the rules in section 6. We also delete the IP addresses and browser data of all your bids and remove your phone number from the internal records of that auction (reasons for decisions, notes, change log). If a manager added you, we remove your name from them as well. If you registered yourself, the name you entered is replaced in those records only after a staff member has reviewed them and confirmed they are about you, and only where it appears in full: a self-chosen name may coincide with ordinary words. What remains is the participant number, the page language, bid amounts and times and technical timestamps: this is the auction log on which its result depends. Data can be anonymised during an auction as well, but you will then no longer be able to bid, and the bids already placed remain valid. We do not alter database backups made earlier: the data in them disappears when those copies are replaced with new ones.

If a manager writes to you on WhatsApp or Telegram (for example, to send your personal link) or you write to the manager using the WhatsApp button on an auction page, the conversation runs through that messenger, so it is also processed by the messenger itself under its own privacy policy, which we have no control over.

Under Article 8 of the Law of Ukraine “On Personal Data Protection” you have the right to:

• know who processes your data and for what purpose;
• access your data and obtain a copy of it;
• request correction of inaccurate data;
• request erasure of your data or restriction of processing;
• withdraw your consent to processing;
• object to processing;
• lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or with a court.

To exercise any of these rights, write or call us: +380 97 102 65 65. We reply within 30 calendar days. We may ask you to confirm your identity so that we do not hand someone else's data over.

The site is intended for adults. We do not knowingly collect data from anyone under 18. If you believe a child has provided us with their data, let us know and we will delete it.

We may update this Policy. A new version takes effect once published on this page; the update date is shown below. If the changes are material, we will announce them on the site.