Privacy notice

Last updated: 12 November 2026.

1. Who controls your data?

UAB “Gorilla auto”, company number 305643932, registered address Gimtinės g. 1, LT-72201 Tauragė, Lithuania. For privacy matters, contact [email protected].

This notice covers Gorilla AI Messenger, our customer-support service for vehicle part enquiries, offers and orders through our Facebook Messenger channel. Meta separately processes data on its own platform under its own terms.

2. What data do we process?

• Messenger message content, attachments and photos, message timestamps, account identifiers and profile information made available by the platform.
• Vehicle and part information: make, model, year, VIN, OEM number, descriptions and photos you provide.
• Where relevant to a quote or order: name, contact details, delivery address, selected parts, payment and delivery status, and invoicing details.
• Technical, security and error-diagnostic records related to processing requests.

Please do not send passwords, card details or unnecessary sensitive information through Messenger.

3. Purposes and legal bases

• Handling enquiries, checking compatibility and preparing quotations – taking steps at your request before a contract and performing a contract (GDPR Article 6(1)(b)).
• Fulfilling orders, delivery and invoicing – contractual performance and legal obligations (Article 6(1)(b) and (c)).
• System security, incident investigation, dispute management and service reliability – our legitimate interests, balanced against your rights (Article 6(1)(f)).

We do not use customer enquiries for unsolicited direct marketing without a separate lawful basis.

4. AI-assisted processing

Automated text and image analysis may help identify your request, VIN or OEM number, select potential parts and draft replies. A human operator may review offers and certain actions. Automated results may be inaccurate; please contact the operator if you need clarification on fitment or ordering terms.

We do not currently maintain an automated training dataset of real customer Messenger conversations for additional AI model training. Technical diagnostic records, aggregated metrics and separately created synthetic test cases may be used to investigate service errors.

5. Who can receive data?

Depending on the task, authorised company representatives and providers may access relevant data: Meta (Messenger), Cloudflare (network infrastructure), Telegram (internal operator notifications), Google Workspace (email), and relevant parts suppliers, delivery or accounting partners for an order. Vehicle part searches can involve supplier catalogues and marketplaces, including RRR.

We limit sharing to what is needed for each purpose, subject to applicable access and service-provider arrangements.

6. International processing

Some technology providers may process data outside the European Economic Area. Such transfers must rely on applicable legal transfer mechanisms and safeguards. You may contact us for details relevant to your enquiry.

7. Data retention

We keep active enquiry and order data for as long as necessary to manage them. After correspondence ends, we assess further retention in light of the nature of the enquiry, possible disputes, security requirements and legal duties. Accounting and transaction records may be subject to longer statutory retention.

At present, a uniform automatic 30-day deletion schedule is not enabled for all inactive conversations. Deletion requests are assessed individually; where the law requires erasure and no exception applies, data is deleted or its processing restricted. Backups and data held by individual service providers can follow their own technical retention cycles.

8. Your rights

Subject to the GDPR, you may request access, correction, erasure, restriction, object to processing, or exercise data portability. Contact [email protected]. We may seek proportionate identity verification before disclosing data. We normally respond within one month; legally permitted extensions will be explained to you.

You can also complain to the Lithuanian State Data Protection Inspectorate.

9. Deletion requests

See our data deletion instructions. Some records may need to be retained for accounting, legal claims or dispute resolution. We will explain any applicable exceptions.

10. Changes

We may update this notice when our services or processing change. We will display the revision date on this page.