Last updated: 1 January 2025 | This policy complies with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and applicable Estonian data protection law.
1. Data Controller
Data25Estonia
Lõõtsa tn 5, 11415 Tallinn, Estonia
Email: mari.saari@data25estonia.online
2. Personal Data We Collect
2.1 Data You Provide Directly
- Name (first and last)
- Email address
- Phone number (optional)
- Organisation name (optional)
- Message content and service interest submitted via our contact form
2.2 Data Collected Automatically
- IP address and general location data
- Browser type, version and operating system
- Pages visited, time on site and referring URL
- Cookie consent preference (stored in localStorage)
3. Purposes and Legal Basis of Processing
- Responding to enquiries — legal basis: Art. 6(1)(b) GDPR (performance of pre-contractual steps at your request)
- Service delivery — legal basis: Art. 6(1)(b) GDPR (performance of contract)
- Website operation and security — legal basis: Art. 6(1)(f) GDPR (legitimate interests)
- Legal compliance — legal basis: Art. 6(1)(c) GDPR (compliance with legal obligation)
- Non-essential cookies — legal basis: Art. 6(1)(a) GDPR (consent)
4. Data Retention
- Enquiry data: retained for up to 3 years from the date of last contact
- Contract-related data: retained for 7 years in accordance with Estonian accounting and commercial law
- Website usage logs: retained for up to 12 months
- Cookie consent preference: retained in your browser until cleared
5. Your Rights Under GDPR
Under Articles 15–22 of the GDPR, you have the following rights:
- Right of access — to obtain a copy of your personal data we hold
- Right to rectification — to correct inaccurate or incomplete data
- Right to erasure — to request deletion of your data ("right to be forgotten")
- Right to restrict processing — to limit how we use your data in certain circumstances
- Right to data portability — to receive your data in a structured, machine-readable format
- Right to object — to object to processing based on legitimate interests
- Right to withdraw consent — to withdraw consent for cookie use at any time without affecting the lawfulness of prior processing
To exercise any of these rights, email mari.saari@data25estonia.online with the subject line "Privacy Request" or "Opt-Out".
6. Data Sharing and Processors
We do not sell personal data. We may share your data with:
- Trusted service providers acting as data processors (e.g. hosting, email), under appropriate data processing agreements;
- Competent authorities where required by law.
7. International Data Transfers
Where personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V — including Standard Contractual Clauses or adequacy decisions.
8. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure. As a data management company, security is at the core of how we operate.
9. Cookies
For full details of our use of cookies, please see our Cookie Policy.
10. Right to Complain
You have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): aki.ee. You may also contact the supervisory authority in your EU country of habitual residence.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page. The date of the latest revision is shown at the top of this document.
12. Contact the Data Controller
Data25Estonia
Lõõtsa tn 5, 11415 Tallinn, Estonia
mari.saari@data25estonia.online