Legal

Privacy Policy

Please review and adapt before go-live. This draft describes the standard data processing of an information website with a contact form. It is not legal advice. Before publication, at least the following should be checked: the actual hosting used (server location, data processing agreement), font delivery (see the "Fonts" section) and whether further services (analytics, maps, video) are embedded. The German version of this policy is authoritative.

1. Controller

The controller within the meaning of the GDPR is:
EstNor OÜ (in the commercial register: OÜ EstNor)
Kurna tee 33, 75401 Kiili, Harju maakond, Estland
Represented by: Renee Mikomägi (board member / Managing Director)
Email: info@estnor.ee
Phone: +372 651 6174

Based on current assessment, EstNor OÜ is not legally required to appoint a data protection officer. [Confirm before go-live; add contact details if applicable.]

2. Processing when visiting the website (server logs)

When the website is accessed, the hosting provider automatically stores information in server log files that your browser transmits: IP address, date and time of access, page/file requested, amount of data transferred, referrer URL, browser and operating system.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in technically error-free and secure operation). The logs are deleted after [insert period, e.g. 7–14 days], unless security-relevant incidents require longer retention.

Hosting: The website is hosted by [hosting provider, company name, address]. A data processing agreement under Art. 28 GDPR is in place with the provider. Server location: [country].

3. Contact form and email contact

If you contact us via the contact form or by email, we process the details you provide (name, company, email address, phone, message) in order to handle your enquiry.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). The form data is transmitted to us by email and is not permanently stored in a database on the server. We delete the data as soon as it is no longer required for the purpose and no statutory retention obligations apply.

4. Fonts

This website embeds fonts ("Bricolage Grotesque", "Inter") via Google Fonts. This establishes a connection to Google servers (Google Ireland Limited / Google LLC, USA) and transmits your IP address. Legal basis: Art. 6(1)(f) GDPR.

[More privacy-friendly: serve the font files locally from your own server and remove the external embedding. In that case adapt or remove this section accordingly.]

5. No analytics tools / no tracking

This website currently does not use any analytics, tracking or marketing cookies. Only one technically necessary cookie is set, to store the selected language. There is no cookie banner, as no consent-requiring technologies are used. [Adapt as soon as, for example, web analytics is introduced.]

6. Your rights

Within the statutory framework you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and a right to object to processing based on Art. 6(1)(f) GDPR (Art. 21).

You also have the right to lodge a complaint with a data protection supervisory authority.

7. Changes

We adapt this privacy policy as soon as changes to the website or the legal situation require it. The version published here at the time applies.