Privacy Policy

1. Who we are

Estonicist OÜ (“Estonicist”, “we”, “us”) is a private limited company registered in Estonia, with its registered office at Tornimäe tn 5, 10145 Tallinn, Estonia. We are the controller of personal data processed through the website estonicist.eu (the “Website”) and in connection with our accessibility audit services.

Contact for data protection matters: info@estonicist.eu.

2. What data we collect and why

2.1 Contact and booking requests

When you submit the contact form or email us, we process the data you provide: name, company, work email address, shop URL, shop platform and the content of your message.

• Purpose: to respond to your request, prepare a scope and offer, and schedule an audit.
• Legal basis: steps at your request prior to entering into a contract (GDPR Art. 6(1)(b)) and our legitimate interest in handling business enquiries (Art. 6(1)(f)).
• Retention: 24 months after our last contact, unless a contract is concluded (see 2.2).

2.2 Clients and contracts

If you become a client, we process contact details of your representatives, contract and invoicing data, and the information needed to perform the audit (shop URLs, test accounts you provide, technical contacts).

• Legal basis: performance of the contract (Art. 6(1)(b)) and legal obligations such as accounting (Art. 6(1)(c)).
• Retention: accounting records are kept for 7 years as required by the Estonian Accounting Act; other contract data for 3 years after the end of the contract (limitation period).

2.3 Audit data

During an audit we may incidentally encounter personal data in your shop (e.g. in test orders or screenshots). We use only test accounts provided for that purpose, minimise captured data, and process it solely as your processor under the audit agreement.

2.4 Website usage

Our hosting provider records technical access data (IP address, time, requested page, browser) in server logs for security and operation of the Website (legitimate interest, Art. 6(1)(f)). Logs are kept for no longer than 30 days. Optional analytics cookies are used only with your consent — see our Cookie Policy.

3. Recipients and processors

We share personal data only with service providers that process it on our behalf under data processing agreements:

• website hosting and form storage infrastructure;
• email and productivity services;
• accounting and invoicing software and our accountant;
• authorities where we are legally obliged to do so.

Where a provider is located outside the European Economic Area, transfers are based on an adequacy decision or the European Commission's Standard Contractual Clauses.

4. Your rights

Under the GDPR you have the right to access your personal data, to have it rectified or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). To exercise these rights, email info@estonicist.eu. We respond within one month.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee, or with the supervisory authority of your habitual residence.

5. Security

We apply appropriate technical and organisational measures, including encrypted connections (HTTPS), access controls, and the principle of data minimisation. Form submissions are stored in access-restricted infrastructure.

6. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

7. Children

The Website and our services are directed at businesses. We do not knowingly collect data from persons under 16.

8. Changes to this policy

We may update this policy to reflect changes in our services or the law. The current version is always published on this page with the date of the last update.