Privacy Policy

Data Controller

Delvaris OÜ (reg. no. 17464650, VAT: EE102967232), Tiskrevälja tn 59-12, 13516 Tallinn, Estonia ("we," "us," "our") is the data controller responsible for the personal data we collect through delvaris.com. We have not appointed a Data Protection Officer as our core activities do not require one under GDPR Art. 37. For data protection inquiries, please contact Marek Stark at privacy@delvaris.com.

This privacy policy explains how we collect, use, store and share your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR").

What Data Do We Collect?

We do not collect special categories of personal data. Depending on how you contact us, we collect:

• Contact form: your name and email address (required), and your company name and message (optional).
• Emails you send us: your email address, your name and what you choose to write.
• When you submit the contact form or make a cookie choice: a pseudonymised (hashed) version of your IP address and browser identifier.

The contact form marks which fields are required. We need them to answer your enquiry; without them we cannot respond. Everything else is optional.

How Do We Collect the Data?

• Directly from you, when you fill in the contact form on delvaris.com or email us.
• From your browser, when you submit the contact form or make a cookie choice (the pseudonymised identifiers described above).

Legal Basis for Processing

We process your personal data only when we have a valid legal basis under GDPR Art. 6:

• Answering your enquiry: Art. 6(1)(b) (steps taken at your request before entering into a contract).
• Protecting the contact form against spam and abuse (rate limiting, pseudonymised IP address and browser identifier): Art. 6(1)(f) (our legitimate interest in keeping the website secure).
• Keeping a record of your cookie choice: Art. 6(1)(c) (our legal obligation to be able to demonstrate consent, Art. 7(1)).
• The necessary cookie that remembers your cookie choice: Art. 6(1)(f) (our legitimate interest in providing a functioning website).

Data Security

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, modification, disclosure or destruction. We never store the IP address of a form submission or cookie choice in readable form, only a pseudonymised (hashed) version. Only authorised personnel have access to your data.

How Do We Use the Data?

• To answer the enquiries you send us.
• To protect the contact form against spam and abuse.
• To be able to demonstrate the cookie choice you made.
• We do not use data collected on this website for newsletters or marketing emails.

Sharing of Personal Data

We do not use analytics or advertising services on this website, and we do not sell your personal data. The service providers that process personal data on our behalf, under data processing agreements, are listed below.

International Data Transfers

Some of the service providers listed above are located in the United States. Transfers to providers certified under the EU-US Data Privacy Framework rely on the European Commission's adequacy decision of July 2023. Transfers to the others rely on Standard Contractual Clauses approved by the European Commission, with supplementary measures where necessary. The table above shows the mechanism for each provider. You may request a copy of the safeguards in place by contacting us at privacy@delvaris.com.

How Long Do We Store Your Data?

• Contact form submissions and our email correspondence with you: up to 24 months from the date of collection.
• Records of your cookie choice: 3 years, so that we can demonstrate your consent.

You can ask us to delete your data sooner at any time, unless we are required by law to keep it.

Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: you may request a copy of the personal data we hold about you (Art. 15).
• Right to rectification: you may request correction of inaccurate or incomplete data (Art. 16).
• Right to erasure: you may request deletion of your personal data (Art. 17).
• Right to restriction of processing: you may request that we restrict how we process your data (Art. 18).
• Right to data portability: you may request your data in a structured, commonly used and machine-readable format (Art. 20).
• Right to object: you may object to processing based on our legitimate interests (Art. 21).
• Right to withdraw consent: you may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)).

To exercise any of these rights, please contact us at privacy@delvaris.com. We will respond within one month (Art. 12(3)).

You also have the right to lodge a complaint with a supervisory authority. The competent authority for Delvaris OÜ is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). You may also lodge a complaint with the supervisory authority in your country of habitual residence or place of work.

Cookies

This website only uses cookies that are strictly necessary for it to work. They need no consent. We do not use analytics, marketing, advertising or social media cookies. The cookies we use are listed below.

Automated Decision-Making

We do not engage in automated decision-making or profiling as defined under GDPR Art. 22.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of it (Art. 33). Where the breach is likely to result in a high risk to you, we will also notify you without undue delay (Art. 34).

Contact Information

If you have any questions about this privacy policy or the processing of your personal data, please contact Marek Stark at privacy@delvaris.com.

Updates to This Privacy Policy

We may update this privacy policy from time to time. If we make material changes, we will announce them on this page before they take effect and update the date above.