Privacy Policy

Delvaris OÜ (reg. no. 17464650, VAT: EE102967232), Tiskrevälja tn 59-12, 13516 Tallinn, Estonia ("we," "us," "our") is the data controller responsible for your personal data. We have not appointed a Data Protection Officer as our core activities do not require one under GDPR Art. 37. For data protection inquiries, please contact Marek Stark at privacy@delvaris.com.

This privacy policy explains how we collect, use, store, and share your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). We are committed to protecting your privacy and being transparent about our data practices.

We do not collect sensitive personal data (special category data), such as health information, religious beliefs, or political opinions. We collect the following personal data:

• Name
• Email address
• IP address

We collect your data in the following ways:

• Through forms you fill out on our website (delvaris.com), such as inquiry emails.
• Through cookies placed on your device. Non-essential cookies (analytics, marketing, and preference cookies) are only placed after you have given explicit consent through our cookie banner. You can manage or withdraw your cookie preferences at any time through the "Cookie Settings" link in the website footer or via your browser settings.

We process your personal data only when we have a valid legal basis under GDPR Art. 6. The specific legal basis depends on the processing purpose:

• Responding to your inquiries via email — Art. 6(1)(b) (pre-contractual measures at your request).
• Sending marketing communications — Art. 6(1)(a) (your consent). You may withdraw consent at any time.
• Website analytics via Google Analytics — Art. 6(1)(a) (your consent via the cookie banner).
• Customer surveys — Art. 6(1)(a) (your consent).
• Necessary cookies for website functionality — Art. 6(1)(f) (our legitimate interest in providing a functioning website).

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, modification, distribution, or destruction. Only authorized personnel have access to your data.

We use the collected data to:

• Provide relevant information about our services.
• Improve website functionality and analyze traffic patterns through Google Analytics.
• Send marketing communications (only with your explicit consent).
• Conduct customer surveys to improve our services (only with your consent).

We share personal data with Google Analytics for analytical purposes. We have a data processing agreement (DPA) with Google to ensure data protection. Google may process this information in connection with other Google services.

We do not share your data with other third parties beyond what is necessary to fulfill the purposes described in this policy. A current list of our data processors is available upon request at privacy@delvaris.com.

Google Analytics data may be transferred to the United States. Google LLC participates in the EU-US Data Privacy Framework, which has been granted an adequacy decision by the European Commission (July 2023). Where the Data Privacy Framework does not apply, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, together with supplementary measures where necessary, to ensure an adequate level of protection for your data.

You may request a copy of the safeguards in place by contacting us at privacy@delvaris.com.

We retain your personal data for up to 2 years from the date of collection, or until you request its deletion, whichever comes first. The 2-year retention period is chosen to enable continuous improvement of our services and to handle customer inquiries. Criteria that may influence storage times include legal requirements, ongoing customer relationships, and the applicable legal basis for processing.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — You may request a copy of the personal data we hold about you (Art. 15).
• Right to rectification — You may request correction of inaccurate or incomplete data (Art. 16).
• Right to erasure — You may request deletion of your personal data (Art. 17).
• Right to restriction of processing — You may request that we restrict how we process your data in certain circumstances (Art. 18).
• Right to data portability — You may request your data in a structured, commonly used, and machine-readable format (Art. 20).
• Right to object — You may object to processing based on our legitimate interests (Art. 21).
• Right to withdraw consent — You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)).

To exercise any of these rights, please contact us at privacy@delvaris.com. We will respond to your request within 30 days.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for Delvaris OÜ is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). You may also lodge a complaint with the supervisory authority in your country of habitual residence or place of work.

Our website uses cookies. Non-essential cookies are only placed after you have given explicit consent through our cookie banner. You can manage your preferences at any time via the "Cookie Settings" link in the footer or by adjusting your browser settings. We use the following categories of cookies:

• Necessary cookies — Essential for the website to function. These are always active and do not require consent.
• Analytics cookies — Help us understand how visitors interact with the website (e.g., Google Analytics). Placed only with your consent.
• Marketing cookies — Used to show relevant advertisements and measure campaign effectiveness. Placed only with your consent.
• Preference cookies — Remember your settings and preferences for future visits. Placed only with your consent.

We do not engage in automated decision-making or profiling as defined under GDPR Art. 22.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of the breach (Art. 33). Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay (Art. 34).

If you have any questions or concerns regarding this privacy policy or the processing of your personal data, please contact Marek Stark at privacy@delvaris.com.

We may update this privacy policy from time to time. If we make material changes, we will inform you via email or a prominent notification on our website before the changes take effect. The "Last updated" date at the top of this policy indicates when it was last revised.