1. Data controller
The controller is Difograaf OÜ, registry code 10964911, P. Süda tn 1, Tallinn 10118, Estonia. For privacy enquiries or rights requests, contact varjunik366@inbox.eu or +372 5616 7055.
2. Data we collect
The enquiry form asks for your name, email, client type, selected service and message. Telephone, site location or cadastral reference and estimated area are optional. Property information is personal data when linked to an identifiable person.
Do not send personal identification numbers, identity-document copies, payment-card data or sensitive personal information through the form. Calculator entries stay in the browser unless you explicitly add them to an enquiry and send it. Hosting and form services may process IP address, request time, browser technical data and errors for delivery and security.
3. Purposes and legal bases
- Answering enquiries, reviewing sites and preparing quotations: steps at your request before entering a contract (GDPR Article 6(1)(b)).
- Delivering services and contractual communications: contract performance (Article 6(1)(b)). Business-contact data may be processed under the legitimate interest in managing the business relationship (Article 6(1)(f)).
- Accounting, tax and other legal duties: legal obligation (Article 6(1)(c)).
- Website security, spam prevention and the defence of legal claims: legitimate interests (Article 6(1)(f)), balanced against individual rights and reasonable expectations.
The form checkbox acknowledges reading this notice. It is not marketing consent. Submitting the form does not subscribe you to a newsletter. We do not use automated decision-making or profiling.
4. Service providers and transfers
The technical website and enquiry-form provider is Netlify, Inc. (USA). This website is prepared to use Netlify Forms. Correspondence is also processed by the provider of the inbox.eu email service used for the public contact address. Accounting and legal support providers may receive only the information required for their tasks.
We do not sell personal data. Necessary data is shared with service providers and with competent authorities when legally required. Processing outside the European Economic Area must have a valid transfer mechanism, such as an applicable European Commission adequacy decision or appropriate standard contractual clauses. Providers and their settings are checked before publication and when changed.
5. Retention and security
Enquiries that do not lead to a contract are normally retained for up to 12 months after the last substantive contact. Contract and accounting records are retained as required by applicable law; source accounting documents are generally retained for seven years after the end of the financial year in which the transaction was recorded. Relevant data may be retained for the legally permitted period to resolve or defend a claim.
Access is limited by role, HTTPS is used and appropriate provider security settings are required. No transmission is completely risk-free. Data breaches are reported where legally required.
6. Your rights
You may request access, correction, erasure, restriction and, where applicable, portability. You may object to processing based on legitimate interests. These rights are not absolute: records required by accounting law, for example, cannot always be deleted.
We normally respond within one month. Complex requests may be extended as permitted by law. Identity is checked proportionately where necessary. You can complain to the Estonian Data Protection Inspectorate or the competent authority in your country of residence.