Privacy policy
Everything we store about you and why. No fog — each line describes what the server actually does.
Last updated
Who processes the data
- Controller
- Prism Hooldus OÜ
- Registry code
- 16894703
- Address
- Läänemere tee 62, 13914 Tallinn, Eesti
- info@visualweb.ee
- Phone
- +372 5368 4587
VisualWeb is a trade name of Prism Hooldus OÜ, not a separate company. We have no data protection officer — at our scale the law does not require one.
Write to info@visualweb.ee about anything on this page. We normally answer within one working day; the law allows us up to a month.
When you send an enquiry
The form asks for four things: name, email, phone and what you need. Company name and package are optional.
Alongside it we store the language version, the page you filled the form on, what brought you here (a search engine, a link from another site, a campaign tag), your IP address and your browser identifier.
The IP address and browser identifier are there because of spam. Without them a bot fills the form a thousand times overnight and real enquiries drown in the noise.
Basis: your own request to be contacted, i.e. pre-contractual steps (GDPR art. 6(1)(b)). For spam filtering, also our legitimate interest in keeping the form usable (art. 6(1)(f)).
When you order and pay
An order keeps: what you ordered, what it cost, your name and email, company name and registry code if you filled them in, phone, the free text you wrote, and whether you asked us to start immediately.
We do not hold card details and never will. The card number, expiry and security code go from your browser straight to Stripe — they never reach our server. All we get back is a payment reference and whether it succeeded.
Basis: the contract (art. 6(1)(b)) and our accounting obligation (art. 6(1)(c)). For fraud prevention, legitimate interest (art. 6(1)(f)).
When you join the newsletter
We store the email address, the language, the page you signed up from, the IP address and the browser identifier.
We do not sell or trade the address. You can leave at any time — write to info@visualweb.ee and we delete it the same working day.
Basis: your consent (art. 6(1)(a)), which you can withdraw whenever you like.
How long we keep it
- Enquiry from the form
- 3 years from the day you sent it, then deleted automatically
- Newsletter address
- until you unsubscribe
- Order and invoice
- 7 years from the end of the financial year — required by the Estonian Accounting Act (§ 12(1))
- Order free text, phone, IP and browser identifier
- 12 months, then stripped from the order; only what an invoice needs to stand up is kept
- Web server log
- up to 10 days
- Spam-protection counter
- 24 hours
Who else sees it
We do not sell data and we do not hand it to ad networks. Outside our own systems it reaches only the parties the service cannot run without:
- Stripe
- payment. Stripe's main establishment in Europe is Irish (Stripe Technology Company, Limited); the US leg is covered by Stripe's EU-U.S. Data Privacy Framework certification.
- Cloudflare
- the bot check on our forms (Turnstile). Cloudflare relies on its EU-U.S. Data Privacy Framework certification.
- visitor statistics (Google Analytics) and our mailbox. Google LLC has certified that it adheres to the EU-U.S. Data Privacy Framework principles.
- Telegram
- the enquiry and order notification, so that your message is answered quickly. It contains your name, email, phone and what you wrote. Telegram's servers are outside the European Union and are covered by no adequacy decision; the basis is GDPR art. 49(1)(b).
- Our own server
- the site and the databases sit in Jõhvi, Estonia (FastVPS / CLOUD.DOG OÜ). We use no third-party database.
Your rights
You have the right to:
- receive a copy of everything we hold about you
- have wrong data corrected
- have data erased where it is no longer needed and no law requires us to keep it
- restrict or object to the processing
- take your data away in a machine-readable form
- withdraw consent — which does not make anything done beforehand unlawful
One email to info@visualweb.ee is enough for any of it. We will not ask for an identity document if the message comes from the same address you ordered or enquired from.
We make no automated decisions about you. There is no profiling.
Complaint to the supervisory authority
If you think we got it wrong, tell us first — most things are settled in one email. If that is not enough, you have the right to complain to the supervisory authority:
- Authority
- Andmekaitse Inspektsioon
- Address
- Tatari 39, 10134 Tallinn
- info@aki.ee
- Phone
- +372 627 4135
- Web
- www.aki.ee
If you live in another EU country, you may also go to the data protection authority of your own country.
Changes
When something changes — a new provider, a new field, a new period — we change this page and update the date at the top. Purchase and contract terms live on their own page: Terms of sale.
An earlier version is available on request.