Privacy Policy

1. Who is responsible for your data

The controller of your personal data is:

• CAVIC Digital OÜ, a private limited company registered in the Estonian Business Registry under code 17418436
• Registered office: Ahtri tn 12, 10151 Tallinn, Harju County, Estonia
• Email for privacy matters: privacy@cavicdigital.com (general: info@cavicdigital.com)

We are not required to appoint a Data Protection Officer. Privacy requests are handled directly by our management.

2. What data we process

We collect only what we need for the purposes described below:

• Contact data you send us: name, company, job title, email address, phone number and the content of your message.
• Business relationship data: information exchanged while preparing or performing an engagement (meeting notes, proposals, contracts, invoices).
• Technical data: when you visit the website, our hosting provider automatically processes your IP address, browser type, requested pages, date and time, and referrer in server logs, for security and delivery of the site.

We do not use advertising, tracking or analytics cookies, and we do not build user profiles. Fonts and visual assets are served from our own domain, so no third-party content provider receives your data when you browse.

3. Purposes and legal bases

We process personal data for the following purposes, each with a legal basis under Article 6 GDPR:

• Responding to your inquiry and preparing a proposal: steps prior to entering into a contract (Art. 6(1)(b)) or our legitimate interest in answering business inquiries (Art. 6(1)(f)).
• Delivering contracted services and managing the client relationship: performance of a contract (Art. 6(1)(b)).
• Accounting, tax and other statutory obligations: legal obligation (Art. 6(1)(c)), including the Estonian Accounting Act.
• Operating, securing and improving the website: legitimate interest in a secure and functional website (Art. 6(1)(f)).
• Occasional business updates to existing clients or contacts: legitimate interest (Art. 6(1)(f)) or your consent (Art. 6(1)(a)); you can opt out at any time.
• Establishing, exercising or defending legal claims: legitimate interest (Art. 6(1)(f)).

4. Contact form and email

When you submit the contact form on this website, the details you enter (name, email address, company, company size, areas of interest and your message) are sent to us by email through our email delivery provider, Resend (Resend, Inc., United States, sending from its EU region in Ireland), which acts as our processor. The website itself does not store your message. We also send a one-time confirmation to the email address you entered, in the language of the form; it does not contain your message and is not marketing.

Digital business cards hosted on this website (for example cavicdigital.com/mc) include a short message form. Messages sent through a card are delivered by the same provider directly to the email address of the person named on that card, who uses them to reply to you.

To keep the forms free of spam we use a hidden check field and short-term limits on repeated submissions, based on your IP address and held only in temporary memory. We do not use CAPTCHAs, tracking pixels or marketing automation on these forms.

5. Who receives your data

We do not sell personal data. We share it only where necessary, with:

• Service providers acting as processors under Article 28 GDPR: website hosting and content delivery, email delivery for our contact forms (Resend), email and productivity services, accounting and IT security providers.
• For messages sent through a digital business card: the person named on that card.
• Professional advisers (lawyers, auditors, accountants) bound by confidentiality.
• Public authorities, where required by law.

6. International transfers

We prefer providers that process data within the European Economic Area. Where a provider processes data outside the EEA, we ensure an adequate level of protection, through an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework where the recipient is certified) or the European Commission’s Standard Contractual Clauses, together with supplementary measures where needed.

7. How long we keep data

• Inquiries that do not lead to an engagement: up to 24 months after our last contact.
• Client and contract data: for the duration of the relationship and up to 7 years afterwards, in line with Estonian accounting and limitation-period rules.
• Accounting records: 7 years, as required by the Estonian Accounting Act.
• Delivery logs at our email delivery provider: kept for a limited period under the provider’s standard retention settings.
• Server logs: typically no longer than 30 days, unless needed to investigate a security incident.

8. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy;
• rectify inaccurate or incomplete data;
• have your data erased, where the legal conditions are met;
• restrict processing;
• data portability;
• object to processing based on legitimate interest, including direct marketing at any time;
• withdraw consent at any time, without affecting earlier processing.

To exercise your rights, email privacy@cavicdigital.com. We respond within one month. You also have the right to lodge a complaint with a supervisory authority. In Estonia, this is the Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee. You may also contact the authority of your EU country of residence.

9. Data we process on behalf of clients

When we implement AI systems or operate FiMaOS for a client, we usually process that client’s data as a processor. In that case, the client is the controller and the processing is governed by a Data Processing Agreement under Article 28 GDPR, which defines the subject matter, security measures, sub-processors and deletion obligations. This policy covers only data for which CAVIC Digital is the controller.

10. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, including profiling.

11. Security

We apply appropriate technical and organisational measures (encryption in transit, access control and least privilege, multi-factor authentication, logging and supplier due diligence) to protect personal data against loss, misuse and unauthorised access.

12. Cookies and similar technologies

This website does not set tracking or marketing cookies and does not require a cookie banner. If we ever introduce non-essential cookies or analytics, we will ask for your consent beforehand, as required by the ePrivacy rules, and update this policy.

13. Changes to this policy

We may update this policy to reflect changes in law or in our services. The current version is always published on this page, with its date of last update.