1. Who we are
This website (exosest.eu) is operated by Exosvantax OÜ, a private limited company registered in the Republic of Estonia (the "Company", "we", "us"). We are the data controller for personal data processed through this website. Contact: hello@exosest.eu. Full company details are on the Imprint page.
2. What data we collect
2.1 Data you give us
- Contact requests — name, email address, company name, chosen package and the description of your service you send via our contact form or by email.
- Project data — information about your business, brand assets and service descriptions you share with us during a project.
- Billing data — company name, address, VAT number and payment details needed to issue invoices.
2.2 Data collected automatically
- Technical data — IP address, browser type, device type, referring page, pages visited and timestamps, processed by our hosting provider for security and to serve the site.
- Cookies and similar technologies — see our Cookie Policy. Analytics and marketing cookies are only set with your consent.
3. Why we process your data (legal bases)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to your enquiry and preparing a quote | Pre-contractual steps at your request (Art. 6(1)(b)) |
| Delivering diagram design services and communicating about a project | Performance of a contract (Art. 6(1)(b)) |
| Invoicing, accounting and tax reporting | Legal obligation (Art. 6(1)(c)) — Estonian Accounting Act |
| Keeping the website secure and preventing abuse | Legitimate interest (Art. 6(1)(f)) |
| Website analytics and marketing cookies | Consent (Art. 6(1)(a)) — withdraw any time via "Cookie settings" in the footer |
| Showing finished work in our portfolio | Consent (Art. 6(1)(a)) — we always ask first |
4. How long we keep data
- Enquiries that do not lead to a project: up to 12 months after our last contact.
- Project and contract data: for the duration of the project and 3 years thereafter (limitation period for claims).
- Accounting records including invoices: 7 years, as required by Estonian law.
- Cookie consent record: 12 months, stored in your browser.
5. Who we share data with
We do not sell personal data. We share it only with processors who help us run the business, under data processing agreements: website hosting and content delivery (Cloudflare), email provider, accounting software and our accountant, and — when you consent — analytics providers. Where a processor is outside the EU/EEA, transfers are protected by EU Standard Contractual Clauses or an adequacy decision.
6. Your rights
Under the GDPR you have the right to access, rectify or erase your personal data, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting prior processing. To exercise any right, email hello@exosest.eu. We reply within one month.
You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the supervisory authority in your country of residence.
7. Security
The website is served over HTTPS. Project files are stored in access-controlled cloud storage with two-factor authentication. We limit data access to the people who need it to deliver your project.
8. Children
Our services are aimed at businesses. We do not knowingly collect data from anyone under 16.
9. Changes to this policy
We may update this policy as our services or the law change. The date at the top shows the current version. Material changes will be highlighted on this page.
This policy was prepared as a working draft for owner review. Exosvantax OÜ should confirm its processors, retention periods and registered details before publication.