Privacy policy

Who we are

Mazos OÜ, Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Estonia (VAT EE102598397), is the controller of personal data processed through this website. Contact for privacy questions: [email protected].

Summary

We only collect what is needed to answer you and to keep this website secure. There are no visitor accounts, comments, analytics, advertising or tracking cookies, and we never sell your data or use it for marketing without asking you first.

What we collect, why, and on what legal basis

• When you use the contact form: your name, email address, company (optional), the topic you choose and your message. Purpose: to read and reply to your message and, if you ask, to prepare a proposal. Legal basis: your consent, given with the checkbox on the form (Article 6(1)(a) GDPR); where your message is about engaging our services, also steps you ask us to take before entering into a contract (Article 6(1)(b)).
• When you email us: your email address, name and whatever you include in the message. Purpose: to reply. Legal basis: our legitimate interest in answering correspondence (Article 6(1)(f)); where your message is about engaging our services, also steps you ask us to take before entering into a contract (Article 6(1)(b)).
• Technical data recorded with a form message: your IP address, browser type and the date and time you sent it. Purpose: to detect and investigate spam, abuse and fraudulent messages. Legal basis: our legitimate interest in keeping the website and our inbox secure (Article 6(1)(f)).
• Website access logs: every visit is logged by our web server with your IP address, the date and time, the page requested, the referring page and your browser type. Purpose: security, preventing attacks and fixing faults. Legal basis: legitimate interest (Article 6(1)(f)).
• Records we must keep by law if you become a client: contracts, invoices and accounting records, kept as the Estonian Accounting Act requires. Legal basis: legal obligation (Article 6(1)(c)).

Please do not send sensitive information (for example health data) through the form. Giving us your name and email address is not a legal or contractual requirement, but without them we cannot reply.

Security and spam protection

The website is delivered through Cloudflare, which protects it against attacks and abuse and filters automated traffic. The form uses Cloudflare Turnstile, which checks that a real person is submitting it by processing technical information about your browser and connection; it is used only for that check and not for advertising or tracking (see Cloudflare’s privacy policy). If you visit the administration area, Cloudflare may show a short security check. These checks do not lead to any decision about you beyond blocking automated abuse.

Cookies

This website does not set any cookies for visitors and uses no analytics, advertising or social-media tracking. Fonts and all other files are served from our own server, so visiting the site does not contact Google or other third parties. Only site administrators who log in receive strictly necessary login and security cookies. Because no non-essential cookies are used, no cookie banner is needed.

Who processes your data on our behalf

We use the following service providers, which act as processors under written terms and may only use the data to provide their service to us:

• OVHcloud: hosts the server that runs this website, in a data centre in the United Kingdom.
• Cloudflare, Inc.: content delivery, DNS, security and spam protection (Turnstile); a global network operated from the United States.
• Zoho Corporation (Zoho Mail): our email, which receives contact form messages; our mail account is hosted in the United States.
• Dropbox: stores our encrypted website backups. Backups are encrypted on our server before upload, so Dropbox cannot read them.

We may also disclose data where the law requires it (for example to a court or regulator) or to professional advisers bound by confidentiality. We do not sell or rent personal data.

International transfers

Some data is processed outside the European Economic Area. The United Kingdom, where our server is located, benefits from a European Commission adequacy decision. Transfers to the United States are protected by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission’s Standard Contractual Clauses. You can ask us for details of these safeguards.

How long we keep it

• Copies of form messages in the website administration (including the IP address, browser and time): deleted automatically after 12 months.
• Emails and form messages in our mailbox: as long as needed to deal with your enquiry, and no longer than 2 years after our last contact unless you become a client, in which case client and accounting records are kept for seven years, as the Estonian Accounting Act requires.
• Web server access logs: deleted automatically after 30 days.
• Encrypted off-site backups of the website: kept for 12 weeks, then deleted.

Your rights

Under the EU General Data Protection Regulation (GDPR) you have the right to:

• access the personal data held about you and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict how it is used;
• object to processing based on legitimate interests;
• receive data you provided in a portable format;
• withdraw consent at any time, without affecting replies already sent.

To use any of these rights, email [email protected]. We will reply within one month, free of charge, and may ask you to confirm your identity first. No decisions about you are made by automated means, and we do not use your data for profiling.

Complaints

We would like the chance to resolve any concern first, so please contact us. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee, or to the data protection authority in the EU country where you live or work.

Other websites

This website links to other websites, for example to professional profiles and certification bodies. They have their own privacy policies; our notice does not cover them.

Children

This website is not aimed at children, and we do not knowingly collect data from anyone under 16.

Changes to this notice

We will update this notice when our practices change. Last updated: 9 October 2026.