Privacy Policy

1. Data Controller

The data controller for the processing of personal data described in this Privacy Policy is:

We comply with the General Data Protection Regulation (GDPR) and applicable Estonian data protection laws.

2. Information We Collect

2.1 Information You Provide

When you contact us or book a consultation, we collect:

• Name
• Email address
• Company name
• Any additional information you choose to provide in your message

2.2 Automatically Collected Information

We use Vercel Analytics, a privacy-focused analytics service that collects anonymized usage data. This includes:

• Page views and navigation patterns
• Referring websites
• General geographic location (country level)
• Device type and browser information

Vercel Analytics does not use cookies and does not collect personally identifiable information.

3. Our Role in Client Projects

When providing our market intelligence services, we compile business contact information from publicly available sources on behalf of our clients. In these activities:

• We act as a data processor carrying out research activities on the instructions of our clients
• Our clients are the data controllers who determine the purposes and means of any subsequent processing of the compiled data
• The data we compile consists of publicly available business contact information intended for business-to-business communications
• Upon delivery, the client assumes full responsibility as data controller for any use of the deliverables

If you believe your business contact information has been included in a deliverable to one of our clients, please contact us at info@netspore.ee. We will assist in identifying the relevant client (where permitted) so you may exercise your data subject rights with the appropriate controller.

4. How We Use Your Information

We use the information we collect to:

• Respond to your inquiries and communicate with you
• Provide and deliver our services
• Schedule and manage consultations via Calendly
• Improve our website and services
• Comply with legal obligations

5. Legal Basis for Processing

Under GDPR, we process personal data based on the following legal grounds:

• Legitimate interests (Article 6(1)(f)): For business-to-business communications, responding to inquiries from business contacts, and service delivery. Our legitimate interest is in conducting our business operations and providing services to clients. We have assessed that this processing does not override the rights of data subjects, particularly as we only process business contact information in a B2B context where such processing is reasonably expected.
• Contractual necessity (Article 6(1)(b)): To provide services you have requested and to perform our contractual obligations
• Legal obligation (Article 6(1)(c)): Where we are required to process data to comply with applicable laws

We do not rely on consent as our primary legal basis for processing B2B contact data, as legitimate interests provides a more appropriate basis for business communications. You may object to processing based on legitimate interests at any time by contacting us.

6. Data Sharing and Third Parties

We may share your information with:

• Service providers: Including scheduling tools, analytics services, and data research tools that help us deliver our services. These providers process data on our behalf under appropriate data processing agreements.
• Legal requirements: When required by law, court order, or to protect our legal rights

We do not sell your personal information to third parties.

7. International Data Transfers

Some of our service providers operate outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions where applicable
• Other legally recognized transfer mechanisms under GDPR Chapter V

8. Data Retention

We retain personal data for the following specific periods:

• Contact form and communication data: 24 months from the date of last contact or the end of the business relationship, whichever is later
• Client project data: Deleted within 30 days after project delivery to the client
• Analytics data: Retained in anonymized, non-identifiable form by our analytics provider
• Invoicing and financial records: As required by Estonian accounting and tax law (typically 7 years)

After the applicable retention period, data is securely deleted or anonymized.

9. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Access (Article 15): Request a copy of the personal data we hold about you
• Rectification (Article 16): Request correction of inaccurate or incomplete data
• Erasure (Article 17): Request deletion of your personal data where there is no compelling reason for continued processing
• Restriction (Article 18): Request that we limit how we use your data
• Portability (Article 20): Request your data in a structured, commonly used, machine-readable format
• Objection (Article 21): Object to processing based on legitimate interests

To exercise any of these rights, please contact us at info@netspore.ee. We will respond to your request within one month, as required by GDPR. In complex cases, this period may be extended by two further months, in which case we will inform you of the extension and the reasons for it.

10. Data Subject Requests Regarding Client Deliverables

If you believe your information was included in a deliverable provided to one of our clients:

• Contact us at info@netspore.ee with details about your concern
• We will make reasonable efforts to identify whether your data was processed and, if so, which client received it
• We will notify the relevant client of your request, as they are the data controller responsible for responding to data subject rights requests
• We will provide reasonable assistance to facilitate your request, though the client bears primary responsibility for responding as the controller

Please note that once data has been delivered to a client, the client becomes the data controller for that data and is responsible for handling any data subject requests related to their use of that data.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, in accordance with GDPR Article 32.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

13. Complaints

If you have concerns about how we process your personal data, please contact us first at info@netspore.ee so we can try to resolve your concern.

You also have the right to lodge a complaint with a supervisory authority. The relevant authority in Estonia is:

If you are located in another EU member state, you may also lodge a complaint with your local supervisory authority.