Privacy
Policy.

1. Who we are

The controller of the personal data described in this notice is blinovit service OÜ, a private limited company registered in the Estonian Commercial Register on 8 September 2026 under registry code 17594156, with its registered office in Estonia, European Union.

You can reach us about anything in this notice at Blinovitservice1@inbox.eu or +372 5854 2311. Our entry in the official register is public and can be checked at ariregister.rik.ee.

We have not appointed a Data Protection Officer. Under Article 37 of the GDPR a DPO is mandatory only for public authorities, for organisations whose core activity is large-scale regular and systematic monitoring of individuals, or for large-scale processing of special categories of data. None of these apply to us, so privacy questions are handled directly by the company's management at the address above.

This notice covers our own processing: the website, enquiries sent through the contact form or by e-mail and telephone, and the client relationships that follow. When we build or maintain software for a client and that system contains personal data belonging to their users, we act as a processor on the client's written instructions under Article 28 of the GDPR — the client's own privacy notice governs that data, not this one.

2. What we collect

We collect only what a small engineering studio genuinely needs in order to answer, quote, build and invoice.

• Enquiry data — what you type into the contact form or send us by e-mail or telephone: your name, e-mail address, optional company name, optional phone number, the package you selected, the budget range you selected, your message, and the date and time it reached us.
• Client and contract data — the named contact person for a project, business contact details, our correspondence, the agreed scope, project documentation, and any access credentials you choose to give us for the duration of the work.
• Invoicing data — billing name and address, registry or VAT number where applicable, bank details, invoice lines and payment dates.
• Technical server log data — IP address, user agent, requested address, referring page, timestamp and response status. These records are created automatically by our hosting provider whenever any website is requested; we do not build visitor profiles from them.
• Preferences stored in your own browser — two keys in local storage, bs_motion (whether you switched animations off) and bs_cookie_choice (that you dismissed the cookie notice), plus bs_seen in session storage (that the opening animation has already played, which the browser discards when you close the tab). They stay on your device.

To be explicit: this site sets no advertising or analytics cookies, runs no tracking pixels, no session replay and no A/B tooling, and carries out no profiling. There is no automated decision-making that produces legal or similarly significant effects within the meaning of Article 22. We do not ask for and do not want special categories of personal data (Article 9) — please do not send health, biometric, political or similar information in an enquiry.

3. Why, and on what legal basis

Every purpose below is tied to a legal basis in Article 6(1) of the GDPR. Where we rely on legitimate interest, we have weighed our interest against your rights and freedoms; you can ask us for a summary of that assessment at any time.

Providing enquiry data is voluntary, but the form cannot work without a name, an e-mail address and a message — without them we have no way to understand the request or reply to it.

4. Cookies and local storage

This website does not set cookies of its own. What it stores is local storage, which is a different mechanism: unlike a cookie, a local storage entry is never attached to HTTP requests, so it is never transmitted to our server or to anyone else. It is readable only by this site, in this browser, on this device.

Clearing your site data removes both keys; nothing else about your visit is stored on your device. The Cookies Policy explains this in more detail and includes instructions for clearing site data in the common browsers.

5. Who else sees your data

We do not sell, rent or exchange personal data, and we never share it for advertising. Personal data reaches a third party only in the situations listed below.

• Our hosting and e-mail provider. Website files, server logs and the contents of our mailbox sit on infrastructure operated by a service provider engaged as a processor under a written agreement meeting Article 28 of the GDPR.
• Google Fonts. The typefaces on this site are loaded from fonts.googleapis.com and fonts.gstatic.com. That request is made by your browser directly, which means Google receives your IP address, your user agent and the address of the page being viewed. We consider it fair to state this plainly rather than bury it: if you would rather avoid it, block those two domains with a content blocker, a browser extension or your hosts file — the site remains fully readable with your system fonts. Google's own notice is at policies.google.com/privacy.
• Our accountant. Invoices and the supporting documents required by law are handled by an accounting service provider bound by confidentiality.
• Legal or debt-recovery advisers, only where a specific dispute or unpaid invoice makes it necessary.
• Public authorities, where a statutory obligation or a lawful order requires disclosure.

The contact form does not post your message to a third-party form service. Unless a server endpoint has been configured, the form simply opens your own mail application with the message prepared, so the data travels from your mailbox to ours and nowhere else.

6. International transfers

As a rule, personal data we control is stored and processed inside the European Union or the wider European Economic Area. Where a processor does transfer personal data outside the EEA, that transfer is covered either by an adequacy decision of the European Commission or by the Standard Contractual Clauses adopted in Commission Implementing Decision (EU) 2021/914, together with any additional technical and organisational measures the transfer requires.

The Google Fonts request described above is the one routine case where data (your IP address and user agent) may leave the EEA. You can ask us for a copy of the transfer safeguards that apply to any processor we use.

7. How long we keep it

We delete or anonymise personal data once the purpose it was collected for has ended and no legal obligation requires us to hold it any longer.

Our financial year runs from 1 January to 31 December, so the accounting period is counted from the end of the year in which the document was issued.

8. Your rights

Under the GDPR you can ask us at any time to:

• Give you access to the personal data we hold about you and a copy of it (Art. 15).
• Correct anything inaccurate or incomplete (Art. 16).
• Erase your data where we no longer have a basis to keep it (Art. 17).
• Restrict processing while a dispute about accuracy or lawfulness is resolved (Art. 18).
• Receive your data in a portable format, where processing is based on consent or a contract and carried out by automated means (Art. 20).
• Object to processing based on our legitimate interest, on grounds relating to your situation (Art. 21).
• Withdraw consent at any time, where consent was the basis — this does not affect the lawfulness of what was done before the withdrawal (Art. 7(3)).
• Not be subject to solely automated decision-making with legal or similarly significant effects (Art. 22) — we carry out none.

Write to Blinovitservice1@inbox.eu with "Privacy" in the subject line. We answer within one month as required by Article 12(3). If a request is unusually complex we may extend that by up to two further months, and we will tell you the reason within the first month. Requests are free of charge; we may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive. Where we cannot identify you with reasonable certainty, we may ask for additional information to confirm who you are before disclosing anything.

Complaints

If you believe we have handled your data unlawfully, please tell us first — most problems are faster to fix directly. You also have the right to lodge a complaint with the Estonian supervisory authority:

• Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
• Tatari 39, 10134 Tallinn, Estonia
• info@aki.ee · +372 627 4135
• www.aki.ee

If you live or work in another EU or EEA country, you may also complain to the supervisory authority there.

9. Security

We keep the security measures proportionate to a small studio that handles client systems, and we do not pretend to more than we operate:

• The website and every form on it are served over TLS (HTTPS).
• Access to mailboxes, repositories and servers is personal, least-privilege, and protected with strong authentication and multi-factor authentication wherever the service supports it.
• Client production credentials are never stored in plain text — they are kept in a password manager, used only for the agreed work, and handed over or rotated at the end of a project.
• Development, staging and production environments are kept separate, and test systems are not filled with real personal data where synthetic data will do.
• Systems and dependencies are kept updated, and backups are taken for the systems we operate.
• Everyone who works with us is bound by a written confidentiality obligation.

If a personal data breach nevertheless occurs, we will notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of it as required by Article 33, unless the breach is unlikely to result in a risk to individuals, and we will inform the affected people without undue delay where Article 34 requires it.

10. Children

Our services are aimed at businesses and organisations, and this website is not directed at children under 16. We do not knowingly collect personal data from children, and we do not rely on a child's consent for anything. If you believe a child has sent us personal data, write to Blinovitservice1@inbox.eu and we will delete it.

11. Changes to this notice

We will update this notice when our processing changes — for example if we add a form endpoint, self-host the fonts, or start using a new processor. The date at the top of the page always shows the current version. Where a change is material and affects data we already hold, we will say so clearly on this page and, where the law requires it, contact you directly. Previous versions are available on request.

12. Contact

Questions, corrections, requests or complaints about personal data all go to the same place:

• blinovit service OÜ, registry code 17594156
• Registered office in Estonia, European Union
• E-mail: Blinovitservice1@inbox.eu
• Phone: +372 5854 2311
• Register entry: ariregister.rik.ee

Please put "Privacy" in the subject line so the request is routed correctly. We reply to privacy requests within one month, and usually within one business day.