OSMYKA OÜ ("we", "us", or "our") is committed to protecting the privacy, confidentiality, and security of your personal data. This Privacy Policy explains how we collect, process, share, and protect personal data in compliance with the EU General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).

1. Scope and Application

This Privacy Policy applies to:

• Visitors and users of our public website (osmyka.com).
• Prospective and active B2B clients, business owners, and technical partners.
• Users of our demonstration platforms, custom CRM systems, online booking engines (e.g. AutoBook Engine, AutoService CRM), and related digital software tools developed or hosted by Osmyka OÜ.

2. Categories of Personal Data We Collect

We process personal data strictly to the extent necessary to provide our digital services, fulfill contractual commitments, and comply with statutory obligations:

• Contact & Identification Data: Full name, business email, phone number, company name, position, and legal entity details.
• Inquiry & Consultation Data: Information submitted via contact forms, project briefs, repair shop workflow requirements, and email correspondence.
• Technical & Telemetry Data: IP address, device identifier, browser type and version, access timestamps, referral URLs, and security audit logs.
• Billing & Contract Data: Invoicing history, transaction IDs, tax numbers, and payment status records (payment transactions are processed via certified third-party payment gateways; we do not store raw credit card numbers).

3. Purposes and Legal Bases for Processing (GDPR Art. 6)

4. Data Sharing and Third-Party Processors

We do not sell, rent, or monetize your personal data. We engage vetted service providers (Data Processors) acting strictly under Data Processing Agreements (DPAs) compliant with GDPR Article 28:

• Cloud Infrastructure & Edge Delivery: Cloudflare (EU edge network), Hetzner Online, or AWS (EU data centers).
• Email & Communication: Google Workspace and authenticated SMTP relays.
• Payment & Invoicing: Certified payment institutions and Estonian banking links.
• Public Authorities: Estonian Tax and Customs Board or law enforcement solely when mandated by statutory law.

5. International Data Transfers

All primary databases and client files are stored within the European Economic Area (EEA). In the event that any data transfer occurs outside the EEA, we implement strict safeguards in accordance with Chapter V of the GDPR (including EU Standard Contractual Clauses — SCCs — or European Commission adequacy decisions).

6. Data Retention Periods

• Consultation Requests: Retained for up to 24 months from the last contact, or until pre-contractual discussions conclude.
• Contractual & Project Data: Retained for the duration of the service agreement plus the statutory limitation period for civil claims (3 to 10 years).
• Accounting & Tax Documents: Invoices, transaction logs, and receipts are retained for 7 years pursuant to § 12 of the Estonian Accounting Act (Raamatupidamise seadus).
• Technical & Security Logs: Retained for up to 12 months for diagnostic and security auditing purposes.

7. Your Data Subject Rights under GDPR

As a data subject located in the EEA, you possess the following enforceable rights:

• Right of Access (Art. 15): Request confirmation and a copy of your personal data processed by us.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete records.
• Right to Erasure (Art. 17): Request deletion of your data where legal retention grounds no longer apply.
• Right to Restriction of Processing (Art. 18): Request temporary restriction of data processing.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing carried out under legitimate interest grounds.
• Right to Withdraw Consent: Withdraw previously granted consent at any time without retroactive invalidation.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 calendar days.

8. Cookies and Storage

Our website uses essential technical cookies and local tokens required for core layout rendering, security, and responsive UI state. We do not deploy invasive marketing trackers or cross-site advertising cookies without explicit consent.

9. Supervisory Authority

If you believe our data processing violates applicable data protection regulations, you have the right to lodge a formal complaint with the Estonian supervisory authority:

10. Contact Us

For any privacy inquiries or legal notices, please write to:

OSMYKA OÜ
Registry code: 17585915
Heina tn 33, Põhja-Tallinna linnaosa, 10412 Tallinn, Estonia
Email: [email protected]
Website: osmyka.com