Privacy policy

Effective 2026-05-22

Brandilabor OÜ ("we") collects and processes your personal data only to respond to your enquiry and provide our services. This document explains exactly what data we collect and how we use it.

1. Data controller

Brandilabor OÜ
Email: info@brandilabor.ee

2. What data we collect

Through the enquiry form

Name - so we know how to address you
Email - so we can reply
Phone (optional) - if you prefer to talk by phone
Message - the content of your enquiry
Selected services (if you use the "Add to enquiry" feature in the price list)
IP address - for security and spam prevention (deleted within 90 days)

Newsletter subscription

Email and name - only if you tick "I want to receive the newsletter"
Confirmation (double opt-in) - by clicking the confirmation link in your email
You can unsubscribe at any time - every newsletter ends with an "unsubscribe" link

Technical data (not sent to the server)

Your browser stores locally in localStorage:

bl_cart_v1 - the services you selected (so they are not lost when the page reloads)
bl_dino_best - your best game score (simply a local save)

This data never reaches our server and you can delete it in your browser settings.

3. Legal basis

Consent (GDPR Art. 6(1)(a)) - newsletter subscription
Performance of a contract (GDPR Art. 6(1)(b)) - responding to enquiries and providing services
Legitimate interest (GDPR Art. 6(1)(f)) - security, spam prevention

4. Retention periods

Enquiries - up to 2 years (for statistics and possible further contact)
Newsletter subscribers - until you unsubscribe
IP addresses in logs - 90 days
Audit log - up to 12 months

Free website sample

If you order a free website sample, we use your name, email, phone (if provided), the public content of the pages you linked, your logo and the thoughts you wrote only to create the sample and notify you about it. The legal basis is your consent.

An unconfirmed request is deleted after 48 hours.
The sample and all related data are deleted automatically 7 working days after the sample is sent, unless you have expressed interest in working together or ordered a new sample.
After deletion we keep only an irreversible hash of your email and link for 90 days, so the same company can receive a free sample once within 90 days. Your email cannot be recovered from the hash.
On the sample page we record when and how many times the sample was opened.

5. Sharing data with third parties

We do not sell or share your data with marketing partners. We use the following services:

Veebimajutus.ee (Elkdata) - hosting, email delivery (EU)
Google Fonts - font loading (sees your IP in the browser request). If this bothers you, block Google Fonts with a browser extension.

We DO NOT use: Google Analytics, Facebook Pixel, Hotjar or any other user tracking tools.

6. Your rights (GDPR)

You have the right to:

Access (Art. 15) - get a copy of your data
Rectification (Art. 16) - have incorrect information corrected
Erasure (Art. 17) - the "right to be forgotten"
Restriction of processing (Art. 18)
Data portability (Art. 20) - JSON export
Object (Art. 21)
Lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee)

To exercise your rights, write to us at info@brandilabor.ee. We reply within 30 days.

7. Security

All data is stored on servers in Estonia / the EU (Veebimajutus.ee)
Logins are password-protected; session cookies are HttpOnly + Secure (HTTPS)
Rate limiting and a honeypot protect against spam
An audit log of all actions
Data is deleted or anonymised once the retention period ends

8. Changes

If we change this document in a significant way, we will notify newsletter subscribers by email. The version and date are at the top of the page.