Privacy policy

1. Who is responsible for your data

The controller of personal data processed through this website is:

A27A OÜ
Registry code: 14741823
VAT number: EE102165872
Address: Järveotsa tee 7-43, 13520 Tallinn, Haabersti linnaosa, Harju maakond, Estonia
Email: management@a27aou.com
Phone: +372 5523 8193

We have not appointed a data protection officer, as this is not required for our activities. All privacy questions can be sent to the email address above.

2. What data we collect

Enquiry data: your name, email address, phone number (optional), the content of your message and, if you used the route planner, the answers you selected.
Correspondence and engagement data: information you share with us by email, phone or in meetings, and the contact details of the people involved in an engagement.
Technical data: when you visit the website, our hosting provider automatically processes your IP address, browser type, the pages requested and the date and time of the request in server logs.
Consent choice: the privacy choice you make in the cookie banner, stored in your own browser.
Advertising measurement data (only with your consent): if you accept Microsoft Advertising (UET) cookies, identifiers stored in cookies and information about your visit, such as pages viewed and whether you arrived from one of our ads.

We do not ask for special categories of personal data. Please do not include such information in your message.

3. Why we use your data and on what legal basis

Purpose	Legal basis (GDPR)
Replying to your enquiry and preparing a proposal	Steps taken at your request before entering into a contract (Art. 6(1)(b)) and our legitimate interest in answering business enquiries (Art. 6(1)(f))
Carrying out a consulting engagement	Performance of a contract (Art. 6(1)(b))
Keeping accounting records and invoices	Legal obligation under Estonian law (Art. 6(1)(c))
Keeping the website secure and working (server logs)	Legitimate interest in operating a secure website (Art. 6(1)(f))
Storing your cookie choice	Legitimate interest in respecting your choice (Art. 6(1)(f)); this storage is strictly necessary
Measuring our Microsoft Advertising campaigns	Your consent (Art. 6(1)(a)), which you can withdraw at any time

We do not sell personal data, do not use it for automated decision-making or profiling with legal effects, and do not send marketing messages without your consent.

4. How long we keep your data

Enquiries that do not lead to an engagement: up to 24 months after our last contact.
Engagement documents and correspondence: for the duration of the engagement and up to 3 years after it ends, in line with the general limitation period for claims.
Accounting documents: 7 years from the end of the financial year, as required by the Estonian Accounting Act.
Server logs: kept by the hosting provider for a limited period, normally no longer than 30 days.
Your cookie choice: 12 months, after which we ask again.
Advertising cookies: as listed in our Cookie Policy.

5. Who receives your data

We share personal data only where necessary, with the following categories of service providers acting as processors on our behalf and under a data processing agreement:

website hosting providers;
email and office software providers;
form delivery services used to transmit enquiries from this website;
accounting service providers, for invoicing and bookkeeping;
font delivery: this website loads fonts from Google Fonts, which means your browser sends your IP address to Google when a page is loaded. No cookies are set for this.

Microsoft. If you consent to advertising measurement, data collected by the Microsoft Advertising Universal Event Tracking (UET) tag is shared with Microsoft Ireland Operations Limited and Microsoft Corporation, which use it to measure the results of our ads. Microsoft may process this data as an independent controller under its own privacy statement. The legal basis for this sharing is your consent.

We may also disclose data to authorities when required by law.

6. Transfers outside the EU

Some providers, including Microsoft, may process data in the United States. Such transfers rely on the EU-US Data Privacy Framework, for companies certified under it, or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed.

7. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased where there is no longer a reason to keep it;
restrict processing in certain circumstances;
receive your data in a portable format;
object to processing based on our legitimate interests;
withdraw your consent at any time, without affecting processing carried out before the withdrawal. For advertising cookies, use the Cookie settings link at the bottom of every page.

To use these rights, email management@a27aou.com. We will reply within one month.

8. Supervisory authority

If you believe we process your data unlawfully, you can lodge a complaint with the Estonian supervisory authority, or with the authority in the EU country where you live or work:

Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39, 10134 Tallinn, Estonia
Email: info@aki.ee
Website: www.aki.ee (opens in a new tab)

9. Security

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls and providers that meet recognised security standards.

10. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version.

11. Contact

Questions about this policy or your data: management@a27aou.com, +372 5523 8193, or by post to A27A OÜ, Järveotsa tee 7-43, 13520 Tallinn, Haabersti linnaosa, Harju maakond, Estonia.