01Who controls your data
Curveon OÜ (registration number 17497752, Vesivärava tn 50-301, 10152 Tallinn, Estonia) is the data controller for the personal data described here. For any privacy question or request, write to info@curveon.net. We have not appointed a data protection officer, as we are not required to.
02What we collect
- Contact and identity data — name, email address, telephone number, company name and role, billing address, and for business clients the company registration and VAT numbers.
- Engagement data — proposals, agreements, correspondence, project requirements, feedback, and any material you send us for the work.
- Billing data — invoices, payment references and bank details used to pay or be paid. We never see or store full card numbers.
- Technical data — if you use our website, your IP address, browser type and pages viewed, collected in aggregate.
- Compliance data — identity and ownership information we are required to collect or retain under accounting and anti-money-laundering rules.
03Why we use it, and our legal basis
- To perform our contract with you (Art. 6(1)(b)) — scoping, delivering and supporting the work, invoicing and taking payment.
- To comply with legal obligations (Art. 6(1)(c)) — accounting, tax and anti-money-laundering requirements.
- For our legitimate interests (Art. 6(1)(f)) — responding to enquiries, keeping records of our dealings, securing our systems, and establishing or defending legal claims.
- With your consent (Art. 6(1)(a)) — where we send you marketing. You may withdraw consent at any time.
04Who we share it with
We share personal data only as far as necessary, with:
- subcontractors and freelance specialists who carry out part of an engagement, under confidentiality and data processing terms;
- our accountants and professional advisers;
- banks and payment institutions that process our transactions;
- providers of hosting, email, communications and project tooling that we use to run the business;
- public authorities, where the law requires it.
We do not sell personal data, and we do not share it for third-party advertising.
05Transfers outside the EEA
Some of our subcontractors and service providers are based outside the European Economic Area. Where personal data is transferred to such a country without an adequacy decision, we rely on the European Commission's standard contractual clauses, together with any additional safeguards the transfer requires. You can ask us for details of the safeguards applying to a particular transfer.
06How long we keep it
Accounting source documents, including invoices and the data they contain, are kept for seven years from the end of the relevant financial year, as Estonian accounting law requires. Engagement records are kept for the duration of the engagement and for three years afterwards, which covers the general limitation period for contractual claims. Enquiries that do not become engagements are deleted within 12 months. Marketing contacts are kept until consent is withdrawn.
07Your rights
You have the right to ask us for a copy of the personal data we hold about you; to have inaccurate data corrected; to have data erased; to restrict or object to our processing; and to receive data you gave us in a portable format. Where processing rests on consent, you may withdraw it at any time without affecting earlier processing.
Write to info@curveon.net and we will respond within one month. Some rights are qualified — for example, we cannot delete records we are legally required to keep.
08Complaints
If you believe we have handled your data improperly, please tell us first. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), or with the supervisory authority in the EU country where you live or work.
09Cookies
Our website uses only the cookies necessary for it to function and, where you agree, basic analytics to understand how the site is used. You can refuse non-essential cookies without losing access to the site, and you can clear or block cookies in your browser at any time.
10Changes
We update this policy when our processing changes. The date at the top of this page shows when it was last revised.