Privacy

What I collect and why

Website

Cloudflare, which hosts this site, processes your IP address and browser details to deliver and protect the pages. I keep no logs of my own; Cloudflare keeps security analytics for up to 31 days. Basis: legitimate interest.

Email

Your name, address and message, so I can reply and discuss working together. If no work follows, I delete the correspondence within a year of the last message. Basis: steps before a contract, or legitimate interest.

Clients

Contact persons’ names, roles and work contact details, correspondence, meeting notes and contracts, to prepare and perform the contract. Kept for three years after the contract ends; contracts and invoices for seven years from the end of the financial year, as the Accounting Act requires. Basis: contract, legitimate interest (when the contract is with your employer) and legal obligation.

New clients

Name, role and work contact details from public sources (Business Register, company websites, LinkedIn), to offer my services to your company. My first message says where I found you. If no work follows, I delete the data within a year of collecting it; if you ask me to stop, I keep only your name and email so I can respect that. Basis: legitimate interest.

Meetings

On Microsoft Teams: your name, the chat, and your image and voice if you turn them on. I record or transcribe only after saying so, and delete recordings and transcripts within 120 days unless we agree otherwise. Basis: contract or legitimate interest.

When I process personal data on a client’s behalf, the client is the controller and our contract applies. To exercise your rights over that data, contact the client first.

Who else processes it

Microsoft 365

Email, calendar, Teams and files. Stored in the EU.

Cloudflare

Website hosting and protection, email routing.

Anthropic

Claude, the AI assistant that helps me work through email, documents and meeting notes and draft replies. Conversations are deleted on the same schedule as the source data. Anthropic does not train its models on this data. Basis: legitimate interest.

Amazon Web Services

AI models in Amazon Bedrock, in EU regions only.

Some data may be processed outside the European Economic Area, including in the USA (Cloudflare and Anthropic, and Microsoft in limited cases). These transfers are protected by the EU–U.S. Data Privacy Framework or the EU Standard Contractual Clauses; I will send you a copy on request.

I disclose data to anyone else only when the law requires it. I do not sell data. AI makes no automated decisions about you.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to its processing, or have it transferred. You can object to direct marketing at any time, without giving a reason. Email mart@kratikaitse.ee and I will reply within a month. You can also complain to the Estonian Data Protection Inspectorate (aki.ee).