Privacy Policy
1. Data controller
Papa Aliferous OÜ
Reg no: 16460985
Address: Keskkooli 3, 79512 Rapla, Estonia
Branch: Härma 16, Pärnu, Estonia
Email: papa.aliferous@gmail.com
Phone: +372 5662 9011
2. What data we collect
2.1 Through the contact form
- Name — to give a personal response
- Phone number — to reach you quickly
- Email — for correspondence and confirmations
- Location + vehicle type — to prepare a fitting offer
- Message — your additional info (optional)
Please do not include sensitive data (e.g. health, family, financial details) in the free-text message.
2.2 When booking
- Preferred date and time
- Vehicle registration number — only at the booking confirmation step, to identify bookings and prepare the workplace
2.3 When subscribing to the newsletter
- Email + optional name
- Consent timestamp and a unique unsubscribe token
2.4 Technical info (automatic)
- IP address — for security and abuse prevention (kept 12 months)
- User-agent — same purpose
- Functional session cookies — admins only (see section 7)
3. Why we process data and legal basis
| Purpose | Legal basis (GDPR art 6) |
|---|---|
| Responding to enquiry, offer, confirming booking | art 6(1)(b) — pre-contractual steps |
| Service delivery and billing | art 6(1)(b) |
| Accounting, tax documents | art 6(1)(c) — legal obligation (Estonian Accounting Act § 12) |
| Newsletter | art 6(1)(a) — your consent (revocable at any time) |
| Asking for feedback after service | art 6(1)(f) — legitimate interest |
| Site security, abuse prevention (IP log) | art 6(1)(f) — legitimate interest |
4. Retention periods
| Dataset | Retention |
|---|---|
| Enquiries without booking | 12 months, then auto-deleted |
| Bookings and billing data | 7 years (Accounting Act § 12) |
| Audit log (security) | 12 months |
| IP addresses next to enquiries | 12 months, then anonymised |
| Newsletter subscribers | Until unsubscribe; thereafter an anonymised entry is kept 90 days to prevent accidental re-subscription |
| Admin sessions | 30 days, then auto-logout |
5. Whom we share data with
We do not sell or rent your data to third parties for marketing. For legitimate processing we use:
| Recipient | Data shared | Location |
|---|---|---|
| Elkdata OÜ | All site data (as processor) | Estonia / EU |
| Google LLC (Gmail) | Admin notification emails | USA · EU-US Data Privacy Framework |
| Accountant | Invoice data (name, company, amount) | Estonia |
International transfers to the USA happen under the EU-US Data Privacy Framework (in force since 2023-07-10), which provides adequate protection per EU Commission's assessment.
6. Your rights
Under GDPR arts 15-22 you have the right to:
- Receive information and a copy of your data (art 15)
- Have inaccurate data corrected (art 16)
- Have your data erased (art 17 — "right to be forgotten"). This does not apply to data we are legally required to keep (e.g. invoices)
- Restrict processing during a dispute (art 18)
- Receive data in a portable format (art 20) — we send it as JSON
- Object to processing based on legitimate interest (art 21)
- Unsubscribe from the newsletter at any time — link in every email
If you believe our processing violates your rights, you may contact the Estonian Data Protection Inspectorate (www.aki.ee, info@aki.ee, +372 627 4135).
7. Cookies
The public site does not use cookies. We do not use analytics (Google Analytics etc), advertising, or tracking cookies.
Admin panel (/admin/) login uses only a
functional session cookie (papaali_admin) for admin
authentication. This is strictly necessary and does not require
separate consent (ePrivacy Directive art 5(3) exemption).
Your browser may store your language preference (Estonian/English)
in localStorage. This is a functional setting and
contains no personal data.
8. Security
We employ organisational and technical measures to protect data (GDPR art 32):
- HTTPS across the whole site
- Strong password hashing (bcrypt) for admin accounts
- Brute-force protection, request rate limits
- Private session storage, secure cookie settings (HttpOnly, SameSite, Secure)
- Input validation, XSS and SQL injection protections
- Content Security Policy header
- Atomic JSON file writes (file lock)
- Regular backups
Data breach notification
In case of a personal data breach we will notify the Estonian Data Protection Inspectorate within 72 hours, and you directly if the breach is likely to pose a high risk to your rights (GDPR arts 33-34).
9. Changes
We may update this policy from time to time. We will notify newsletter subscribers of material changes by email and publish a notice on this page at least 30 days before the changes take effect. Each version's date is at the top of the page.
10. Contact
Questions about this policy or your data:
Papa Aliferous OÜ
Email: papa.aliferous@gmail.com
Phone: +372 5662 9011
Mail: Keskkooli 3, 79512 Rapla, Estonia