Privacy Policy
This Privacy Policy explains how Onpolar OÜ (“Onpolar,” “we,” “us,” or “our”) processes personal data when you visit our website (onpolar.com), contact us or work with us. It gives the information required by Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
1. Who Is Responsible for Your Data
The controller of your personal data is:
Onpolar OÜ
Registry code 14384702, VAT number EE102370845
Jõe tn 7-30, 10151 Tallinn, Estonia
Email info@onpolar.com, phone +372 608 4910
We have not appointed a data protection officer, as the law does not require one for our activities. Send any privacy question or request to info@onpolar.com and it will reach the person responsible.
2. What We Process, Why, and on What Basis
We process only the data we need for the purposes below. Each purpose relies on a legal basis under Article 6(1) of the GDPR.
| Purpose | Data | Legal basis |
|---|---|---|
| Answering your enquiry from the contact form, email or phone | Name, work email, company, your message, budget range | Steps you ask us to take before a contract (Art. 6(1)(b)); our legitimate interest in answering business enquiries (Art. 6(1)(f)) |
| Scheduling a call you book through Calendly | Name, email, chosen time, any notes you add | Steps you ask us to take before a contract (Art. 6(1)(b)) |
| Delivering services and managing the client relationship | Names, roles and contact details of client representatives, correspondence, contract and invoicing data | Performance of a contract (Art. 6(1)(b)); legitimate interest where the contract is with your employer (Art. 6(1)(f)) |
| Accounting and other legal obligations | Invoices, payment records and the contract data they refer to | Legal obligation, including the Estonian Accounting Act (Art. 6(1)(c)) |
| Running and protecting the website, including spam protection on the contact form | IP address, browser and device data, request logs, Turnstile security signals | Legitimate interest in a secure, working website (Art. 6(1)(f)) |
| Website analytics with Google Analytics | Pseudonymous online identifiers, pages viewed, referrer, device and browser data, approximate location | Your consent (Art. 6(1)(a)), asked for in the cookie banner |
| Occasional emails about similar services to clients and people who contacted us | Name, work email, company | Legitimate interest in keeping in touch with business contacts (Art. 6(1)(f)); you can opt out at any time |
Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for details and object at any time (see Your Rights). If a colleague gives us your contact details for a project, the data comes from your employer and is limited to business contact details.
3. How Long We Keep It
- Enquiries and call bookings that do not lead to a contract: up to 24 months after our last contact.
- Client relationship data: for the duration of the contract and up to 3 years after it ends, the general limitation period under Estonian law for claims arising from a transaction.
- Accounting documents: 7 years from the end of the financial year, as the Estonian Accounting Act requires.
- Website server logs: no longer than 30 days.
- Google Analytics data: no longer than 14 months.
- Your cookie choice: 12 months, after which we ask again.
5. Bot Protection (Cloudflare Turnstile)
Our contact form is protected against spam and automated abuse by Cloudflare Turnstile. The check processes technical browser signals (such as browser characteristics and request behavior patterns) to distinguish humans from bots — it shows no puzzles and builds no advertising profile of you. This involves transmitting data such as your IP address and user agent to Cloudflare. The legal basis is our legitimate interest in keeping the form free of spam (Art. 6(1)(f)).
Use of Turnstile is governed by the Cloudflare Privacy Policy.
6. Embedded Videos (YouTube)
Some pages show videos hosted on YouTube. Until you press play, the page only shows a preview image served from our own website, and no request is made to YouTube. When you press play, the video loads from youtube-nocookie.com, and Google may then process data such as your IP address and set cookies or similar technologies on your device. Pressing play is your consent to that (Art. 6(1)(a)).
Video playback is governed by the Google Privacy Policy.
7. Who Receives Your Data
We do not sell, rent, or trade your personal information. We share it only with the service providers that run parts of our business for us, under data processing agreements and only for the purposes above:
- Vercel Inc. (USA): website hosting and server logs
- Cloudflare, Inc. (USA): bot protection on the contact form
- Formspree, Inc. (USA): delivery of contact form messages to our inbox
- Calendly LLC (USA): call booking
- Google Ireland Limited and Google LLC: Google Analytics (with your consent) and YouTube playback
- Our email, office software and accounting service providers
We may also disclose data to professional advisers bound by confidentiality, such as auditors and lawyers, and to public authorities when the law requires it, or to protect the rights, safety, or property of Onpolar, our clients, or the public.
8. Transfers Outside the EU
Some of the providers above are based in the United States, so your data may be transferred outside the European Economic Area. We transfer data only where it is protected as the GDPR requires: to providers certified under the EU–U.S. Data Privacy Framework, which the European Commission found adequate on 10 July 2023, or otherwise under the Standard Contractual Clauses adopted by the European Commission. You can ask us for a copy of the relevant safeguards at info@onpolar.com.
9. When We Work for Our Clients
When we run AI agents, campaigns or integrations for a client, we process personal data on that client’s behalf and on its instructions, as its processor. If one of our clients contacted you, for example through an AI sales agent we built for them, that client is responsible for the processing and its privacy notice applies. Please send requests about that data to the client; if you write to us, we will pass your request on.
10. Your Rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict our processing (Art. 18);
- receive the data you gave us in a machine-readable format, or have it sent to another controller (Art. 20);
- object to processing based on our legitimate interests, and at any time to direct marketing, which we will then stop (Art. 21);
- withdraw your consent at any time, without affecting processing before the withdrawal (Art. 7(3)).
To use any of these rights, write to info@onpolar.com. We reply within one month, which the GDPR allows us to extend by two further months for complex requests; we will tell you if we do. We may ask you to confirm your identity first. Using your rights is free of charge.
11. Right to Complain
If you believe we process your data unlawfully, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee, or with the supervisory authority of the EU country where you live or work. We would appreciate the chance to resolve your concern first at info@onpolar.com.
12. Required Data and Automated Decisions
You are not required by law or contract to give us personal data. Without a name and an email address, however, we cannot answer an enquiry or schedule a call. We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects (Art. 22).
13. Data Security
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including encrypted connections, access limited to the people who need it, and providers bound by data processing agreements. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
14. Children’s Privacy
Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will take steps to delete it promptly.
15. Changes to This Policy
We may update this Privacy Policy from time to time. The updated version will be indicated by a revised “Last updated” date. If a change materially affects how we use data we already hold, we will tell the people concerned directly where we can.
16. Contact
If you have any questions about this Privacy Policy, please contact us at info@onpolar.com, call +372 608 4910, or write to Onpolar OÜ, Jõe tn 7-30, 10151 Tallinn, Estonia.