01Who we are
The controller of your personal data is:
- Company
- Velfen OÜ
- Registry code
- 14942444
- VAT
- EE102245420
- Address
- Nuia tn 2, 11415 Tallinn, Estonia
- hello@velfen.com
- Phone
- +372 6006070
For any privacy question or request, email us with "Privacy" in the subject line.
02What we collect
When you contact us
If you email, call or use the "Request NDA" form, we receive what you send: typically your name, company, role, email, phone number, company address, and the project information you include.
The NDA form doesn't send anything to our servers. It opens your own email app with a pre-filled message, and nothing is transmitted until you press send there.
When you visit the site
As with any website, our hosting provider automatically logs basic technical data for each request: IP address, date and time, the page requested, browser type and referring page. We don't use these logs to identify visitors.
03Why we use it & legal basis
- Answering enquiries, quotes and NDAs: to take steps at your request before entering a contract, or to perform one (GDPR Art. 6(1)(b)), and our legitimate interest in responding to business contacts (Art. 6(1)(f)).
- Running and securing the website: our legitimate interest in a stable, secure site (Art. 6(1)(f)).
- Accounting and legal obligations: where we have to keep records, for example invoices (Art. 6(1)(c)).
We don't sell your data, use it for advertising, or make automated decisions about you.
05Third parties
Service providers
We use a web hosting provider and an email provider to run this site and our mailbox. They process data only on our behalf and under a data processing agreement.
Google Fonts
The site loads its typefaces from Google Fonts (Google Ireland Ltd.). To deliver the fonts, your browser connects to Google's servers, which receive your IP address. Google may process this data in the USA, under the EU–US Data Privacy Framework. See Google's Privacy Policy.
Social media
Our LinkedIn, YouTube, Instagram and Facebook icons are plain links. Nothing is loaded from those platforms until you click one. After that, the platform's own privacy policy applies.
06How long we keep it
- Enquiries that don't lead to a project: up to 24 months, then deleted.
- Customer correspondence, NDAs and contracts: for as long as the business relationship lasts and as long as needed to establish or defend legal claims.
- Accounting records: 7 years, as required by the Estonian Accounting Act.
- Server logs: kept by the hosting provider for a short period (typically up to 30 days).
07Your rights
Under the GDPR you have the right to access your data, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format. Where processing is based on consent, you can withdraw it at any time.
To use any of these rights, email hello@velfen.com. We'll reply within one month.
You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee, info@aki.ee.
08Changes to this policy
We'll update this page when our practices change. The date at the top always shows the current version.