Privacy notice

1. Controller

The controller responsible for the processing described in this notice is the company identified in the legal notice of this website ("CASAERA", "we"). Contact details for data protection matters are given at the end of this notice.

2. Data we process and why

We process personal data only where necessary for a specific purpose and on a legal basis provided by Article 6 GDPR.

• Website visit: technical data transmitted by your browser (IP address, date and time, requested page, referrer, browser and operating system) is recorded in the hosting provider's server logs. Purpose: security, fault detection and operation of the website. Legal basis: legitimate interest (Art. 6(1)(f)).
• Enquiries by email or telephone: name, company, contact details and the content of your message. Purpose: handling your request and any follow-up. Legal basis: pre-contractual steps (Art. 6(1)(b)) or legitimate interest in responding to enquiries (Art. 6(1)(f)).
• Trade relationships: identity and contact details of our partners' representatives, order, delivery, invoicing and payment data, correspondence. Purpose: performance of the contract, invoicing, after-sales and compliance with accounting and tax obligations. Legal basis: contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).
• Compliance and defence of claims: data required to comply with applicable law (including accounting, tax, product safety and export control rules) or to establish, exercise or defend legal claims. Legal basis: legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)).

3. Cookies and tracking

This website does not set cookies, does not use analytics, advertising or social-media scripts and does not build profiles of visitors. No consent banner is displayed because no consent is required.

4. Recipients

Personal data is processed by our staff on a need-to-know basis. We share data with service providers acting as processors on our behalf (website hosting, email, IT, accounting), bound by data processing agreements, and with logistics and payment partners where necessary to perform a contract. Data may be disclosed to public authorities where required by law. We do not sell personal data and do not share it with third parties for their own marketing.

5. International transfers

Our website and email are hosted within the European Union. Where a service provider processes data outside the European Economic Area, we rely on an adequacy decision of the European Commission or on the Standard Contractual Clauses adopted by the Commission, together with additional safeguards where appropriate.

6. Retention

Server logs are kept for a maximum of 30 days unless required for security investigation. Enquiry data is kept for as long as necessary to handle the request and for up to 12 months thereafter, unless a business relationship follows. Contract, order and invoicing data is kept for the duration of the relationship and for 7 years after the end of the financial year concerned, as required by the Estonian Accounting Act. Data relating to legal claims is kept until the claim is finally settled and the applicable limitation period has expired.

7. Your rights

Under the GDPR you have the right to access your personal data, to have it rectified or erased, to restrict its processing, to object to processing based on legitimate interest, and to receive data you provided to us in a portable format. Where processing is based on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

To exercise these rights, contact us using the details below. We respond within one month, extendable by two further months for complex requests, in which case we inform you. We may ask you to confirm your identity before acting on a request.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence or place of work. The supervisory authority for CASAERA is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee, info@aki.ee.

8. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including encrypted transport (HTTPS), access control and the principle of data minimisation reflected in the design of this website.

9. Changes to this notice

We may update this notice to reflect changes in our activities or in applicable law. The date of the last update is shown at the top of this page.

10. Contact for data protection matters

Company

Casaera OÜ

Email

office@casaera.eu

Registered office

Pärnu mnt 139b
Kesklinna linnaosa, 11317 Tallinn
Harju maakond, Estonia