Privacy Policy
Updated: 10 June 2026
1. Data controller
- Controller: AtalayaSoft OÜ
- Registration: company entered in the Estonian Commercial Register with registry code 14687160
- Registered office: Jõe tn 2a, 10151 Tallinn, Estonia
- Privacy contact email: legal@atalayasoft.com
This policy applies to the personal data processed through the website https://www.atalayasoft.com and through AtalayaSoft OÜ's contact channels.
2. What data we process
- Contact details that you provide to us through the contact form or by email: first name, surname, email address, company and the content of your message.
- Client data required for the B2B contractual relationship: professional contact details, billing details (company name, tax/VAT number, address) and bank details for payment management.
- Browsing data (IP address, browser type, pages visited) only if you accept analytics cookies. See the Cookie Policy.
We do not request or process special categories of data. This site is not aimed at anyone under the age of 18.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Responding to your enquiries and quotation requests | 6(1)(b) — pre-contractual measures at the data subject's request |
| Providing services and managing the contractual relationship with clients | 6(1)(b) — performance of a contract |
| Invoicing and tax and accounting obligations | 6(1)(c) — legal obligation |
| Sending commercial communications about our services | 6(1)(a) — consent (revocable at any time) |
| Aggregate statistical analysis of website usage | 6(1)(a) — consent (analytics cookies) |
| Defence against potential claims | 6(1)(f) — legitimate interest |
4. Retention periods
- Enquiries that do not become clients: up to 1 year from the last contact.
- Contractual and billing data: for the duration of the contractual relationship and, afterwards, for the applicable statutory limitation periods (in Estonia, as a general rule, 7 years for accounting documentation).
- Commercial communications: until you withdraw your consent.
- Analytics data (GA4): according to the Google Analytics retention settings (14 months).
5. Recipients and processors
We do not sell or share your data with third parties. It may be accessed, as processors and under a contract in accordance with Art. 28 GDPR, by our providers of: web hosting, email, web analytics (Google Ireland Ltd.) and video playback (Vimeo Inc.). We may disclose data to public authorities and to courts and tribunals where required by a legal obligation.
6. International transfers
Some providers may process data outside the European Economic Area (in particular, in the United States). These transfers are covered by the Adequacy Decision for the EU-US Data Privacy Framework for certified providers, or by Standard Contractual Clauses approved by the European Commission.
7. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, as well as withdraw any consent given, by sending an email to legal@atalayasoft.com indicating the right you wish to exercise. We will only ask you for additional information to verify your identity if there are reasonable doubts about it.
If you consider that the processing does not comply with the law, you may lodge a complaint with the supervisory authority: the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) as the authority of the controller's country of establishment (www.aki.ee), or with the Spanish Data Protection Agency (AEPD) if you reside in Spain (www.aepd.es).
8. Security
We apply technical and organisational measures appropriate to the risk to protect your data against unauthorised access, alteration, loss or destruction, in accordance with Art. 32 GDPR.
9. Changes to this policy
We may update this policy to adapt it to regulatory changes or to changes in our processing activities. We will publish the current version on this page, indicating the date of update.