Privacy policy
How Corvanox collects, uses and protects personal data, and the rights you have under the EU General Data Protection Regulation (GDPR).
Last updated 18 October 2026
1. Who is responsible
The controller of your personal data is Corvanox OÜ, a private limited company registered in Estonia (registry code 17597686), Tartu mnt 67/1-13b, 10115 Tallinn, Estonia. Email: info@corvanox.com.
When we build or run a system for a client, we process the client's operational data on their behalf as a processor. That processing is governed by the data processing agreement in our contract with the client, not by this policy.
2. What we collect
- Contact details you send us: name, organisation, work email, sector and your message, when you use the contact form or email us.
- Business relationship data: contact details and correspondence with clients, prospects and suppliers.
- Technical data: IP address, browser type and request time, kept in server and security logs when you visit the site.
- Analytics data: anonymous visit statistics, only if you switch analytics on in the cookie settings. We do not run analytics today.
We do not collect special categories of personal data through this website, and we do not knowingly collect data from children.
3. Why we use it and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Replying to your enquiry and preparing a proposal | Steps at your request before a contract (6(1)(b)) and our legitimate interest in replying (6(1)(f)) |
| Delivering and supporting contracted services | Performance of a contract (6(1)(b)) |
| Keeping the website secure and available | Legitimate interest in security (6(1)(f)) |
| Anonymous visit statistics | Your consent (6(1)(a)), which you can withdraw at any time |
| Accounting and tax records | Legal obligation (6(1)(c)) |
We do not use your data for automated decision-making or profiling, and we do not sell it.
4. Who receives it
We share personal data only with service providers that help us run our business, under contracts that require them to protect it:
- Cloudflare, Inc. (USA): website hosting, secure connection, protection against attacks, content delivery, and forwarding of email sent to info@corvanox.com.
- Formspree, Inc. (USA): receives the messages you send through our contact forms and forwards them to our inbox.
- Google Ireland Ltd. (Gmail): our email inbox.
- Sendinblue SAS (Brevo) (France): delivery of the emails we send.
- Our accountant and, where required by law, public authorities.
5. Transfers outside the EU
Some providers may process data outside the European Economic Area. Where they do, the transfer is protected by an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or by the Commission's Standard Contractual Clauses.
6. How long we keep it
- Enquiries that do not lead to a contract: up to 24 months after our last contact, then deleted.
- Client and supplier records: for the duration of the relationship and as long as needed for possible legal claims.
- Accounting documents: 7 years, as required by the Estonian Accounting Act.
- Server and security logs: up to 30 days, unless needed to investigate an incident.
7. Your rights
Under the GDPR you have the right to access your data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time without affecting earlier processing. To use any of these rights, email info@corvanox.com. We reply within one month.
You can also complain to a data protection authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), Tatari 39, 10134 Tallinn. You may also contact the authority in the EU country where you live or work.
8. Security
We protect personal data with encryption in transit and at rest, role-based access, and regular backups. Only people who need the data for their work can access it.
9. Cookies
How we use cookies and similar storage is explained in our cookie policy.
10. Visitors from outside the EU
If you are in California, you also have rights under the CCPA/CPRA to know, delete and correct personal information. We do not sell or share personal information for cross-context behavioural advertising.
11. Changes
We may update this policy. The date at the top shows the latest version. If a change matters to you, we will make it clear on this page.