-cropped.svg)
1. Who we are
Elevates Digital Services OÜ is a private limited company registered in the Estonian Commercial Register under registry code 17455911, at Tartu mnt 67/1-13b, 10115 Tallinn, Estonia. We decide why and how the personal data described here is used, which makes us its controller.
For anything about your data, write to [email protected], or to Hussein S Mohammedameen, member of the management board, at [email protected].
We are not required to appoint a data protection officer, and we have not appointed one.
2. What we collect, why, and for how long
When you What we receive Why Legal basis How long we keep it Visit the website IP address, browser and device details, the page requested, date and time To deliver the website and protect it from attacks and abuse Our legitimate interest in running a secure website, Article 6(1)(f) GDPR Up to 12 months in server and network logs Allow analytics cookies Pages viewed, clicks, device type, approximate location derived from your IP address, a random identifier To see which pages people use, and improve the rest Your consent, Article 6(1)(a) 14 months in Google Analytics Send the contact form Name, email address, company if you give it, your message, and the signals hCaptcha uses to tell people from automated programs To reply and discuss your project Steps you ask for before a possible contract, Article 6(1)(b). The security check rests on our legitimate interest in stopping spam, Article 6(1)(f) 24 months after our last contact. Web3Forms keeps its own copy for at most three years, then deletes it automatically Book a call Name, email address, any answers you give in the booking form, the time you choose, and the Google Meet link To hold the call Steps you ask for before a possible contract, Article 6(1)(b) 24 months after our last contact Write to us by email or WhatsApp What you send us To reply Article 6(1)(b), or our legitimate interest in answering questions, Article 6(1)(f) 24 months after our last contact Become a client Contact details of your representatives, the agreement, invoices and payments To deliver the work and keep the accounting records the law requires Performance of the contract, Article 6(1)(b), and legal obligation, Article 6(1)(c) For the agreement, then seven years from the end of the financial year for accounting records Hear from us first See section 5 See section 5 See section 5 See section 5 We do not record or transcribe calls unless we ask at the start of the call and you agree.
When a period ends, we delete the data or make it anonymous.
We do not send newsletters or other marketing emails, apart from contacting businesses as section 5 describes. If we start a newsletter, we will send it only to people who have agreed to receive it, and every issue will let you unsubscribe.
4. Who else receives your data
We share personal data only with the providers below, and only what each one needs.
Provider What they do for us Their role Where Hostinger International Limited Hosts the website Processes data on our behalf European Union Cloudflare, Inc. Delivers the website, protects it from attacks, hides our email addresses from spam robots Processes data on our behalf United States, see section 6 Google Ireland Limited, with Google LLC Google Workspace: our email, calendar, booking page and Google Meet Processes data on our behalf EU and United States, see section 6 Google Ireland Limited, with Google LLC Google Analytics, only with your consent Processes data on our behalf EU and United States, see section 6 Intuition Machines, Inc. (hCaptcha) Checks that a form is sent by a person Processes data on our behalf United States, see section 6 Web3Creative (Web3Forms) Receives contact form messages and forwards them to our inbox. Its spam filters, CleanTalk and Akismet, check the sender's IP address and email address Processes data on our behalf, under a data processing agreement India, with servers in the United States and the EU, see section 6 WhatsApp. If you choose to message us on WhatsApp, WhatsApp handles that message under its own terms and privacy policy.
Our pages on LinkedIn, Instagram and X. When you visit them, those platforms process your data under their own policies. LinkedIn shares page statistics with us, and for those statistics LinkedIn and we are joint controllers.
Professional advisers and authorities. Our accountant and our lawyers, when their work for us requires it, and public authorities, when the law requires it.
A buyer. If we sell the company or its business, the buyer receives client and contact records under a confidentiality agreement.
Elevates does not sell, rent or trade personal data, and does not make it available to anyone in exchange for payment or any other benefit.
5. When we contact your business first
We look for businesses whose websites we could improve and contact them by email or phone. For this we use business contact details that the business has published itself, or that appear in public registers or on professional networks: a person's name, role, business email address or phone number, the company, and what is publicly visible on its website.
Legal basis: our legitimate interest in offering our services to businesses, Article 6(1)(f).
Our first message to you says who we are and where we found your details, and links to this section. Every message lets you refuse further messages, free of charge, by replying.
We keep these details for up to 12 months after our last contact, unless you become a client.
You can object at any time. Reply "stop" to any message or write to [email protected]. We stop contacting you, and keep only your email address on a do not contact list, so that it stays that way.
6. Transfers outside the European Economic Area
Some providers in section 4 process data outside the European Economic Area. Google LLC, Cloudflare, Inc. and Intuition Machines, Inc. are certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023. Web3Creative, which runs Web3Forms from India, is bound by the standard contractual clauses adopted by the European Commission, through its data processing agreement with us. We rely on the same clauses wherever the framework does not apply.
Write to [email protected] for a copy of the safeguard that applies to a provider.
7. Your rights
You can ask us to show you the personal data we hold about you and give you a copy; to correct it; to delete it; to limit how we use it; and to send it to you or to another provider in a common format, where you gave it to us for a contract or with your consent.
Where we rely on your consent, you can withdraw it at any time, for cookies through Cookie settings at the bottom of every page. Withdrawing does not affect what happened before.
Right to object. Where we rely on our legitimate interest, you can object at any time for reasons relating to your situation, and we stop unless we have compelling legitimate grounds that override your interests, or need the data for legal claims. When the purpose is direct marketing, including contacting your business first, we always stop.
Write to [email protected]. You do not need a form, and it costs nothing. We answer within one month. If a request is complex or we receive many, we can extend this by up to two more months, and we tell you so within the first month. If we cannot tell that a request comes from you, we ask you to confirm your identity first.
When we correct or delete your data, we pass that on to each provider in section 4 that holds it, and we tell you who they are if you ask.
We cannot delete records the law requires us to keep, such as invoices, until that period ends. If we refuse any request, we tell you why and how to complain.
8. Complaints
You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or to the data protection authority of the country where you live, where you work or where you believe the infringement happened. We would appreciate the chance to put it right first.
9. Do you have to give us personal data
No law or contract obliges you to give us personal data. To reply to the contact form we need your email address and a message, and without them we cannot answer. To book a call we need your name and email address, and without them the booking cannot be made. Everything else is optional.
10. No automated decisions
We do not make decisions about you by automated means alone, and we do not build profiles that have legal or similarly significant effects on you.
11. Children
Our website and services are meant for businesses and are not directed at children. We do not knowingly collect children's personal data. If you are under 18, please do not send us personal data.
12. How we protect your data
Our email, calendar and documents run on Google Workspace. Only the people at Elevates who need your data can reach it, and every account signs in with two step verification. Data travels encrypted between your browser and our website.
If a personal data breach is likely to result in a high risk to your rights, we tell you without undue delay. We report breaches to the Data Protection Inspectorate as the law requires.
13. Changes to this statement
When we change this statement, we update the date at the top. When a change matters to you, such as a new purpose or a new way to use your rights, we tell you before it applies: by email if we have your address, otherwise by a notice on this website.
14. Language
This statement is published in English, French, Dutch and Turkish. If a translation differs from the English text, the English text prevails. This never reduces the rights the law gives you.