Privacy policy
Last updated: October 2026
Who processes your data
- Legal name
- Union Atlantica OÜ
- Registry code
- 16694803 · e-äriregister (Estonian Business Register)
- Registered address
- Löötsa tn 2a, Lasnamäe linnaosa, 11415 Tallinn, Harju maakond, Estonia
- VAT number
- EE102598669
- Contact email
- [email protected]
We have not appointed a data protection officer, as none of the cases in art. 37 GDPR applies to us. For any question about your data, write to us at [email protected].
What data we collect
We only process the data you give us and the data your visit generates:
- If you write through the contact form: your name, your email, the topics you are interested in and the message you write.
- If you subscribe to the newsletter (from the top notice or from the footer): your email and the language you are browsing in.
- If you book a call: the details you enter in the Google Calendar booking page, which handles the appointment.
- While you browse: aggregated technical and usage data, and only if you accept analytics cookies. The detail is in our cookie policy.
We do not ask for special categories of data (health, beliefs, ethnic origin…) and we would ask you not to include them in the form message.
Why we use it and on what legal basis
| What we process | Why | Legal basis | Retention |
|---|---|---|---|
| Name, email, interests and message from the contact form | To answer your enquiry and follow up on it | Your consent when submitting the form (art. 6.1.a GDPR) | For as long as the conversation lasts and up to 3 years after the last contact |
| Email and language from the newsletter forms | To send you our newsletter and commercial communications | Your explicit consent (art. 6.1.a GDPR and art. 13 of Directive 2002/58/EC) | Until you unsubscribe |
| Name, email and time slot when booking a call | To arrange the meeting you asked for | Your consent and the pre-contractual relationship (art. 6.1.a and 6.1.b GDPR) | For the duration of the relationship and up to 3 years after |
| Aggregated browsing data (page views, device, country) | To understand how the site is used and improve it | Your consent in the cookie notice (art. 6.1.a GDPR) | Up to 14 months |
| Date, IP and accepted wording when you tick a consent box | To be able to prove that you gave us your consent if it is ever questioned | To meet the accountability obligation (art. 5.2 and 7.1 GDPR) | While the consent remains valid and for 3 years afterwards |
| IP address and technical security signals | To protect the site and its forms from attacks and spam | Our legitimate interest in keeping the site secure (art. 6.1.f GDPR) | As long as needed for the security of the service |
Who else has access to your data
We do not sell or trade your data. It is only shared with the providers we need in order to operate, which act as processors and strictly on our instructions:
- HubSpot — CRM and newsletter delivery. Our account is hosted in the European Union.
- Google — reCAPTCHA to protect the forms, Google Analytics 4 for analytics (only with your consent) and Google Calendar for call bookings.
- Cloudflare — site delivery and security.
- Our web hosting provider and our email provider.
We may also disclose data to public authorities or courts where the law requires it.
International transfers
Some of these providers are US companies and may process data outside the European Economic Area. When that happens, the transfer relies on the adequacy decision of the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission, together with the additional safeguards each provider documents.
Your rights
You can exercise the following rights at any time, free of charge:
- Access: find out what data of yours we process.
- Rectification: correct anything inaccurate.
- Erasure: ask us to delete it.
- Objection: object to processing based on legitimate interest.
- Restriction: ask us to keep it but not use it.
- Portability: receive it in a structured format or have us send it to another controller.
- Withdraw consent: whenever you like, without affecting what we did before you withdrew it.
Write to [email protected] telling us which right you want to exercise. We will reply within one month at the latest. If you believe we have not handled your request properly, you can lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), which is the lead supervisory authority because the company is established in Estonia. Art. 77 GDPR also lets you complain to the data protection authority of your own country of residence.
Profiling and automated decisions
If you have written to us or subscribed, HubSpot links your visits to the site with your contact record. That lets us know which topics interest you before a commercial conversation, and it is profiling within the meaning of art. 4(4) GDPR.
We make no automated decisions that produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR). You can object to this tracking at any time: reject the “Marketing & contact” category in the cookie notice, or write to us.
Children
This site is aimed at professionals and companies, not at children. We do not knowingly collect data from children under 13, the threshold set by § 8 of the Estonian Personal Data Protection Act (isikuandmete kaitse seadus) under art. 8 GDPR, and also the age COPPA requires in the United States. In other EU countries that threshold goes up to 16; if that is your case, we will apply the one that corresponds to you. If you are a parent or guardian and believe a child has given us their data, write to us and we will delete it.
Security
The whole site is served over HTTPS, the forms are protected with reCAPTCHA, and access to the data is limited to the team members who need it. We apply reasonable technical and organisational measures to prevent loss or unauthorised access, although no system is infallible.
If you live in the United States
This section answers California’s CalOPPA and the state privacy laws that may apply to you. It operates alongside the rest of this policy, not instead of it.
What we collect and where it comes from
| Category (CCPA terminology) | What it covers | Where it comes from |
|---|---|---|
| Identifiers | Name, email, IP address | From you, when you fill in a form; from your device, as you browse |
| Commercial information | The services you ask about and the content of your message | From you |
| Internet activity | Pages viewed, how you arrived and how you interact with our emails | From your device and from our providers (HubSpot, Google Analytics, Cloudflare) |
| Approximate geolocation | Country and region, inferred from the IP address | From your device |
We use it to reply to you, send the newsletter if you asked for it, understand how the site is used and keep it secure. Only the providers listed above receive it, acting on our behalf.
Selling, sharing and advertising
We do not sell personal information and we do not share it for cross-context behavioural advertising, as the CCPA/CPRA and the other state laws define those terms. We also use no third-party advertising pixels.
We do use cookies from HubSpot, our CRM, to link visits to contact records for our own commercial follow-up. That is neither a sale nor sharing under those laws, but you can switch it off by rejecting the “Marketing & contact” category in the cookie notice.
Your rights and how to exercise them
Depending on your state, you may have the right to: know what data we hold and get a copy, correct it, delete it, take it with you in a portable format, opt out of its sale or sharing and of targeted advertising, limit the use of sensitive personal information (we process none), and appeal if we turn your request down. We will not treat you differently for exercising any of them.
There are two ways to ask: by email at [email protected], or by post to our registered address, shown at the top of this page. We reply within the deadlines your state sets, and if we refuse a request we tell you why and how to appeal.
To verify your identity we will ask you to write from the address already in our records, or to give us enough detail to find your record. If you act as someone’s authorised agent, we need their written authorisation and may confirm it with them directly.
Do Not Track and Global Privacy Control
We do not respond to the browser’s Do Not Track signal, because there is no common standard for interpreting it. We do honour Global Privacy Control: if your browser sends it, no non-essential cookies are set.
Changes to this policy
We may update this policy if the services we use or the applicable rules change. The date of the latest review is shown at the top of the page.