Privacy Policy

PRIVACY AND PERSONAL DATA PROCESSING POLICY (GDPR)

Last Updated Date: 2025-10-30

This Policy defines the procedure for processing and protecting personal data (PD) received from data subjects (Users) through forms on the website basismetrics.com (hereinafter – “the Site”). Data processing is carried out in accordance with the General Data Protection Regulation (EU Regulation 2016/679, GDPR).

1. Data Controller

The Data Controller responsible for processing your personal data is:

  • Company Name: Basis Metrics / NarvaOnline OÜ
  • Legal Address: Ida-Viru maakond, Narva linn, Soldina tn 14, 21003 (Estonia / EU)
  • Contact Person (DPO/Controller): Liudmila Elesina
  • Email for PD requests: elesinaljudmila@gmail.com

2. Categories of Personal Data Collected

We collect the following data when you fill out form(s) on our Site:

  1. Identification Data: Name, Email address, Phone number.
  2. Service and Commercial Data: Your website address, Selected service type (Level 1), Long-term interest (text field), Message/Problem description.
  3. Technical Data (Automatic): IP address, browser type, time of visit.

3. Purposes and Legal Basis for Processing

We process your personal data exclusively for the following purposes and on the following legal bases (pursuant to Art. 6(1) GDPR):

Purpose of ProcessingLegal Basis under GDPR
Processing the inquiry and preparing a commercial offer (Client contact, pre-contractual relations, preparing commercial offer).Art. 6(1)(b) GDPR: Processing is necessary for pre-contractual steps taken at the request of the data subject.
Execution and conclusion of a contract (After acceptance of the commercial offer, entering into verbal or written agreements).Art. 6(1)(b) GDPR: Processing is necessary for the performance of a contract.
Business interest analysis (Use of “Long-term interest” data regarding Level 2/3).Art. 6(1)(f) GDPR: Legitimate interest of the Controller in segmenting potential clients and developing the business.
Informational and promotional mailing (Email marketing).Art. 6(1)(a) GDPR: Explicit, active, and voluntary consent of the data subject, obtained via a separate checkbox.

3.1. Use of Cookies and Analytical Systems

The Site uses Cookies (small text files placed on your device) and external analytical services, including Google Analytics and Yandex Metrica. These technologies are used for analyzing user behavior, optimizing Site performance, and gathering anonymous statistical data.

Legal Basis: The use of Cookies that are not strictly necessary for Site operation (i.e., analytical and marketing cookies) requires the explicit, voluntary consent of the data subject (Art. 6(1)(a) GDPR). We obtain this consent through the Site’s mandatory Cookie Consent Banner.

4. Data Recipients and Data Transfer

We do not transfer your data to third parties, except for authorized Processors who assist us in achieving the above-mentioned purposes:

  1. CRM System: We use an external service for maintaining the client base, managing inquiries, and storing contacts. This service acts as a Data Processor.
    • Measures Taken: We guarantee that a relevant agreement (DPA – Data Processing Agreement) has been concluded with the Processor, obligating them to comply with the requirements of the GDPR.
  2. Hosting Provider: The Site is hosted on a server within the EU.

5. Data Retention Periods

Personal data will be stored for the time necessary to achieve the processing purposes, or for the following periods:

  • Data related to an inquiry (CRM): Up to 5 (five) years from the last contact, if it did not lead to the conclusion of a contract, or until receipt of a deletion request.
  • Data used for mailing lists: Until consent is withdrawn.

6. Data Subject Rights (Your Rights)

In accordance with the GDPR, you have the following rights regarding your personal data:

  • Right of Access: You have the right to obtain confirmation as to whether your PD is being processed and to access it.
  • Right to Rectification: You have the right to request the correction of inaccurate or incomplete data.
  • Right to Erasure (“Right to be forgotten”): You have the right to request the deletion of your PD if there are no legitimate grounds for their further processing.
  • Right to Restriction of Processing: You can limit our processing of your PD in certain circumstances.
  • Right to Data Portability: You have the right to receive your data in a structured, commonly used, and machine-readable format and transmit it to another controller.
  • Right to Object: You may object to the processing of your PD based on legitimate interest or against its use for direct marketing purposes.
  • Right to Withdraw Consent: You may withdraw your consent to data processing based on consent (e.g., for mailings) at any time. Withdrawal does not affect the lawfulness of processing carried out prior to its withdrawal.

To exercise any of the above rights, please contact us via the email address specified in Section 1.

7. Contact for Complaints

If you believe your rights have been violated, you have the right to file a complaint with the Estonian supervisory authority: The Data Protection Inspectorate (Andmekaitse Inspektsioon).