This Privacy Policy ("Policy") describes how GRAHMUR OÜ (Registry code: 17295519 · VAT: EE102969748), a company registered in the Republic of Estonia ("GRAHMUR", "we", "us", or "our"), collects, uses, and shares information about you when you access or use our website (grahmur.com) or engage with our software engineering and consulting services.
We are committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the applicable data protection laws of the Republic of Estonia.
1. Information We Collect
We may collect and process the following categories of personal data:
- Identity and Contact Data: Name, email address, phone number, company name, and job title when you submit inquiries through our contact form or email us directly.
- Communication Data: The contents of any messages, project requirements, or attachments you send us during the pre-sales or discovery phase.
- Technical and Usage Data: IP address, browser type and version, time zone setting, operating system, and information regarding your interaction with our website.
- Professional Engagement Data: Data necessary to execute Master Services Agreements (MSAs), Statements of Work (SOWs), and NDAs, including billing details and VAT numbers.
2. How We Use Your Information
We use the collected information for the following purposes:
- To respond to your inquiries, provide project estimates, and schedule discovery calls.
- To prepare and execute legal contracts for software engineering services.
- To manage ongoing client relationships, including billing and project reporting.
- To analyze website usage trends and improve our digital presence and user experience.
- To comply with legal, regulatory, or tax obligations required by the Republic of Estonia.
3. Legal Basis for Processing Under GDPR
We rely on the following legal bases to process your personal data:
- Contractual Necessity: Processing is required to fulfill our obligations under a service agreement or to take steps at your request prior to entering into a contract.
- Legitimate Interests: Processing is necessary for our legitimate business interests, provided such interests are not overridden by your fundamental rights (e.g., website analytics, fraud prevention).
- Legal Obligation: Processing is required to comply with Estonian tax and corporate laws.
- Consent: Where expressly provided, such as opting into marketing communications (which you may withdraw at any time).
4. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.
- Client contract and billing data are retained for 7 years to comply with Estonian accounting laws.
- General inquiry communications that do not result in a contract are securely deleted after 12 months.
5. Data Security
We have implemented appropriate technical and organizational security measures designed to protect your personal data against accidental loss, unauthorized access, alteration, or disclosure. All data transmitted through our website is encrypted via TLS/SSL.
6. Third-Party Service Providers
We do not sell your personal data. We may share your data with trusted third-party vendors who assist us in operating our business (e.g., cloud hosting providers, invoicing software, analytics platforms). We ensure that all third-party processors adhere to strict GDPR compliance and confidentiality agreements.
7. Your Data Protection Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete data.
- Right to Erasure ("Right to be Forgotten"): Request deletion of your data, subject to certain legal exceptions.
- Right to Restrict Processing: Request suspension of data processing in certain scenarios.
- Right to Data Portability: Request the transfer of your data to another party in a structured format.
- Right to Object: Object to processing based on legitimate interests.
To exercise any of these rights, please contact us at hello@grahmur.ee. We will respond to your request within 30 days. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at www.aki.ee.
8. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this Policy periodically.
9. Contact Us
If you have any questions or concerns about this Privacy Policy or our data practices, please contact the Data Controller:
GRAHMUR OÜ
Registry code: 17295519 · VAT: EE102969748
Tallinn, Estonia
Email: hello@grahmur.ee
Automatic Regional Content
We use your IP-derived country to display the relevant company information and legal pages. We do not request your device's precise location.
When our hosting provider cannot determine your country, we use ipapi.co to look it up. This sends your IP address to that service. We remember the country in the grahmur_country cookie for up to 30 days. If detection fails, we show the Estonian version and remember that fallback for one hour before trying again.
Visitors in India see the Indian company information and legal pages. All other visitors see GRAHMUR OÜ in Estonia and the Estonian legal pages. Location detection changes the information displayed on this website; the contracting entity for an engagement is set out in your signed agreement.