Privacy Policy

Last updated 10 September 2026

1. Controller

The controller of your personal data is Morfeo Technologies OÜ, Estonian Business Register code 17532574, registered at TuneUp OÜ, Pärnu mnt 139b, 11317 Tallinn, Estonia. For any privacy question, write to morfeou@proton.me. We have not appointed a Data Protection Officer, as we are not required to.

2. What we collect and why

• Enquiries. When you email us we hold your name, email address and whatever you tell us, so that we can answer. Legal basis: our legitimate interest in responding to a business enquiry, and steps taken at your request before entering a contract.
• Client and contract data. Contact details of the people we work with, the contract, correspondence and delivery records. Legal basis: performance of a contract.
• Billing and payment data. Company name, billing address, VAT number, invoice records and the outcome of a payment. Card details are entered directly with our payment processor and never reach our systems. Legal basis: performance of a contract and our legal obligation to keep accounting records.
• Server logs. Our hosting provider records the IP address, the page requested, the timestamp and the browser user agent, for security and abuse prevention. Legal basis: our legitimate interest in keeping the site available and secure.

3. Cookies and analytics

This website sets no cookies and runs no analytics or advertising scripts. There is nothing to consent to and no tracking to opt out of. If that changes we will update this page and ask for consent before setting any non-essential cookie.

4. Who we share data with

We use a small number of processors, each under a data processing agreement:

• Cloudflare, Inc. Website hosting and content delivery.
• Stripe Payments Europe, Ltd. Card payment processing. Stripe is an independent controller for fraud prevention and its own regulatory obligations. See stripe.com/privacy.
• Our email and accounting providers. To correspond with you and to issue and record invoices.
• Our accountant and, where legally required, the Estonian Tax and Customs Board.

We do not sell personal data and we do not share it for advertising purposes.

5. International transfers

Some processors are established outside the European Economic Area or operate infrastructure there. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision. You can ask us for a copy of the safeguards in place.

6. How long we keep it

• Enquiries that do not lead to a contract: 12 months.
• Contract and correspondence records: for the contract term plus 3 years, matching the general limitation period.
• Accounting and invoice records: 7 years, as required by the Estonian Accounting Act.
• Server logs: 30 days.

7. Your rights

Under the GDPR you may request access to your personal data, its correction or erasure, restriction of processing, and portability, and you may object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

Send any request to morfeou@proton.me. We answer within one month. We may ask you to confirm your identity before acting on a request.

8. Complaints

If you believe we have handled your data unlawfully you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee, or to the supervisory authority in your own country of residence.

9. Security

Access to client data is limited to the people who need it, accounts require multi-factor authentication, and data is encrypted in transit. No system is perfectly secure, and we will notify you and the supervisory authority of a personal data breach where the law requires it.

10. Automated decision-making

We do not make decisions about you by automated means and we do not profile you.

11. Changes

We update this policy when our processing changes. The date at the top of the page shows the version in force.