This policy explains what personal data OSKI Solutions OÜ collects when you visit oski.solutions or contact us, why we collect it, how long we keep it and what rights you have. We process personal data under the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.
1. Who is responsible
The controller is OSKI Solutions OÜ, registry code 16525070, Kaupmehe tn 7-120, 10114 Tallinn, Estonia. For any privacy question or request, email hello@oski.solutions. We have not appointed a Data Protection Officer because we are not required to; the email above reaches the people responsible for data protection.
2. What we collect and why
| Data | When | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Name, work email, company, budget range, engagement model, project details, and any optional follow-up answers (preferred contact method, role, project stage, timeline and similar) | You send a form on the website or email us | Reply to your inquiry, prepare for the first call and a proposal | Steps at your request before a contract, Art. 6(1)(b); legitimate interest in answering inquiries, Art. 6(1)(f) |
| Name, email, meeting time and answers you give | You book a call through our scheduling link | Hold the call | Art. 6(1)(b) |
| Request context sent with a form: IP address, approximate location (country, region, city), network provider, browser and device details, the page and how you arrived (referrer, campaign tags) | You send a form on the website | Understand and prioritise your inquiry, detect spam and abuse | Legitimate interest in handling inquiries and protecting our forms, Art. 6(1)(f) |
| Visit history sent with a form: pages you viewed on this site before, when and for how long, which links you clicked and how far you scrolled. Never what you type, except in the form you send | You send a form, and only if you allowed analytics cookies; without consent only the current page is included | Understand what you already read so the reply is relevant | Consent, Art. 6(1)(a) |
| Contact, billing and project data | You become a client | Deliver the contract, invoice, keep accounting records | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Technical data: IP address, browser, requested page, time | Any visit | Deliver the website securely and fix errors | Legitimate interest in running a secure website, Art. 6(1)(f) |
| Aggregate visit statistics: page, referrer, country, device and browser type, time on page, scroll depth and clicks on the page; IP address processed briefly to count unique visitors, not stored | Any visit | Understand which pages are useful, without cookies (Ahrefs Web Analytics and our own statistics on Cloudflare) | Legitimate interest in understanding how our website is used, Art. 6(1)(f) |
| Analytics and advertising data: pages viewed, time on site, traffic source, device and browser, IP address, cookie identifiers | Only if you allow analytics or marketing cookies in the cookie banner | Understand how the site is used, measure our ads | Consent, Art. 6(1)(a) |
| CV and application details | You apply for a job or internship | Assess your application | Steps at your request, Art. 6(1)(b); consent for keeping it for future roles, Art. 6(1)(a) |
We do not sell personal data or use it for automated decision-making. Cookieless visitor statistics run on every visit; analytics and marketing cookies are set only after you allow them, and you can withdraw consent at any time through “Cookie settings” in the footer; see our cookie policy.
3. Who we share it with
We share data only with service providers that help us run the business and only as far as they need it: website hosting and the database where form submissions are stored (Cloudflare, Inc.; the database is restricted to the EU), email, a chat notification that a new inquiry arrived (Telegram; it contains only the country and an internal link, not your contact details), the scheduling tool for booking calls (HubSpot Meetings, operated by HubSpot, Inc.), cookieless website statistics (Ahrefs Web Analytics, provided by Ahrefs Pte. Ltd., Singapore), and, if you consent, website analytics and advertising (Google Analytics and Google Ads, provided by Google Ireland Limited, loaded through Google Tag Manager), accounting and, for client projects, the infrastructure the client chooses. Each provider processes data on our instructions under a data processing agreement. Most of our engineering team works from Ukraine; access to client data is limited to the people working on the project.
4. Transfers outside the EU
Some providers, such as Cloudflare, HubSpot and Google, may process data in the United States; Ahrefs processes data outside the EU; and engineers working from Ukraine access project data from there. For these transfers we rely on adequacy decisions where they exist (including the EU-US Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses.
5. How long we keep it
- Inquiries that do not lead to a project: anonymised 24 months after the last contact. Only the date, form name, country and traffic source stay, for statistics.
- Request context and visit history sent with a form: IP address, device details and the page-by-page history are removed after 90 days; country, city, browser family and traffic source stay with the inquiry.
- Submissions detected as spam: deleted after 30 days.
- Our own cookieless statistics: aggregated, kept for about 3 months.
- Client and contract data: for the contract term, then as long as Estonian accounting law requires (generally 7 years for accounting documents).
- Job applications: up to 6 months after the hiring decision, or longer only with your consent.
- Analytics and advertising cookies: up to 2 years in your browser (see the cookie policy); Google Analytics event data: 14 months.
- Server logs: kept for a short period for security, then deleted or anonymized.
6. Your rights
You can ask us to give you access to your data, correct it, delete it, restrict or object to its processing, or send it to you in a portable format. Where we rely on consent, you can withdraw it at any time. Email hello@oski.solutions and we will answer within one month. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the authority in the EU country where you live.
7. Security
We protect data with access control, encryption in transit, and by limiting who can see client data. No system is perfectly secure; if a breach affects your data, we will notify you and the authority as the GDPR requires.
8. Changes
We update this policy when our processing changes. The date at the top shows the latest version.