Privacy Policy

Delvaris OÜ (reg. no. 17464650, VAT: EE102967232), Tiskrevälja tn 59-12, 13516 Tallinn, Estonia ("we," "us," "our") is the data controller responsible for your personal data. We operate the website flexireo.com and the Flexireo application. We have not appointed a Data Protection Officer as our core activities do not require one under GDPR Art. 37. For data protection inquiries, please contact Marek Stark at privacy@flexireo.com.

This privacy policy explains how we collect, use, store, and share your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). We are committed to protecting your privacy and being transparent about our data practices.

We do not collect special categories of personal data. Depending on how you use the website, we collect:

• Contact form: your name, email address, company name and message.
• ESPR readiness assessment: your work email address, company name, your answers and the resulting score.
• Booking a call: your name, email address, the time you choose and any notes you add.
• When you submit a form or make a cookie choice: a pseudonymised (hashed) version of your IP address and browser identifier, used to prevent abuse.
• Website analytics, only with your consent: pages visited and approximate location (country and city).

Fields marked as required are needed to handle your request; without them we cannot respond. Everything else is optional.

We collect your data in the following ways:

• Directly from you, when you fill in the contact form, take the ESPR readiness assessment or book a call on flexireo.com.
• Through our first-party analytics, only after you consent via the cookie banner. You can change or withdraw your choice at any time via the "Cookie Settings" link in the website footer.

We process your personal data only when we have a valid legal basis under GDPR Art. 6:

• Responding to your inquiry, sending the assessment report you request and arranging the call you book: Art. 6(1)(b) (steps taken at your request before entering into a contract).
• Protecting our forms against spam and abuse (rate limiting, pseudonymised IP and browser hashes): Art. 6(1)(f) (our legitimate interest in keeping the website secure).
• Website analytics: Art. 6(1)(a) (your consent via the cookie banner). Our first-party analytics sets no cookies and creates no persistent identifiers.
• Keeping a record of your cookie choice: Art. 6(1)(c) (our obligation to be able to demonstrate consent, Art. 7(1)).
• Necessary cookies for website functionality: Art. 6(1)(f) (our legitimate interest in providing a functioning website).

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, modification, disclosure or destruction. We never store the IP address of a form submission in readable form, only a pseudonymised (hashed) version. Only authorized personnel have access to your data.

• Respond to inquiries you submit via the contact form.
• Email you the ESPR readiness report you requested. A copy goes to our team so we can follow up if you reply.
• Schedule the call you booked: we send you a confirmation email and a Google Calendar invitation with a Google Meet link.
• Protect our forms against spam and abuse.
• Improve the website through our first-party analytics, only with your consent.
• We do not use data from this website to send you newsletters or marketing emails.

Website analytics are processed in-house using our own first-party analytics system. Your IP address is used only to derive approximate location (country and city) and is then discarded; it is never stored. Visitor identification uses a daily-rotating anonymous hash that cannot be traced back to you and resets every 24 hours. Analytics data is automatically deleted after 90 days and is not shared with third parties. We do not sell your personal data. The service providers that process personal data on our behalf, under data processing agreements, are listed below.

Separately, we operate an anonymous usage counter that measures aggregate activity across all visitors, for example how many people reach each step of an interactive assessment, including visitors who do not consent to analytics. This counter places nothing on your device (no cookies, no local or session storage), and the totals contain no identifier, no IP address and no device or browser details. It records only anonymous daily totals per page or step, which cannot be linked to any individual. To protect the counter against abuse, we briefly keep a code derived from your IP address with a secret key, never the address itself; it expires within an hour at most and is then deleted automatically (legitimate interest, Art. 6(1)(f) GDPR). Because the counter stores nothing on your device, it operates without consent.

Some of our service providers are located in the United States: Vercel (hosting), Supabase (database), Resend (email delivery) and Google (email, calendar and video calls). Transfers to providers certified under the EU-US Data Privacy Framework (Resend, Google) rely on the European Commission's adequacy decision of July 2023. Transfers to the others (Vercel, Supabase) rely on Standard Contractual Clauses approved by the European Commission, with supplementary measures where necessary. You may request a copy of the safeguards in place by contacting us at privacy@flexireo.com.

We keep contact form submissions and call bookings for up to 24 months from the date of collection. Assessment answers are not stored in our database; the report email and our copy of it are kept for up to 24 months. Analytics data is deleted automatically after 90 days. Records of your cookie choice are kept for 3 years so that we can demonstrate your consent. You can ask us to delete your data sooner at any time.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: you may request a copy of the personal data we hold about you (Art. 15).
• Right to rectification: you may request correction of inaccurate or incomplete data (Art. 16).
• Right to erasure: you may request deletion of your personal data (Art. 17).
• Right to restriction of processing: you may request that we restrict how we process your data (Art. 18).
• Right to data portability: you may request your data in a structured, commonly used, and machine-readable format (Art. 20).
• Right to object: you may object to processing based on our legitimate interests (Art. 21).
• Right to withdraw consent: you may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)).

To exercise any of these rights, please contact us at privacy@flexireo.com. We will respond within one month (Art. 12(3)).

You also have the right to lodge a complaint with a supervisory authority. The competent authority for Delvaris OÜ is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). You may also lodge a complaint with the supervisory authority in your country of habitual residence or place of work.

Our website uses cookies and similar technologies. Non-essential ones are only used after you have given explicit consent through our cookie banner. You can manage your preferences at any time via the "Cookie Settings" link in the footer. We use the following categories:

• Necessary cookies: essential for the website to function. Always active, no consent required.
• Analytics: help us understand how visitors use the website through our first-party analytics system. No cookie is set: a temporary session identifier is stored in your browser's sessionStorage and cleared when the tab closes. Analytics only activate after you give consent.
• We do not use marketing, advertising or social media cookies.

We do not engage in automated decision-making or profiling as defined under GDPR Art. 22.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Estonian Data Protection Inspectorate within 72 hours (Art. 33). Where the breach poses a high risk, we will also notify you without undue delay (Art. 34).

If you have any questions regarding this privacy policy, please contact Marek Stark at privacy@flexireo.com.

We may update this privacy policy from time to time. If we make material changes, we will announce them on this page before they take effect and update the date above.