Effective from 07.07.26
1. General provisions
1.1. This privacy policy sets out the principles governing the collection, processing and storage of personal data on the website https://helmut.ee.
1.2. The controller of personal data is Helmut Electric OÜ (registry code 17112753, address [ADDRESS], e-mail info@helmut.ee, telephone +372 5392 8352), hereinafter the controller.
1.3. A data subject within the meaning of this privacy policy is a client, prospective client, website visitor or any other natural person whose personal data the controller processes.
1.4. The controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation) and the Estonian Personal Data Protection Act.
2. What personal data is processed
2.1. Personal data is collected primarily by electronic means, through the website, e-mail and telephone. The controller does not collect data that the data subject has not provided themselves, except for website usage statistics as described in clause 2.5.
2.2. Through the enquiry and contact form: first and last name, e-mail address, telephone number and the content of the enquiry. At the data subject's discretion, the enquiry may also include the address and description of the site.
2.3. When concluding a contract and carrying out works: name, contact details, site address, description of the works ordered, documentation of the works performed (including measurement protocols and as-built drawings) and billing details.
2.4. When subscribing to the newsletter: e-mail address and the date of subscription.
2.5. When using the website: pages visited, referring source, approximate location at city or country level, device and browser type, and session duration. This data is collected only where the data subject has given consent via the cookie banner. The data is collected in pseudonymised form and is not linked to an identifiable person.
2.6. The controller does not process special categories of personal data, nor personal data concerning persons under the age of 16.
3. Purpose and legal basis of processing
3.1. Responding to enquiries and preparing quotations. Legal basis: steps taken at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).
3.2. Performance of the contract, carrying out and documenting the works. Legal basis: performance of a contract (Article 6(1)(b) GDPR) and the obligation to document electrical work arising from the Estonian Electrical Safety Act (Article 6(1)(c) GDPR).
3.3. Accounting and compliance with tax obligations. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).
3.4. Sending the newsletter. Legal basis: consent of the data subject (Article 6(1)(a) GDPR).
3.5. Website usage statistics and improvement of the website. Legal basis: consent of the data subject (Article 6(1)(a) GDPR).
3.6. Establishment, exercise and defence of legal claims. Legal basis: legitimate interests of the controller (Article 6(1)(f) GDPR).
4. Retention of personal data
- Enquiries that did not result in a contract — [1 YEAR] from the date of the enquiry
- Client data, contracts and documentation of works — 7 years from the end of the financial year in which the transaction took place (Estonian Accounting Act § 12)
- Documentation of electrical work — in accordance with the requirements of the Electrical Safety Act, at minimum for the service life of the installation
- Newsletter subscriber data — until the subscription is cancelled
- Website usage statistics — 14 months
4.1. Once the retention period has expired, personal data is deleted or irreversibly anonymised.
5. Processors and transfer of data
5.1. The controller uses service providers who process personal data on behalf of and under the instructions of the controller:
- web hosting provider (established in the European Union)
- website analytics provider
- accounting software provider
- e-mail delivery provider
The names of the specific processors will be disclosed by the controller upon request by the data subject. A data processing agreement has been concluded with each processor.
5.2. When carrying out works, the controller may pass the data subject's contact details and the site address to a subcontractor or partner, only to the extent necessary for performing the specific work.
5.3. Data may be disclosed to supervisory authorities where required by law, and to a legal service provider where necessary for the establishment, exercise or defence of legal claims.
5.4. Some service providers may process personal data outside the European Economic Area. In such cases the transfer takes place on the basis of the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.
5.5. The controller does not sell, rent or exchange personal data with third parties for marketing purposes.
6. Cookies
6.1. The website uses cookies. Cookies necessary for the functioning of the website are always set; statistics and marketing cookies are set only with the data subject's consent.
6.2. A full list of the cookies used, together with their purpose and duration, is set out in the cookie policy.
6.3. Consent given can be changed or withdrawn at any time via the cookie settings link displayed on the website.
7. Rights of the data subject
7.1. The data subject has the right to:
- obtain information about and access to the personal data processed about them
- request rectification of inaccurate personal data
- request erasure of personal data where there is no legal basis for processing it
- request restriction of processing
- object to processing carried out on the basis of legitimate interests
- receive their personal data in a machine-readable format and transmit it to another controller
- withdraw consent given at any time
7.2. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
7.3. To submit a request, send an e-mail to info@helmut.ee. The controller will respond within one month of receiving the request.
7.4. If the data subject considers that their rights have been infringed in the processing of personal data, they have the right to contact the Estonian Data Protection Inspectorate (Tatari 39, 10134 Tallinn, e-mail info@aki.ee, website www.aki.ee) or to bring the matter before a court.
8. Security
8.1. The controller applies appropriate technical and organisational measures to protect personal data, including an encrypted connection (HTTPS), restriction of access rights and regular backups.
8.2. Access to personal data is limited to those employees of the controller and those processors for whom it is necessary in order to perform their duties.
8.3. In the event of a personal data breach, the controller will notify the Estonian Data Protection Inspectorate within 72 hours and, where necessary, the data subject as well.
9. Final provisions
9.1. The controller has the right to amend this privacy policy unilaterally. The current version, together with its effective date, is always available on this page.
9.2. For any questions concerning this privacy policy, please contact info@helmut.ee. This is a translation of the Estonian original. In the event of any discrepancy, the Estonian version prevails.
