Skip to content

Privacy Policy

Last updated: Oct 29, 2026

This Privacy Policy explains what personal data we process when you visit www.aidusec.com or contact us, why we do so, and what rights you have. We aim to keep it clear and complete. This Privacy Policy, as amended or otherwise changed from time to time (the “Privacy Policy” or “Policy”), explains the manner in which AIDUSEC OÜ (hereinafter “AIDUSEC OÜ” or the “Company”) maintains and discloses user information obtained through its website www.aidusec.com (the “Site”). The terms “we”, “us” and “our” refer to the Company. By using the Site, you (“User”) consent to the data practices prescribed in this Privacy Policy.

Your Personal Data is processed under this Privacy Policy and in accordance with applicable legislation, including the General Data Protection Regulation (2016/679) (“GDPR”) and the applicable national data protection laws (“Data Protection Law”). The Company acts as the data controller of your Personal Data.

On occasion, the Company may revise this Privacy Policy to reflect changes in the law, our personal data collection and use practices, the features on the Site, or advances in technology. If material changes are made to this Privacy Policy, the changes will be prominently posted on the Site.

01What we process, why, and on what legal basis

We collect and process personal data only where necessary to operate our website, respond to enquiries, provide our services, meet legal obligations, and protect our legitimate interests. The list below sets out each purpose, the data involved, the legal basis under Article 6 of the EU General Data Protection Regulation (GDPR) and how long we keep it.

1.1Operating and securing the website

  • Data collected: IP address, date and time of access, requested pages, referrer, browser and device information, and other technical server-log data.
  • Purpose: To operate, maintain, troubleshoot, and protect the website against security threats and misuse.
  • Legal basis: Article 6(1)(f) GDPR – our legitimate interest in maintaining a secure and functional website.
  • Retention period: Up to 30 days, unless longer retention is necessary to investigate or respond to a security incident.

1.2Responding to enquiries

  • Data collected: Name, email address, company, job title or role, message content, and any other information you choose to provide through our contact form, email, or telephone.
  • Purpose: To respond to questions, discuss potential services, and communicate with prospective clients.
  • Legal basis: Article 6(1)(b) GDPR where processing is necessary to take steps at your request before entering into a contract; otherwise, Article 6(1)(f) GDPR, where applicable.
  • Retention period: Up to 24 months after our last contact, unless a contract follows, a legal obligation applies, or longer retention is necessary to establish, exercise, or defend legal claims.

1.3Contracts and client relationships

  • Data collected: Business contact details, contact information, invoicing and payment records, and communications relating to the engagement.
  • Purpose: To establish and manage client relationships, deliver agreed services, administer contracts, and fulfil accounting and other legal obligations.
  • Legal basis: Article 6(1)(b) GDPR – performance of a contract; and Article 6(1)(c) GDPR – compliance with legal obligations.
  • Retention period: For the duration of the contractual relationship and thereafter for the periods required by applicable law. Accounting records are retained for the period required under applicable Estonian law, which may be up to seven years depending on the record and applicable requirements.

1.4Newsletter communication (if offered)

  • Data collected: Email address, subscription date, and records of consent and subscription confirmation.
  • Purpose: To send newsletters, company updates, or other communications you have subscribed to receive.
  • Legal basis: Article 6(1)(a) GDPR – your consent.
  • Retention period: Until you withdraw your consent; after that, we keep only a record of the consent and its withdrawal where necessary to demonstrate compliance or address legal claims.

1.5Website analytics (if used)

  • Data collected: Pseudonymous usage information, pages viewed, approximate location, and device information, depending on the analytics tools used.
  • Purpose: To understand website usage, evaluate performance, and improve the website.
  • Legal basis: Article 6(1)(a) GDPR – your consent, where required and obtained.
  • Retention period: Up to 14 months, subject to the configuration of the analytics tools used.
  • Cookies and tracking: Non-essential analytics cookies are used only after your consent has been obtained. For further information, see our Cookies Policy.

1.6Legal claims and compliance

  • Data collected: Relevant records, communications, contractual documents, and other information necessary to meet legal obligations or establish, exercise, or defend legal claims.
  • Purpose: To comply with applicable laws, respond to lawful requests, and protect our legal rights and interests.
  • Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation; and Article 6(1)(f) GDPR – our legitimate interests, where applicable.
  • Retention period: For as long as necessary to fulfil the relevant legal obligation or establish, exercise, or defend legal claims, subject to applicable statutory retention periods.

You are not required to give us personal data to browse the Site. If you contact us, we need enough information to reply. We do not process special categories of personal data through this website, and ask you not to send any.

02Cookies and similar technologies

We use only the cookies and storage technologies described in our Cookies Policy. Technologies that are not strictly necessary are used only after you consent, and you can change your choice at any time.

03Who receives your data

We share personal data only where needed and only with:

  • Service providers (processors) that host, secure, deliver or support our website and communications. They act on our instructions under data processing agreements. See Subprocessors & AI for the current list.
  • Professional advisers such as accountants, auditors and lawyers, bound by confidentiality.
  • Authorities where we are legally required to disclose data or need to protect our rights.

We do not sell personal data and we do not share it with third parties for their own advertising.

04Transfers outside the EU/EEA

Where a provider processes data outside the EU/EEA, we rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified US providers) or on Standard Contractual Clauses together with supplementary measures where needed. The location and safeguard for each provider are shown on our Subprocessors & AI page. You can request a copy of the relevant safeguards by writing to us.

05Your rights

Under the GDPR you have the right to:

  • Access: your personal data and receive a copy (Art. 15);
  • Rectification: of inaccurate or incomplete data (Art. 16);
  • Erasure: where the legal conditions are met (Art. 17);
  • Restriction: of processing (Art. 18);
  • Data portability: for data you provided on the basis of consent or contract (Art. 20);
  • Object: to processing based on legitimate interests, on grounds relating to your situation (Art. 21);
  • Withdraw consent: at any time, without affecting the lawfulness of earlier processing (Art. 7(3)).

To exercise a right, use our contact page. We may need to verify your identity, and we will respond within one month, extendable by up to two further months for complex requests as the law allows. Exercising your rights is free of charge unless requests are manifestly unfounded or excessive.

06Complaints

If you believe we process your data unlawfully, you have the right to lodge a complaint with a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee (opens in a new tab), info@aki.ee. You may also complain to the authority in the EU/EEA country where you live or work. We would appreciate the chance to resolve your concern first.

07How we protect your data

We apply technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS), access control on a need-to-know basis, separation of environments, logging, regular updates and vendor due diligence. No online service can be perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the authority and, where required, you.

08Automated decisions and AI

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. How artificial intelligence is or is not used on this website is explained in our AI transparency section.

09Children

This website is intended for business users and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has sent us data, please contact us and we will delete it.

10Changes to this notice

We may update this policy when our processing, providers or the law change. The date at the top shows the latest version. For material changes we will give a clear notice on the website.

11Contact

Questions about this notice or your data: our contact page, or write to AIDUSEC OÜ, Harju County, Tallinn, Kesklinna district, Tornimäe St 5, 10145.

© 2026 AIDUSEC OÜ. All rights reserved.