PRIVACY
POLICY

GENERAL DATA PROTECTION REGULATION (GDPR)

We are a Data Controller of your information. xynn OÜ's legal basis for collecting and using personal information depends on the information we collect and the context: performance of a contract with you, your permission, our legitimate interests, or compliance with the law.

We retain your personal information only as long as necessary for the purposes set out in this policy, to comply with legal obligations, resolve disputes and enforce our policies. Specific retention periods are stated in the relevant sections below.

If you are a resident of the European Economic Area (EEA), you have certain data protection rights: the right to access, update or delete your information; rectification; objection; restriction; data portability; and withdrawal of consent. To exercise them, please contact us.

You also have the right to lodge a complaint with a supervisory authority. For xynn OÜ the competent authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). The data controller's identity and contact details are available in our Legal Notice.

CONTACT FORM & PROJECT BRIEFS

When you send us a project brief through the form on our Start a Project page, we collect the information you provide: your name, your email address, the services you select and your project description.

We use this information to respond to your inquiry and, where relevant, to prepare a proposal — the legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR). We also analyse past inquiries to improve our website, our services and the information we present (Art. 6(1)(f) GDPR — legitimate interest). Your brief is delivered to our company mailbox, a confirmation email summarising your brief is sent to the address you provide, and a copy is stored in our database. If you receive such a confirmation without having submitted a brief, someone else entered your address — you can ignore the email or contact us to have the record deleted.

We retain project briefs and the related correspondence for 7 years from our last contact with you — aligned with the retention period for business records under Estonian accounting law — after which they are deleted automatically. You can request earlier deletion of your brief at any time.

SERVICE PROVIDERS

We use Google Firebase (Google Ireland Ltd. / Google LLC) to host this website and operate its supporting services: hosting, serverless functions, database, remote configuration and analytics. Depending on the service, data may be processed in the European Union and/or the United States under Google’s data processing terms.

To protect our contact form against automated abuse, we use Google reCAPTCHA (via Firebase App Check) on the Start a Project page. reCAPTCHA evaluates technical signals such as your IP address and browser characteristics and may set cookies for this purpose. The legal basis is our legitimate interest in preventing fraud and abuse (Art. 6(1)(f) GDPR).

We use Resend Inc. (USA) to deliver email sent through this website, for example project briefs. Resend is certified under the EU-U.S. Data Privacy Framework, which provides the legal basis for this transfer. For details see Google's privacy policy and Resend's privacy policy.

GOOGLE ANALYTICS

Google Analytics runs only after you accept cookies in our cookie banner (Art. 6(1)(a) GDPR — consent); if you decline, it is never loaded and no analytics cookies are set.

When enabled, we use Google Analytics to understand how you use our website, improve its design and functionality, and get the most out of our marketing campaigns. Google utilizes the data collected to track and examine use of this application, prepare reports and share them with other Google services, and may use it to contextualize and personalize ads in its own advertising network. Personal data processed: cookies, usage data. Place of processing: United States / Ireland. Under the CCPA this is categorized as internet or other electronic network activity information; this processing constitutes a sale according to the CCPA, VCDPA, CPA, CTDPA and UCPA.

LOG FILES

xynn follows a standard procedure of using log files, which log visitors to the website. Information collected includes IP addresses, browser type, ISP, date and time stamp, referring/exit pages and possibly click counts — not linked to personally identifiable information. It is used for analyzing trends, administering the site, tracking movement and gathering demographic information.

COOKIES AND SIMILAR TECHNOLOGIES

xynn OÜ uses cookies and similar local-storage technologies in two ways. Strictly necessary storage: your accept-or-decline decision from the cookie banner is kept in your browser’s local storage so we do not ask you again on every visit. Analytics cookies: set by Google Analytics only after you accept. You can additionally disable cookies through your browser options.

THIRD-PARTY PRIVACY POLICIES

Our Privacy Policy does not apply to the third-party services named above. When these providers process data on their own behalf, their respective privacy policies apply — consult them for more detailed information, including available opt-outs. xynn has no access to or control over cookies set by third parties.

CHILDREN'S INFORMATION

xynn does not knowingly collect personal identifiable information from children under 13. If you believe your child provided such information on our website, contact us immediately and we will promptly remove it from our records.

ONLINE PRIVACY POLICY ONLY

This policy applies only to our online activities and to information shared and/or collected on xynn — not to information collected offline or via other channels.

CONSENT

Analytics cookies are set only after you explicitly accept them via our cookie banner. You can change or withdraw your decision at any time by clearing this website’s site data in your browser — the banner will then ask again on your next visit. By using our website, you agree to this Privacy Policy.