Privacy policy

What data

• Report form: the company you select, the subject line, your message, your optional e-mail address and the publication consent box.
• Reply form: the replying company or person, e-mail address (required), the statement concerned and the message.
• E-mail: if you write to us directly, your address and what you write.
• Technical data: the hosting provider processes IP address and browser information in server logs for security. To limit abuse, the form may briefly keep a truncated one-way hash of the IP address; the IP address itself is not stored.
• Cookies and analytics: no cookies are used. Visit counts are measured with Cloudflare Web Analytics, which is cookieless, does not profile visitors and stores no personal data.

Purpose and legal basis

• Assessing reports and replying to you where needed: legitimate interest (GDPR Art. 6(1)(f)).
• Publishing your report as an anonymous complaint type: only with your explicit consent (Art. 6(1)(a)); you can withdraw consent at any time.
• Publishing a response under the right of reply: legitimate interest.
• Information about the companies and the board member named on the site: from public registry records, on the basis of legitimate interest in informing the public and freedom of expression; personal data such as identification numbers or home addresses is not published.

Who processes the data

• Cloudflare (hosting, form endpoint and forwarding e-mails sent to contact@globalestonia-complaints.com to the site operator’s mailbox).
• The site operator’s e-mail provider (storing forwarded e-mails and form notifications).
• Resend (delivering the form content to the site operator by e-mail).
• Optionally a Cloudflare key-value store (backup of form records).

These providers may process data outside the EU/EEA; transfers rely on the safeguards they offer (for example standard contractual clauses). Data is not sold, not used for advertising and not shared with the companies named.

Retention

• Form messages and e-mails: as long as needed for assessment, at most 24 months after the last correspondence.
• Your e-mail address: deleted when no longer needed or on request.
• Published anonymous complaint types: remain while the site is online; you can ask for removal.
• Server logs: according to the hosting provider’s own retention period.

Your rights

You have the right to access, rectify and erase your data, to restrict and object to processing, and to withdraw publication consent. Requests: contact@globalestonia-complaints.com; answered within one month. You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the data protection authority of your country. Companies and persons named on the site can also send correction requests through the Right of reply page.

Controller

The identity of the person running the site is not published because of the risk of retaliation. Data protection requests are made to the e-mail address above and handled with the same care.