Privacy notice

Who is responsible for your data

Winch OÜ, the company that operates Noda (see Company details), is the controller of the personal data described here. Questions: [email protected].

What we collect

• What you enter in our forms: name, work e-mail, company, country, your message, website link, call preference and any optional answers.
• What you send us by e-mail, and our replies.
• When you become a client: the identity details we need for client checks and sanctions screening.
• Technical logs kept by our hosting provider for security, for 30 days.
• Cookies: none. We measure visits with Cloudflare Web Analytics, which sets no cookies and does not identify you.

Why, and on what legal basis

• To answer your request and prepare a proposal: steps you ask for before a contract (GDPR, Article 6(1)(b)).
• To run our contract with you: performance of the contract (Article 6(1)(b)).
• To check client identity, screen against sanctions lists and keep customs and accounting records: legal obligations (Article 6(1)(c)).
• To keep our correspondence and protect our rights: legitimate interests (Article 6(1)(f)).

Who receives your data

• Our providers for hosting, forms and e-mail: Cloudflare (hosting, forms and e-mail routing), Google (e-mail), Resend (e-mail delivery, EU region) and Google (Sheets, our copy of your request), under data processing agreements.
• A partner, such as a warehouse, only when we ask it for a quote for you, and only what it needs to quote.
• Authorities, where the law requires it.
• Transfers outside the EEA: Cloudflare, Inc., Google LLC and Resend, Inc. in the United States, under the EU–US Data Privacy Framework or the EU standard contractual clauses.

How long we keep it

• Enquiries that don't lead to a contract: 12 months.
• Client records: as long as the law requires for customs, tax and accounting records, seven years.

Your rights

You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on legitimate interests. Write to [email protected]. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).