Data controller
Zoya OÜ (registry code 16775708), Paavli tn 5a/1, 10412 Tallinn, Estonia — [email protected]
GDPR
Privacy Policy
How Zoya OÜ collects, uses and protects personal data under the EU General Data Protection Regulation (GDPR, Regulation 2016/679).
Last updated: 2 November 2026
What we collect
The enquiry form sends your name, email, optional phone and company, service, budget and message to website storage through Lovable Cloud. These enquiries are not public. Submitting a review stores and publicly displays your name, optional company or role, star rating and comment. Please only submit information you wish to publish. Hosting providers may process IP addresses and technical connection data for delivery and security.
Why we process it
To answer enquiries and prepare offers (pre-contractual steps, Art. 6(1)(b)), to deliver and support agreed services (contract), to meet Estonian accounting and tax obligations (legal obligation), and to keep the website secure (legitimate interest).
Retention
Enquiries and reviews are saved in website storage. No automatic deletion schedule is currently configured; request deletion or information about retention at [email protected]. Correspondence is retained only as needed to answer the enquiry, manage a resulting contract or comply with legal obligations. Estonian accounting records must generally be retained for seven years. To ask about retention or request deletion of your correspondence, contact [email protected]; retention in provider logs is governed by the applicable service arrangements.
Recipients and transfers
Website delivery and email involve hosting and email providers. Google Fonts currently receives technical connection data when fonts load. External social and reference sites apply their own policies when you follow their links. If preview diagnostics are available, Lovable may receive technical error details. Personal data is not sold. Where a transfer outside the EEA occurs, the applicable GDPR transfer basis and provider safeguards must be assessed; this notice does not certify that specific agreements have been signed.
Your rights
Request access, correction, erasure, restriction, portability or object to processing at [email protected]. Rights depend on the applicable legal basis. Any consent can be withdrawn without affecting earlier lawful processing. Requests are normally answered within one month; a permitted extension of up to two further months must be explained within the first month. You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee.
Data protection requests and incidents
Send a request or suspected data incident to [email protected] with only the information needed to identify the issue. Identity verification must be proportionate. Zoya must assess the request, protect access to personal data and document the outcome. Where GDPR Art. 33 applies, a personal data breach must be notified to the supervisory authority within 72 hours of awareness; high-risk breaches also require informing affected people under Art. 34. No automated decisions with legal or similarly significant effects are made by this form.
Free first step
Book a free review15-minute infrastructure & needs review
Tell us about your systems, app idea or security setup. We listen, ask the right questions and send a clear plan with a quote — no obligation.