Privacy Policy

Last Updated: October 29, 2025 Effective Date: October 28, 2025

1. Introduction

This Privacy Policy explains how AEONEX OÜ (trading as “ExaOne Digital,” “we,” “us,” or “our”) collects, uses, stores, and protects your personal data when you use our website, services, or communicate with us.

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and all applicable Estonian and European Union data protection laws.

2. Data Controller

AEONEX OÜ Registry Code: 17350891 Registered Address: Tornimäe tn 5, 10145 Tallinn, Estonia Email: [email protected] Public Contact: [email protected]

For any questions about this Privacy Policy or your personal data, please contact us at [email protected].

3. Personal Data We Collect

We collect and process the following categories of personal data:

3.1 Business Contact Information

When you contact us or engage our services:

Full name
Business email address
Company name and position
Phone number (if provided)
Business communication history

3.2 Website Usage Data

When you visit our website:

IP address
Browser type and version
Operating system
Pages visited and time spent
Referral source
Device information
Cookies and similar tracking technologies (see our Cookie Policy)

3.3 Client Area Registration

If you register for our client area:

Account credentials (email, password)
Company information
Project-related information
Communication preferences

3.4 Contact Forms

When you submit a contact form:

Name, email, company (as provided)
Message content
Timestamp of submission

We do not collect sensitive personal data such as racial origin, political opinions, religious beliefs, health data, or biometric data.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

4.1 Legitimate Interest (Art. 6(1)(f))

Processing business contact information for B2B marketing and business development
Website analytics to improve our services
Security and fraud prevention
Internal business administration

4.2 Contract Performance (Art. 6(1)(b))

Delivering services you have requested or purchased
Client communication and project management
Invoicing and payment processing

Marketing communications (where consent is required)
Non-essential cookies and tracking technologies
Newsletter subscriptions

4.4 Legal Obligation (Art. 6(1)(c))

Accounting and tax compliance (7-year retention in Estonia)
Responding to legal requests or court orders

You have the right to object to processing based on legitimate interest at any time by contacting us at [email protected].

5. Purpose of Data Processing

We use your personal data for the following purposes:

5.1 Service Delivery

Providing SEO, consulting, and automation services
Project management and client communication
Technical support and issue resolution

5.2 Business Operations

Responding to inquiries and contact form submissions
Client onboarding and account management
Invoicing, payment processing, and accounting
Contract management

5.3 Marketing and Business Development

Sending relevant business communications about our services
Industry insights and company updates (with consent)
Building long-term business relationships

5.4 Website Improvement

Analyzing website usage to improve user experience
Technical maintenance and security
Performance optimization

5.5 Legal Compliance

Meeting accounting and tax obligations under Estonian law
Responding to regulatory requests
Protecting our legal rights

We do not sell, rent, or trade your personal data. We may share your data with the following categories of third parties:

6.1 Service Providers

We work with trusted service providers who process data on our behalf:

Website Hosting: Vercel (USA) - GDPR-compliant, EU data residency options
Email Services: (if applicable) - for business communications
Analytics: Vercel Analytics (privacy-friendly, no cookies, no personal data collection)
Payment Processors: (if applicable) - for invoice processing

All third-party processors are bound by data processing agreements and GDPR compliance requirements.

6.2 Legal Requirements

We may disclose personal data if required by law, court order, or to:

Comply with legal obligations
Protect our rights, property, or safety
Prevent fraud or security threats

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity, subject to GDPR requirements.

6.4 International Data Transfers

Some of our service providers may be located outside the European Economic Area (EEA). When we transfer data internationally, we ensure:

Adequate safeguards under GDPR Chapter V
Standard Contractual Clauses (SCCs) approved by the European Commission
Data Processing Agreements with GDPR compliance requirements

7. Data Retention

We retain personal data only as long as necessary for the purposes outlined in this policy:

7.1 Business Contacts

Active Relationships: Duration of business relationship + 7 years (Estonian accounting law)
Marketing Prospects: Until consent is withdrawn or 3 years of inactivity

7.2 Website Data

Analytics: 26 months (standard analytics retention)
Server Logs: 90 days

7.3 Client Data

Project Records: Duration of contract + 7 years (accounting, warranty claims)
Client Communications: Duration of relationship + 3 years

7.4 Contact Forms

Inquiries: 2 years from last contact or until purpose fulfilled

After retention periods expire, we securely delete or anonymize personal data.

You have the following rights regarding your personal data:

8.1 Right of Access (Art. 15)

You can request a copy of the personal data we hold about you.

8.2 Right to Rectification (Art. 16)

You can request correction of inaccurate or incomplete data.

8.3 Right to Erasure (Art. 17)

You can request deletion of your data (“right to be forgotten”) when:

Data is no longer necessary for the original purpose
You withdraw consent (where processing is based on consent)
You object to processing based on legitimate interest
Data has been unlawfully processed

Exceptions: We may retain data if required by law (e.g., accounting obligations).

8.4 Right to Restrict Processing (Art. 18)

You can request limited processing while we verify accuracy or assess objections.

8.5 Right to Data Portability (Art. 20)

You can receive your data in a structured, machine-readable format and transmit it to another controller.

8.6 Right to Object (Art. 21)

You can object to processing based on legitimate interest, including direct marketing.

Where processing is based on consent, you can withdraw it at any time without affecting prior lawful processing.

8.8 Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or significant effects.

How to Exercise Your Rights

9. Data Security

We implement appropriate technical and organizational measures to protect personal data:

9.1 Technical Measures

Encryption in transit (HTTPS/TLS)
Secure password storage (hashing and salting)
Regular security updates and patches
Access controls and authentication

9.2 Organizational Measures

Limited access to personal data (need-to-know basis)
Employee training on data protection
Data processing agreements with third parties
Regular security assessments

9.3 Data Breach Notification

In the event of a data breach, we will:

Notify the Estonian Data Protection Inspectorate within 72 hours (if required)
Notify affected individuals without undue delay (if high risk)
Document the breach and response measures

10. Cookies and Tracking Technologies

We use cookies and similar technologies for website functionality, analytics, and user experience. For detailed information, please see our Cookie Policy.

Essential Cookies: Required for website functionality (no consent needed) Analytics Cookies: Website performance and improvement (consent required) Marketing Cookies: Not currently used (consent required if implemented)

You can manage cookie preferences through your browser settings or our cookie consent banner.

11. Third-Party Links

Our website may contain links to third-party websites, services, or content. We are not responsible for the privacy practices of these external sites. We recommend reviewing their privacy policies before providing personal data.

12. Children’s Privacy

Our services are designed for business-to-business (B2B) use and are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware of such collection, we will delete it promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or services. When we make material changes, we will:

Update the “Last Updated” date at the top of this policy
Notify you via email (for registered clients)
Display a prominent notice on our website

We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.

14. Supervisory Authority

If you believe we have not addressed your privacy concerns adequately, you have the right to lodge a complaint with the supervisory authority:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) Address: Tatari 39, 10134 Tallinn, Estonia Phone: +372 627 4135 Email: [email protected] Website: https://www.aki.ee

You also have the right to seek judicial remedy if you believe your rights under GDPR have been violated.

15. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Data Protection Contact: AEONEX OÜ Email: [email protected] Address: Tornimäe tn 5, 10145 Tallinn, Estonia

General Inquiries: Email: [email protected] Website: https://exaone.digital

Acknowledgment: By using our website or services, you acknowledge that you have read, understood, and agree to this Privacy Policy.

This Privacy Policy is compliant with Regulation (EU) 2016/679 (General Data Protection Regulation) and Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).