Privacy
policy.

Effective: 25 October 2026.

Who is responsible

Tarkmote OÜ is the controller of personal information collected through tarkmote.com for website operation and business enquiries. Contact us using the details below for privacy questions or requests.

Tarkmote OÜ · Estonian registry code 14359704 · VAT EE102089741
Ranna tn 6, Võiste, 86501, Estonia
[email protected]

This policy covers this company website and related enquiry correspondence. If we process personal data on behalf of a client while delivering a project, the relevant service agreement and data-processing terms govern that work.

Information we use and why

Project enquiries

When you contact us, we receive your name, email address, message, selected service interest and any other information you choose to provide. We use this information to understand your request, reply, discuss scope and prepare a proposal. Enquiries submitted through the website are stored in our Odoo customer relationship management system.

Where you ask us to take steps before entering a contract with you personally, our legal basis is taking those pre-contractual steps. For enquiries made on behalf of an organisation, our legal basis is our legitimate interest in responding to business enquiries and developing relevant business relationships. We do not add you to a marketing mailing list just because you submit the form.

The form requires your name, email address and message so we can understand and answer the enquiry. You do not have to contact us, but without suitable contact details we may be unable to reply. Please do not send passwords, access tokens, sensitive personal information or confidential datasets.

Website operation and security

Requests to the website can include an IP address, request time, requested address, browser/device information and technical error or security information. We use technical records to operate the website, diagnose problems and prevent misuse. Our legal basis is our legitimate interest in maintaining a reliable and secure website.

Legal responsibilities

If an enquiry becomes an engagement, we may need business correspondence and transaction records to perform the agreement, meet legal obligations or establish, exercise or defend legal claims. Those records are subject to the applicable contractual and statutory requirements, rather than the unsuccessful-enquiry period below.

Who may receive information

Access is limited to people who need the information to handle the enquiry, operate our systems or meet legal responsibilities. This may include authorised team members and contractors, infrastructure and communications service providers, and professional advisers where necessary.

Cloudflare provides the public delivery and security layer for this website and processes connection information to provide those services. You can read Cloudflare’s privacy policy for its processing information. We may also disclose information where required by law or where necessary to protect legal rights.

Cloudflare processes relevant website data under its Customer Data Processing Addendum. We use its delivery and security services on the basis of our legitimate interest in operating a reliable website and preventing abuse.

Our Odoo application, database and filestore are self-hosted by Tarkmote on its own hardware in Poland. We use Brevo for transactional email delivery, not marketing campaigns. Information needed to deliver a message, including recipient details and message content, may be processed by Brevo. See Brevo’s privacy information.

Brevo acts as our email processor under the data-processing provisions of its Terms of Service. Transactional messages support the enquiry and contractual purposes described above; we do not operate a newsletter subscription through this website.

Processing outside the European Economic Area

Our external providers may process data outside the EEA. We have agreed to the applicable data-processing terms for Cloudflare, Brevo and Google Analytics. Depending on the recipient and transfer, the arrangements rely on an applicable adequacy decision, including the EU–US Data Privacy Framework for covered recipients, or Standard Contractual Clauses and supplementary safeguards where required. A provider’s European data-storage location does not by itself exclude international access or onward processing.

Contact [email protected] for information about the safeguards applicable to your data and how to obtain a copy.

How long we keep information

We keep unsuccessful project enquiries for 90 days after the enquiry is closed, unless a legal obligation or a specific legal claim requires longer retention. If we start working together, relevant information becomes part of the client records and is retained according to the agreement and applicable legal requirements.

Our approved retention schedule is 90 days for routine website access and application/error logs, and one year for security events and administrative audit records. Records needed for an active incident or legal claim may be retained until that matter is resolved, with periodic review of the continuing need.

Our approved backup retention period is up to one year from creation. As a result, information removed from active records can remain in restricted recovery copies until those copies expire. Recovery procedures need to preserve applicable deletion and restriction decisions when restoring a backup.

We are implementing this retention schedule. Daily backups are in place; automated backup expiry and routine log and enquiry cleanup are not yet enabled. You can contact us about a specific retention or deletion request while this work is completed.

Your choices and rights

Under applicable data-protection law, you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing and, where applicable, portability. You may object to processing based on legitimate interests on grounds relating to your situation. If processing is based on consent, you may withdraw consent without affecting processing that took place before withdrawal.

Email [email protected] with your request. We may ask for proportionate information to confirm your identity. We normally respond within one month; where the law allows an extension, we will explain it. Some rights are subject to legal exceptions.

You may complain to the Estonian Data Protection Inspectorate or the competent supervisory authority where you live or work or where you believe an infringement occurred. You do not have to contact us first.

Cookies and similar technologies

Odoo uses browser storage and cookies for features such as sessions and language preferences. Cloudflare security services may set cookies when checking requests or remembering a completed security challenge. Blocking these technologies can affect site or form functionality.

See Cloudflare’s cookie information for the cookies associated with its enabled services. Not every cookie described there is necessarily used on this website.

Google Analytics

We use Google Analytics to understand how visitors use the website and which content is useful. Depending on the configuration and your choices, it can process page views, interactions, approximate location, browser/device information and online identifiers, including cookie identifiers. Google receives information to provide the analytics service. See how Google uses information from sites using its services.

The legal basis for optional analytics is your consent. Google Analytics is covered by the applicable Google Ads Data Processing Terms, which include Analytics among the processor services.

The new consent controls let you accept or reject analytics independently of using the website. Google Analytics is loaded only after acceptance. You can withdraw your choice using the Cookie settings button; this stops future analytics on this browser, but does not automatically erase information already collected. Your choice is saved in a first-party preference cookie for 180 days. You can also contact us about your data rights.

Google Analytics user/event data retention is set to 14 months, with reset on new activity disabled. This setting does not determine the retention of standard aggregate reports.

Changes to this policy

We will update this page when our processing changes and show the effective date of the revised policy. For questions about this policy, contact [email protected].