Privacy policy

1. Controller

Humanos Tech OÜ is the controller of the data of people who visit this website, write to us through the contact form or act as contact persons for our clients. For any data protection question, write to us at privacy@humanostech.com.

2. Data inside the Vahetus service

The data that client companies and their users enter into Vahetus (for example, email address, role, projects, hours logged, adjustments, flags, appeals and attachments) are processed on behalf of each client company, which is the controller. Humanos Tech acts as processor under Article 28 of the GDPR.

If you use Vahetus as a freelancer or account manager, the company that gave you access is the one that informs you about that processing and handles your rights. We will help with everything needed if they ask us to.

3. What data we process

• Contact form: full name, company, email address, team size and the message you send us.
• Commercial relationship: contact and billing details of the people who represent the client.
• Browsing: technical data logged by the server when serving pages (IP address, browser, date and time), for security purposes.

4. Purposes and legal basis

• Replying to your request and preparing your proposal, at your request, as a pre-contractual step (Article 6(1)(b) GDPR).
• Managing the agreement with the client and its invoicing (Article 6(1)(b) GDPR).
• Complying with legal accounting and tax obligations (Article 6(1)(c) GDPR).
• Protecting the security of the website and the service, based on our legitimate interest (Article 6(1)(f) GDPR).

5. Recipients

We do not sell your data or share it for advertising purposes. Only the providers we need in order to operate have access to it, under a data processing agreement and with confidentiality and security obligations: the contact form delivery service (Web3Forms), the hosting of this website (Hostinger International Ltd., Cyprus), the hosting of the Vahetus application (OVH SAS, France) and the email provider.

6. International transfers

If any provider processes data outside the European Economic Area, the transfer takes place with the appropriate safeguards of Chapter V of the GDPR, such as the standard contractual clauses approved by the European Commission.

7. Retention period

• Contact requests: as long as needed to handle them and, at most, twelve months from the last contact if no agreement is signed.
• Contractual and billing data: for the duration of the agreement and, afterwards, for the retention period required by Estonian accounting law, which is seven years.
• Server technical logs: for the minimum time needed for security reasons.

8. Security

We apply technical and organisational measures appropriate to the risk. In Vahetus, for example, passwords are stored only as hashes, every session can be revoked immediately and the history of hours is protected by a chain of cryptographic hashes.

9. Your rights

You can exercise your rights of access, rectification, erasure, restriction of processing, portability and objection by writing to us at privacy@humanostech.com. We will reply within one month at the latest.

10. Complaints

If you believe we are not handling your data properly, you can lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, info@aki.ee) or with the data protection authority of your country.

11. Changes to this policy

We may update this policy. The date of the last update appears at the top of this document.