Privacy policy and terms of use
How LEISSON OÜ collects, uses and protects personal data (GDPR) and the terms under which our services are used.
1. General
This document describes how LEISSON OÜ ("we") collects, uses, stores and protects personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act. It applies to the website leisson.eu and to our services. By using the services you accept this policy; if you disagree with any part of it, please do not use our services.
2. Controller
The controller is LEISSON OÜ, registry code 16952932, Tallinn, Estonia. For data-protection matters write to gert@leisson.eu.
3. What data we collect
Through the contact form you voluntarily provide your name, e-mail address, optionally a company name, and the content of your message and optionally a website address. The enquiry is linked to the chosen service and a technical enquiry ID; the IP address is used for a temporary send-rate limit and is not added to the email body. In a client relationship we additionally process the data needed to perform the contract: contact details, invoicing and payment data, and correspondence. Google Analytics is loaded only after separate consent; our hosting provider logs technical data (IP address, browser type, request time) to keep the service running and secure.
4. Purposes and legal basis
Answering your enquiry and preparing a proposal — pre-contractual steps (GDPR art. 6(1)(b)). Providing the service and invoicing — performance of a contract (art. 6(1)(b)) and a legal obligation, including the Accounting Act (art. 6(1)(c)). Website security and technical logs — legitimate interest (art. 6(1)(f)). Marketing messages are sent only with your consent (art. 6(1)(a)), which you may withdraw at any time.
5. Who we share data with
We do not sell or rent personal data. Data is processed on our behalf only by authorised processors: hosting (Vercel, EU/USA), contact-form e-mail delivery (Resend, USA), consent-based analytics (Google Analytics), accounting (Estonia) and, where needed, legal advisers (Estonia). For transfers outside the EU/EEA we rely on the European Commission's standard contractual clauses (GDPR art. 46). Data may be disclosed to public authorities where the law requires it.
6. Retention
Contact-form enquiries: up to 2 years after the last exchange. Client data: for the duration of the contract and 3 years after it ends. Accounting records: 7 years under the Accounting Act. Marketing consent: until withdrawn. After the retention period the data is deleted or anonymised.
7. Your rights
You have the right to access your data, have it corrected or erased, restrict processing, object, receive your data in a portable format and withdraw consent. To exercise these rights write to gert@leisson.eu — we reply within 30 days and may ask for additional information to verify your identity. You may lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee).
8. Cookies
leisson.eu uses only what is strictly necessary for the site to work (for example remembering your language and theme preference in device storage). Google Analytics is used only with consent. It measures page views, service selection and enquiries accepted by the mail provider; form text, email addresses and enquiry IDs are not sent to analytics. The choice is stored on your device for up to 180 days. You can change it at the bottom of every page; declining stops collection and removes accessible analytics cookies.
9. Terms of use (summary)
The exact scope, timeline and fees of a service are agreed in a separate proposal or contract. Invoices are issued electronically with a payment term of 14 calendar days unless agreed otherwise; prices are final and no VAT is added, as LEISSON OÜ is not registered for VAT. Custom deliverables created for a client become the client's property once the final invoice is paid; our general tooling, methods and design-system components remain the intellectual property of LEISSON OÜ. We ask for separate permission before publishing a client project in our portfolio. Services are provided "as is"; total liability is limited to the fees paid in the preceding 12 months and excludes indirect loss. The terms are governed by the law of the Republic of Estonia; disputes are first resolved by negotiation, then in Harju County Court.
10. Changes and how to reach us
We may amend the policy and the terms; material changes are announced on the website at least 30 days in advance. The current version and its effective date are always shown at the top of this page. Questions: gert@leisson.eu.