Privacy policy and terms of use
How LEISSON OÜ collects, uses and protects personal data (GDPR) and the terms under which our services are used.
1. General
This document describes how LEISSON OÜ ("we") collects, uses, stores and protects personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act. It applies to the website leisson.eu and to our services. By using the services you accept this policy; if you disagree with any part of it, please do not use our services.
2. Controller
The controller is LEISSON OÜ, registry code 16952932, Tallinn, Estonia. For data-protection matters write to gert@leisson.eu.
3. What data we collect
Through the contact form you voluntarily provide your name, e-mail address, optionally a company name, and the content of your message and optionally a website address. The enquiry is linked to the chosen service and a technical enquiry ID; the IP address is used for a temporary send-rate limit and is not added to the email body. In a client relationship we additionally process the data needed to perform the contract: contact details, invoicing and payment data, and correspondence. Google Analytics is loaded only after separate consent, while cookieless Vercel Web Analytics counts page views in aggregate (see section 8); our hosting provider logs technical data (IP address, browser type, request time) to keep the service running and secure.
4. Purposes and legal basis
Answering your enquiry and preparing a proposal — pre-contractual steps (GDPR art. 6(1)(b)). Providing the service and invoicing — performance of a contract (art. 6(1)(b)) and a legal obligation, including the Accounting Act (art. 6(1)(c)). Website security and technical logs — legitimate interest (art. 6(1)(f)). Marketing messages are sent only with your consent (art. 6(1)(a)), which you may withdraw at any time.
5. Who we share data with
We do not sell or rent personal data. Data is processed on our behalf only by authorised processors: hosting and cookieless visit statistics (Vercel, EU/USA), contact-form e-mail delivery (Resend, USA), consent-based analytics (Google Analytics), accounting (Estonia) and, where needed, legal advisers (Estonia). For transfers outside the EU/EEA we rely on the European Commission's standard contractual clauses (GDPR art. 46). Data may be disclosed to public authorities where the law requires it.
6. Retention
Contact-form enquiries: up to 2 years after the last exchange. Client data: for the duration of the contract and 3 years after it ends. Accounting records: 7 years under the Accounting Act. Marketing consent: until withdrawn. After the retention period the data is deleted or anonymised.
7. Your rights
You have the right to access your data, have it corrected or erased, restrict processing, object, receive your data in a portable format and withdraw consent. To exercise these rights write to gert@leisson.eu — we reply within 30 days and may ask for additional information to verify your identity. You may lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee).
8. Cookies
Without analytics consent, leisson.eu stores only your choice (allowed or declined) on your device. Cookieless Vercel Web Analytics also runs only with analytics consent. Consent given before version 1.7 of this notice covers Google Analytics only; we ask again before Vercel measurement. The Vercel script writes nothing to your device, but on every page view it reads the key "__va_attribution" from browser storage and, if the key exists, sends its content with the page view (leisson.eu never writes this key). Every page view sends the page address without query string or fragment; the first page view also sends the referring page address in the form the referring page gives it to the browser (usually only the domain, but it can be the full address including its query string). Vercel derives country, device and browser type from the request, uses the data for aggregate statistics and, by its own description, distinguishes visitors only by a hash valid for one day. Client portal pages are not measured. The basis is consent (GDPR art. 6(1)(a)). If analytics is allowed, the label of the page area where a service was last chosen (for example the home price list) is kept for the session, without personal data, and Google Analytics sets its own cookies. Google Analytics is used only with consent. It measures page views, service selection and enquiries accepted by the mail provider; form text, email addresses and enquiry IDs are not sent to analytics. The choice is stored on your device for up to 180 days. You can change it at the bottom of every page; after declining, the page starts no new Vercel measurement requests, Google Analytics is disabled and its script removed, and accessible analytics cookies are removed.
9. Terms of use (summary)
The exact scope, timeline and fees of a service are agreed in a separate proposal or contract. Invoices are issued electronically with a payment term of 14 calendar days unless agreed otherwise; prices are final and no VAT is added, as LEISSON OÜ is not registered for VAT. Custom deliverables created for a client become the client's property once the final invoice is paid; our general tooling, methods and design-system components remain the intellectual property of LEISSON OÜ. We ask for separate permission before publishing a client project in our portfolio. Services are provided "as is"; total liability is limited to the fees paid in the preceding 12 months and excludes indirect loss. The terms are governed by the law of the Republic of Estonia; disputes are first resolved by negotiation, then in Harju County Court.
10. Changes and how to reach us
We may amend the policy and the terms; material changes are announced on the website at least 30 days in advance. The current version and its effective date are always shown at the top of this page. Questions: gert@leisson.eu.