GDPR statement

1. Our commitment

We process personal data lawfully, fairly and openly, collect only what we need, and keep it no longer than we need it. The privacy policy describes what this website collects; this statement sums up how the rules are applied.

2. Controller

Aerion OÜ, registry code 17328101, VAT number EE102902048, registered office in Tallinn, Estonia. contact@aerion.ee, +372 5690 1376.

3. Data protection officer

Given our size and what we process, we have not appointed a formal data protection officer. Data protection questions go to contact@aerion.ee, where the responsible director handles them.

4. Legal bases

• Booking an inspection: steps you ask for before a contract, and the contract itself, Article 6(1)(b).
• The waitlist: your consent, Article 6(1)(a). You can withdraw it at any time.
• The contact form and email: our legitimate interest in answering you, Article 6(1)(f).
• Hosting and security of the website: legitimate interest, Article 6(1)(f).
• Records the law requires, such as accounting: legal obligation, Article 6(1)(c).

5. Data minimisation

Our forms ask only for what we need to answer you. Everything marked optional can be left empty.

6. Your rights

You have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21), and the right not to be subject to decisions based solely on automated processing that have legal or similarly significant effects (Article 22). Where processing is based on consent, you can withdraw it at any time.

7. Response time

We confirm a request as soon as we reasonably can and answer it within 30 days, in line with Article 12(3). For complex or many requests the period can be extended by up to two more months, and we tell you if that happens.

8. Processors and other recipients

• Netlify (USA): hosts the website and keeps server logs.
• FormSubmit (formsubmit.co): delivers form messages to our inbox, outside the European Union.
• Our email provider: stores the emails we receive and send.
• GeoJS (get.geojs.io): answers the city guess on the network page; your browser sends it your IP address directly. See the privacy policy.

If this list changes, we update this statement.

9. Transfers outside the EU

Some of the services above process data outside the European Union and the European Economic Area, including in the United States. We use them only where the GDPR’s rules for such transfers (Chapter V) are met.

10. Supervisory authority

The supervisory authority for Aerion OÜ is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee. You can complain to it if you think your data has been processed unlawfully.