Privacy Policy

1. Controller

The controller responsible for data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is:

Byteweb OÜ
Sepapaja tn 6, 15551 Tallinn, Estonia
hello@byteweb.io

2. Hosting and server log data

This website is hosted on a server located within the European Union. Each time this website is accessed, our hosting provider's server automatically records technical data required to deliver the page and keep it secure: the requesting device's IP address, the date and time of access, the page requested, the browser type and version, and the referring page. This data is processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in operating a secure and functional website, and is not combined with any other data source.

3. Cookies and similar storage

This website uses only strictly necessary cookies: a session cookie and a security (CSRF-protection) cookie, both required for the site to function and both deleted automatically at the end of your browser session. Neither is used for tracking or advertising, and neither requires consent under Art. 6(1)(f) GDPR / § 25(2) TTDSG.

If you interact with the contact form, Google reCAPTCHA may additionally set its own cookies (e.g. "_GRECAPTCHA") needed for it to function — see section 5 below. These are only set once you start filling in the form, never on page load.

On your first visit, a cookie consent banner asks whether you accept optional analytics cookies (see section 6). Your choice — accept, reject, or a per-category setting — is remembered in your browser's local storage, not a cookie, so the banner does not reappear; nothing is sent to us or to any third party either way. You can change your choice at any time via the "Cookie settings" link in the footer.

4. Contact form

When you submit the contact form, we process the information you provide — your name, email address, and message, plus phone, company name, and your stated need or budget if you choose to share them — in order to respond to your enquiry. This processing is based on your consent (Art. 6(1)(a) GDPR), given by ticking the consent checkbox before submitting.

We also record the language and page you submitted from, and a spam-likelihood score from Google reCAPTCHA (see section 5). Submitted enquiries are stored only in our own internal system — no third-party CRM or mailing tool is used, and no automatic confirmation or notification email is sent. We keep enquiry data for as long as needed to handle it and for a reasonable follow-up period; you can request its deletion at any time using the address in section 1.

Concretely, that period is 24 months from the last activity on an enquiry. After it, we erase the personal details automatically — your name, email address, phone number, company, and the message itself — and delete any internal notes about you. What remains is anonymous: the type of need, the budget range, the language, and the outcome, with nothing linking it back to you. You can ask us to erase it sooner at any time using the address in section 1.

5. Google reCAPTCHA

To protect the contact form from spam and abuse, we use Google reCAPTCHA v3, a service provided by Google Ireland Limited. reCAPTCHA runs invisibly once you interact with the form and analyzes technical signals — such as your IP address, browser and device characteristics, and interaction patterns — to produce a bot-likelihood score. This score only helps us judge each enquiry; it never blocks a submission by itself.

This involves transferring data to Google's servers, including in the United States; Google is certified under the EU-U.S. Data Privacy Framework as the safeguard for that transfer (Art. 44 et seq. GDPR). This processing is based on our legitimate interest in preventing abuse of the contact form (Art. 6(1)(f) GDPR).

For details, see Google's Privacy Policy and Terms of Service.

6. Google Analytics 4

With your consent, given via the cookie banner described in section 3, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, to understand how visitors use this site — which pages are viewed, and in what language. Analytics is off by default; nothing is set and no data reaches Google until you actively accept it, and you can withdraw acceptance at any time via the "Cookie settings" link in the footer, which stops any further collection.

This involves transferring data to Google's servers, including in the United States; Google is certified under the EU-U.S. Data Privacy Framework as the safeguard for that transfer (Art. 44 et seq. GDPR). This processing is based on your consent (Art. 6(1)(a) GDPR).

For details, see Google's Privacy Policy and Analytics' own cookie use disclosure.

7. WhatsApp click logging

When you tap a "Message us on WhatsApp" button, we record that the tap happened — which conversation starter, in which language, on which page — before your browser opens WhatsApp. This log is anonymous: it stores no name, number, or identifier connecting it to you or to any other record, and it does not depend on or require the cookie consent described in section 3. It exists purely so we can see which conversation starters are useful, on the basis of our legitimate interest in improving the site (Art. 6(1)(f) GDPR).

8. Your rights

Under the GDPR, you have the right to request access to, correction of, or deletion of your personal data, to restrict or object to its processing, and to data portability. You also have the right to lodge a complaint with a data protection supervisory authority. To exercise any of these rights, contact us at the address above.

9. Supervisory authority

As Byteweb OÜ is established in Estonia, the competent data protection supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia.