Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Praetorian Digital OÜ
Tornimäe tn 5, 10145 Tallinn, Estonia
Registration number: 17393771
Email: joram@praetorian-digital.com
Represented by: Joram Höfs (management board)

Data Protection Officer: A DPO is likely not mandatory under Art. 37 GDPR / § 38 BDSG given the current processing (small company, no large-scale/systematic monitoring, no special categories of personal data).

EU representative (Art. 27 GDPR): Not required. The controller is established in Estonia and thus within the EU; Art. 27 applies only to controllers without an establishment in the Union.

2. Overview / what data we process

This website is deliberately data-minimal. It has no contact form and no newsletter or email capture. There is no web analytics, no tracking and no advertising. No content is loaded from third-party servers (e.g. content delivery networks, Google Fonts, social media plugins): all fonts and resources are served from our own server (see section 6).

Personal data is therefore only processed

• for technical reasons in the server log files on each page request (section 3),
• if you actively follow the external link to the Zoom scheduler (section 5.1),
• if you email us or we reply to you by email (section 5.3).

3. Server log files

When the website is accessed, the hosting infrastructure automatically records data transmitted by your browser in server log files:

• IP address (of the accessing device),
• date and time of access,
• requested URL / name of the retrieved file,
• volume of data transferred and HTTP status code,
• referrer URL (previously visited page, if transmitted),
• browser type/version and operating system (user agent).

Purpose: delivery of the website, ensuring system security and stability, defending against and investigating attacks, and error analysis.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest). The legitimate interest lies in the secure, stable and functional operation of the website. This data is not combined with other sources or evaluated for marketing/profiling purposes; your interests in non-processing therefore do not override ours.

Retention period:

Server log files are deleted or anonymised no later than 14 days after collection. If a specific security incident occurs, relevant entries may be preserved separately. This preservation is documented, restricted to authorised personnel and deleted once it is no longer required to investigate the incident or enforce legal rights.

4. Cookies and local storage

This website sets no tracking, analytics or marketing cookies and therefore needs no cookie/consent banner.

The website does not write cookies or store information in localStorage or sessionStorage. The language version is determined by the URL you open.

5. External services and recipients

5.1 Zoom scheduler (external link)

The main call to action on this website is a link to an external scheduler provided by Zoom (domain scheduler.zoom.us), operated by Zoom Communications, Inc. (or the Zoom entity contracting for the EU), USA.

As long as you remain on our website, no data is transmitted to Zoom. Only when you actively click the link do you leave our website and get redirected to the scheduler page operated by Zoom. When you access that page, Zoom processes in particular your IP address and device and browser data. If you book an appointment, Praetorian Digital OÜ receives your name, email address, appointment time and any optional information entered during booking. We use this data to arrange, prepare, conduct and follow up on the conversation. Praetorian Digital OÜ remains the controller for this use. Zoom may act on our behalf to provide the scheduler and may process data for its own purposes such as operating and securing the Zoom service. Zoom's privacy terms also apply.

Purpose: appointment booking and the organisation, preparation, conduct and follow-up of the conversation you requested.
Legal basis: Art. 6(1)(b) GDPR where the conversation is requested by you in preparation for a possible contract. Where the conversation does not concern such pre-contractual steps, we rely on Art. 6(1)(f) GDPR for technical scheduling, security measures and necessary conversation records. Our legitimate interest is to handle your request reliably, securely and transparently.

Retention period: booking and contact data are reviewed no later than twelve months after the last contact and deleted or anonymised if there is no ongoing business matter, statutory retention obligation or need to establish, exercise or defend legal claims.

Third-country transfer (USA): using the scheduler transfers personal data to the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) agreed in our data processing agreement with Zoom. Where the contracting Zoom entity participates in the EU-U.S. Data Privacy Framework, we additionally rely on the European Commission's adequacy decision (Art. 45 GDPR). You can check participation in the register at dataprivacyframework.gov. You can request a copy of the Standard Contractual Clauses at joram@praetorian-digital.com.

Note: the Data Privacy Framework is not legally settled. An appeal against its confirmation is pending before the Court of Justice of the European Union (Case C-703/25 P). The European Commission is also reviewing, at the request of the European Data Protection Board, how a US Supreme Court ruling on the independence of the FTC affects it. Should the framework fall away, the Standard Contractual Clauses remain the basis. A residual risk for data subjects remains.

Details: Zoom's privacy policy – https://www.zoom.com/en/trust/privacy/privacy-statement/

5.2 Hosting / processing on our behalf

The website is hosted through Laravel Forge (Laravel Holdings, Inc., USA) as our hosting processor on a server in the Frankfurt am Main (Germany) data centre. The server is provided by DigitalOcean, LLC (USA) as Laravel's subprocessor. The server log data named in section 3 is processed in this context.

Third-country transfer (USA): the data is stored in Germany. Laravel and DigitalOcean are US companies and may access the server from the USA for operations, maintenance and support. The basis is the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in our data processing agreement with Laravel; Laravel passes these obligations on to DigitalOcean. Where either company participates in the EU-U.S. Data Privacy Framework, the adequacy decision applies in addition. You can request a copy of the safeguards at joram@praetorian-digital.com.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and performant hosting); processing is based on a data processing agreement under Art. 28 GDPR.

5.3 Email communication

If you email us, we process your email address, your name, the content of your message and the technical details of the email in order to answer your request. The same applies to booking confirmations and calendar entries from the Zoom scheduler. Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract or steps before entering into one, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering messages addressed to us.

Recipients and third-country transfer: our email mailboxes and calendars run on Google Workspace (Google). Google processes the content and technical details of the emails and calendar entries and may also process this data in the USA. According to Google, such transfers are based on the EU Standard Contractual Clauses and, where the receiving Google entity participates, on the EU-U.S. Data Privacy Framework.

Retention period: we review emails no later than twelve months after the last contact and delete them if there is no ongoing business matter, statutory retention obligation or need to establish, exercise or defend legal claims.

6. Fonts (self-hosted) – no Google Fonts connection

The font "Inter" used is served locally from our own server. There is no connection to Google Fonts or any other external font service; in particular, no IP address is transmitted to Google when the page loads. No other resources are embedded via an external CDN.

7. Your rights as a data subject

Under the GDPR you have the right to:

• access (Art. 15) to the data processed about you,
• rectification (Art. 16) of inaccurate data,
• erasure (Art. 17), unless retention obligations apply,
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21).

No automated decision-making including profiling under Art. 22 GDPR takes place on this website.

To exercise your rights, an informal message to joram@praetorian-digital.com suffices.

8. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your residence, place of work or place of the alleged infringement.

The controller's lead supervisory authority is the Estonian data protection authority:
Andmekaitse Inspektsioon (AKI), Tatari 39, 10134 Tallinn, Estonia – www.aki.ee.

Users in the DACH region may also contact their locally competent authority, e.g.:

• Germany: the state data protection authority competent for your federal state, or the Federal Commissioner for Data Protection and Freedom of Information (BfDI),
• Austria: Data Protection Authority (DSB), Vienna,
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC) (where applicable).

9. Contact for data protection matters

For data protection enquiries, reach us at:
Praetorian Digital OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia
Email: joram@praetorian-digital.com

10. Changes to this Privacy Policy / version history

We update this Privacy Policy whenever the underlying processing changes (e.g. new services, analytics, contact options).