← All services

Privacy Policy

Effective date: 2026-06-02 · Version: 1.1

This policy describes how Loovl OÜ (registry code 17497447, VAT EE102982660, registered in Estonia) processes personal data of visitors to loovl.studio, prospects who contact us via messengers, and clients who engage us for managed hosting, web development, modernization or SEO / GEO services.

It is written to comply with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Estonian Personal Data Protection Act.

1. Who we are

  • Controller: Loovl OÜ
  • Registry code: 17497447
  • VAT identifier: EE102982660
  • Country of registration: Estonia
  • Contact for privacy matters: WhatsApp / Telegram (see Section 9)

We have not appointed a Data Protection Officer because we are below the GDPR thresholds requiring one.

2. Visitors of loovl.studio

We use our own product, Pulse Analytics (hosted at pulse.loovl.eu, EU-only), to measure aggregate usage of this website. This means:

  • No cookies, no localStorage, no fingerprinting for tracking purposes.
  • Your IP address is never written to any database or log. It is processed in memory only to compute a daily-rotating pseudonymous identifier and an approximate country / region / city via offline databases.
  • We collect: pseudonymous visitor and session identifiers (rotating daily), browser and OS name/version, device type, screen resolution, page language, page path (no query strings or fragments), referring URL, UTM parameters, and approximate location.

The full technical description of Pulse measurement matches the documentation at loovl.eu.

Legal basis. We process this analytics data under our legitimate interest (Art. 6(1)(f) GDPR) in understanding and improving the Website. Because Pulse is cookieless, never stores your IP address, builds no cross-site profile and does not allow re-identification of individuals, the measurement falls outside Art. 5(3) of the ePrivacy Directive and requires no consent banner — in line with the published guidance of the French CNIL and the UK ICO for privacy-friendly measurement tools.

Approximate location. Country, region and city are derived on our EU server from offline databases — DB-IP Lite (© DB-IP, licensed under CC BY 4.0) and the geoip-lite database — so your browser never contacts a third-party geolocation service.

Opt out at any time. You can switch analytics off in your browser without contacting us: open the developer console (F12 on most browsers) on any page and run localStorage.setItem('pulse-opt-out', '1'). The tracker checks this flag on every page load and exits before sending any data; the opt-out lasts until you clear your browser storage. The tracker also respects the browser Do-Not-Track signal (navigator.doNotTrack === '1') and exits silently when it is enabled.

Web server logs: our Nginx server records standard access logs containing IP addresses and timestamps for up to 14 days for security and abuse prevention. These logs are not used for analytics or marketing.

3. Prospects who contact us

If you contact us via WhatsApp, Telegram, Viber, or any other channel listed on this website, we process the contact data and message content you provide. The legal basis is your free consent (you initiate the contact) and the legitimate interest in responding to a business inquiry (Art. 6(1)(a) and 6(1)(f) GDPR).

We do not run any newsletter, lead magnet, or marketing automation. There is no contact form on this site that collects data into our database.

4. Clients

When you engage Loovl OÜ for paid services, we process the data necessary to deliver those services and meet our legal obligations:

  • Identification and billing: company name, address, VAT identifier, contact person name and email — for invoicing and accounting (Estonian Accounting Act, retention: 7 years).
  • Project communications: messages, files, credentials shared during the engagement — kept only as long as necessary for the project plus a reasonable period afterwards.
  • Server access credentials: SSH keys, hosting accounts, etc. — stored encrypted; you can revoke access at any time.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR).

5. Where data is stored

All servers, analytics, and project infrastructure are physically located in the European Union — primarily Hetzner data centres in Helsinki (Finland) or Falkenstein (Germany). We do not transfer personal data outside the EU/EEA.

6. Sub-processors

We rely on a small set of EU sub-processors:

  • Hetzner Online GmbH (Germany / Finland) — server hosting
  • Pulse Analytics by Loovl OÜ (EU) — analytics for this website

For the Pulse Analytics service itself, sub-processors are listed at pulse.loovl.eu/legal/subprocessors.

7. Retention

  • Pulse analytics data — aggregate retention per Pulse policy.
  • Server access logs — up to 14 days.
  • Messenger conversations — kept as long as necessary for the inquiry / project.
  • Accounting records (invoices, contracts) — 7 years (Estonian Accounting Act).

8. Your rights

Under GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to data portability. To exercise these rights, contact us through any messenger listed below.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee) or your local supervisory authority.

9. Contact

WhatsApp: +372 5392 3861 · Telegram: @eriksaar

10. Changes to this policy

We may update this policy as our practices evolve. The effective date at the top is updated on every revision. Material changes will be announced on this page.