Privacy and Cookies
Updated: 20 October 2026. Notice version: 2026-10-16.1
This notice explains data use on our website and contact form, and the choices available to you. Your contact details are not used for website measurement.
1. Controller and contact
Baltic Operations Advisory OÜ, registry code 17612523, Tervise tänav 17/4, 76607, Keila, Estonia. For privacy questions and rights requests, contact info@balticops.com. Kristjan Niiberg coordinates data protection matters; this does not denote an appointed Data Protection Officer.
2. Contact form data and purpose
We use your name, email address and message to receive and answer your enquiry and manage related business correspondence. All three form fields are required: your name lets us address you personally, your email allows a reply, and your message explains your enquiry. Using the form is voluntary; you can also email us directly. Please do not include health information, other special-category data or unnecessary information about other people.
3. Legal bases
For B2B enquiries, our basis is our legitimate interest in handling communication about our services (GDPR Article 6(1)(f)). We assess its necessity and impact on your rights. Where an individual requests steps necessary for their own service contract, the relevant processing may instead rely on pre-contractual measures (Article 6(1)(b)). Sending an enquiry does not consent to newsletters, marketing emails or sharing contact details with advertising platforms. Optional analytics and advertising measurement rely on your separate consent.
4. Where your enquiry goes
Your enquiry is saved first in Cloudflare D1. Resend then sends a notification to our Microsoft 365 mailbox and a confirmation containing your message copy to the address you provided. This is a service email, not marketing. Delivery limits or technical failures may prevent confirmation even when your enquiry is saved. Only authorised people can access enquiries; they are not publicly accessible.
5. Security and delivery data
We also process the enquiry identifier, language and time, a content hash, email status and provider identifiers. IP addresses are used for rate limiting and Cloudflare Turnstile verification; they are not added to our enquiry table. Turnstile and hosting also process connection and browser information. A short-lived email hash limits repeated confirmations; hashing does not make it anonymous. The application does not log form contents. Security and provider logs are separate processing activities.
6. Retention
The website enquiry and associated database records are automatically removed after six calendar months from receipt through scheduled maintenance. Confirmation rate-limit hashes are removed with a 24-hour maintenance allowance after their cooldown expires. Completed enquiry correspondence in our mailbox is retained for up to six months after the last substantive exchange. If a client relationship or specific legal claim arises, necessary information is retained separately for that purpose; this does not automatically extend the website database copy. Consent evidence and settings change records are retained for six months. Provider logs and backups expire under their applicable retention cycles; deletions are reapplied after restoration.
7. Providers and international transfers
We use Cloudflare for hosting, the D1 database, access protection and Turnstile; Resend for sending email; and Microsoft 365 for our mailbox. D1 uses EU jurisdiction, but this does not mean all networking, support and email operations occur only in the EEA. International providers may process data outside the EEA. Such transfers must rely on an applicable adequacy decision or appropriate safeguards, such as European Commission Standard Contractual Clauses. Contact us for information about the applicable recipients and safeguards.
8. Analytics and advertising measurement
When a service is enabled and you allow it, Google Analytics 4 measures visits, traffic sources, section engagement, contact clicks and successful enquiries. Our starting event-level retention is two months; Google Signals and Google advertising features are not used in this setup. LinkedIn Insight Tag and Meta Pixel measure page views and successful enquiries to assess advertising performance. LinkedIn Website Actions may also automatically collect button clicks, page visits and form interactions, with related element information such as button text and page name. These automatic actions do not by themselves mean an enquiry succeeded. These services may process URLs, referrers, IP addresses, browser and device details and cookie identifiers, and associate them with a platform account. We do not send your form name, email or message, use Advanced Matching or send advertising conversions from our server. Creating our own retargeting audiences is outside this initial setup.
9. Your rights
You may request access, correction, deletion or restriction of processing. You may object to processing based on legitimate interests. Portability may apply to automated processing based on consent or contract. You may withdraw consent at any time without affecting the lawfulness of earlier processing. We normally respond within one month and may proportionately verify your identity. Legal limitations apply to these rights. You can complain to the Estonian Data Protection Inspectorate (aki.ee) or your competent supervisory authority. We do not make automated decisions about website enquiries that have legal or similarly significant effects on you.
10. Changes
We review this notice when services, purposes or data flows change. Where fresh consent is needed, we ask before starting the new tracking. Using the website alone is not consent.