How we handle enquiry data.

Controller

Kahromaa OÜ · registry code 12181358
Kahro, Kamali village, Saarde Parish, Pärnu County 86207
mark.er@mail.ee · +372 5661 8520

Purpose, data and lawful basis

We use the name, contact details, company, selected service and message solely to answer the enquiry, assess the requested work and continue communication initiated by you. For a private person enquiring about their own prospective contract, the basis is GDPR Article 6(1)(b): taking requested pre-contractual steps. For a representative enquiring on behalf of a company, utility or public authority, the basis is Article 6(1)(f): Kahromaa’s and the represented organisation’s legitimate interest in receiving, assessing and answering a business enquiry. That limited correspondence is expected in the representative’s professional role, uses only information they choose to submit, and does not override their rights. The workflow does not rely on consent.

Required and optional information

Name, a description of the work and at least one contact method—email or phone—are required so that we can assess and answer the enquiry. Company and service selection are optional. Without the required details, the form cannot be submitted and we cannot answer through this channel.

Recipients, hosting and transfers

Authorised Kahromaa administrators receive the enquiry. Netlify is the selected temporary hosting platform: Netlify Database stores application records and Netlify Blobs stores work photographs. The platform and its subprocessors process data only to host, maintain, secure and support the site. Before public data collection is enabled, Kahromaa must verify the terms for its own account, the applicable data-processing agreement, subprocessor list and international-transfer safeguards. We do not sell the data or use it for advertising.

Retention

Records are retained only while needed for the enquiry, possible quotation or contract, and related business communication. No fixed automatic deletion period has yet been adopted; Kahromaa reviews necessity case by case and archives closed enquiries. This notice does not promise automatic deletion.

Your rights

You may request access, correction, deletion or restriction of processing and, where applicable, data portability, or object to processing. Because this workflow is not based on consent, there is no contact-form consent to withdraw. A request may be sent to the controller above; identity verification may be required. You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or seek a judicial remedy.

Estonian Data Protection Inspectorate

Technical abuse controls and automated decisions

We do not use enquiry data for profiling or decisions about a person or quotation. A Kahromaa administrator reviews each genuine enquiry. To protect the form, the server creates a salted one-way HMAC from the connecting IP address; no raw IP is stored and the rate-limit bucket expires after 15 minutes. It also creates a salted one-way fingerprint from the submitted email or phone plus message; the duplicate claim expires after 10 minutes and the current form does not store that fingerprint with the lead. Expired technical rows are deleted lazily when a later form submission runs, so they may remain inaccessible and unused until that cleanup. Older imported lead records may retain a legacy fingerprint until Kahromaa completes its retention review. These controls may suppress abusive or repeated submissions only.