Privacy policy

Who we are

The controller of your personal data is [Legal name: to be completed in Settings], registry code [registry code: to be completed in Settings], [registered address: to be completed in Settings], info@nuance-agency.ee.

What we collect

Inquiries and bookings: name, email, company, phone (optional), and what you tell us about your project.

Clients: contact details of authorised users, project communication, files you share with us, invoices and payment records.

Website: anonymous visit counts (page, referring site, country, device type) with nothing stored on your device and no IP address kept. With your consent, the pages of one visit are also linked together so we can see how the site is used. We do not use advertising trackers.

Client portal accounts

If you are invited to the client portal, we store your name, email address, the organisation you belong to and a securely hashed password. We use them only to let you sign in, show you your projects, files, approvals and invoices, and send you messages about your projects.

Signing in with Google

You can sign in to the client portal with your Google account instead of a password. When you do, Google shares your name, email address and profile picture with us. We ask for nothing else: no access to your Gmail, Drive, contacts or calendar.

We use this information only to identify you and sign you in to the client portal, and to match you with the invitation sent to your email address. We do not use it for advertising, we do not sell it, and we do not share it with anyone except the processors that host the portal (database and authentication hosting in the EU).

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time in your Google account settings (Security → Your connections to third-party apps). To delete your portal account and the data linked to it, use the form on the Your data page or write to us; we delete it within 30 days, except records we must keep by law, such as invoices.

Why and on what legal basis

To answer inquiries and prepare proposals: steps taken at your request before entering a contract (GDPR Art. 6(1)(b)).

To deliver services and run the client portal: performance of a contract (Art. 6(1)(b)).

To keep accounting records: legal obligation (Art. 6(1)(c)).

Website statistics: anonymous visit counts rely on our legitimate interest in running the site (Art. 6(1)(f)); linking the pages of a visit relies on your consent (Art. 6(1)(a)), which you can withdraw at any time in Cookie settings.

Who receives your data

We use processors to run our systems: database and authentication hosting in the EU, website hosting, transactional email, file storage, payment processing and electronic signatures. Each processes data only on our instructions under a data processing agreement.

Where a processor transfers data outside the EEA, the transfer relies on an adequacy decision or the EU Standard Contractual Clauses.

How long we keep it

Inquiries that do not lead to a project: up to 24 months after the last contact.

Client records and communication: for the duration of the relationship and then as long as needed for legal claims.

Accounting documents: for the period required by Estonian accounting law.

Website statistics: up to 25 months.

Your rights

You can ask for access to, a copy of, correction or deletion of your data, restriction of processing, and you can object to processing. Use the form on the Your data page or write to us. We reply within one month.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).