Privacy Policy

Last updated: 2 August 2026

1. Purpose of this policy

This policy explains how Carmagnole OÜ processes personal data in connection with the website www.carmagnole.eu, the client portal and the services provided to its clients. It is issued under Regulation (EU) 2016/679 (General Data Protection Regulation, the "GDPR") and the Estonian Personal Data Protection Act (isikuandmete kaitse seadus).

2. Controller

The controller of the processing described below is:

Carmagnole OÜ, registry code 17131338, VAT number EE102814152, Ahtri tn 12, Kesklinna linnaosa, 15551 Tallinn, Harju maakond, Estonia. Secondary office: Impasse Edowangani, Libreville, Gabon. Email: contact@carmagnole.eu. Telephone: +372 5355 0223.

Carmagnole OÜ has not appointed a data protection officer. All privacy requests are handled by the management board and should be sent to contact@carmagnole.eu.

3. Categories of data processed

We process the following categories of personal data.

Contact form and email enquiries. Surname and first name, organisation, position, email address, telephone number where provided, the content of the message and any attachment, and the date of the enquiry.

Client portal account data. Surname and first name, professional email address, organisation, user identifier, encrypted password, access rights, connection history and actions performed on documents.

Contractual and billing data. Identity and contact details of the client contacts, engagement documents, participant lists for training sessions, attendance records, invoices and payment records.

Server logs. IP address, date and time of the request, requested resource, HTTP status code, volume of data transferred, browser type and operating system, referring page.

We do not knowingly collect special categories of personal data within the meaning of Article 9 of the GDPR, and we ask users not to communicate such data through the website.

4. Purposes and legal bases

| Purpose | Legal basis | | --- | --- | | Responding to enquiries sent through the contact form or by email | Article 6(1)(b), steps taken at the request of the data subject prior to entering into a contract, and Article 6(1)(f), legitimate interest in answering professional enquiries | | Preparing, concluding and performing training, advisory, audit and business intelligence engagements | Article 6(1)(b), performance of a contract | | Managing client portal accounts and access to documents | Article 6(1)(b), performance of a contract | | Issuing invoices and keeping accounting records | Article 6(1)(c), compliance with a legal obligation under Estonian accounting and tax law | | Ensuring the security of the website and the portal, preventing fraud and abuse, keeping server logs | Article 6(1)(f), legitimate interest in the security of our systems | | Sending professional information about our services to existing clients or to persons who have requested it | Article 6(1)(f) for existing clients, and Article 6(1)(a), consent, in all other cases | | Recording cookie consent choices | Article 6(1)(c) and Article 6(1)(f) | | Establishing, exercising or defending legal claims | Article 6(1)(f), legitimate interest |

Where processing is based on consent, that consent may be withdrawn at any time by writing to contact@carmagnole.eu, without affecting the lawfulness of processing carried out before withdrawal.

5. Provision of data

The data requested in the contact form and at the time of contracting is necessary for Carmagnole OÜ to respond to the request or to perform the engagement. Failure to provide it may prevent the response or the performance of the services. All other data is provided voluntarily.

6. Recipients and processors

Personal data is accessible to the members of the management board of Carmagnole OÜ and to the personnel and trainers involved in the engagement concerned, on a need to know basis and subject to a confidentiality undertaking.

Carmagnole OÜ uses the following categories of processors, each bound by a data processing agreement under Article 28 of the GDPR:

the hosting provider of the website and the client portal, Hostinger International Ltd, 61 Lordou Vironos Street, 6023 Larnaca, Cyprus;
the provider of the professional email service;
where applicable, the accounting firm and the payment institution used for invoicing.

Personal data may also be disclosed to public authorities, courts or auditors where Carmagnole OÜ is required to do so by law. Carmagnole OÜ does not sell personal data and does not transfer it to third parties for their own marketing purposes.

7. International transfers

Personal data is stored on servers located within the European Economic Area. Where an engagement requires data to be accessed from the secondary office in Libreville, Gabon, or where a processor is established outside the European Economic Area, the transfer is carried out only on the basis of an appropriate safeguard within the meaning of Chapter V of the GDPR, in particular the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional technical and organisational measures. A copy of the safeguards in place may be requested at contact@carmagnole.eu.

8. Retention periods

Contact enquiries and related correspondence: three years from the last contact, unless a contractual relationship is entered into.
Client files, engagement documents, invoices and accounting records: ten years from the end of the financial year concerned, in accordance with the retention obligations of the Estonian Accounting Act.
Client portal account data: for the duration of the account, then deleted within three months of the closure of the account, save for connection logs.
Server logs and connection logs: twelve months.
Cookie consent records: as stated in the Cookie Policy.
Data processed on the basis of consent: until consent is withdrawn.

At the end of these periods the data is deleted or irreversibly anonymised, except where a longer retention period is required for the establishment, exercise or defence of legal claims or by a legal obligation.

9. Rights of data subjects

Subject to the conditions laid down in Articles 15 to 22 of the GDPR, every data subject has the right:

of access to the personal data concerning them and to a copy of that data (Article 15);
to rectification of inaccurate or incomplete data (Article 16);
to erasure of the data (Article 17);
to restriction of processing (Article 18);
to be notified of rectification, erasure or restriction communicated to recipients (Article 19);
to data portability for data processed by automated means on the basis of consent or of a contract (Article 20);
to object at any time, on grounds relating to their particular situation, to processing based on legitimate interest, and to object at any time and without justification to processing for direct marketing purposes (Article 21);
not to be subject to a decision based solely on automated processing producing legal effects or similarly significantly affecting them (Article 22). Carmagnole OÜ carries out no automated decision making of that kind and no profiling.

Requests should be sent to contact@carmagnole.eu or by post to the registered office. Carmagnole OÜ may ask for reasonable evidence of identity where there is doubt as to the identity of the applicant. A reply is given within one month of receipt of the request, a period which may be extended by two further months where the request is complex, in which case the data subject is informed.

10. Right to lodge a complaint

Every data subject has the right to lodge a complaint with a supervisory authority, in particular the Estonian Data Protection Inspectorate:

Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia. Telephone: +372 627 4135. Email: info@aki.ee. Website: www.aki.ee.

A complaint may also be lodged with the supervisory authority of the Member State of the data subject's habitual residence or place of work.

11. Security

Carmagnole OÜ implements technical and organisational measures appropriate to the risk, in accordance with Article 32 of the GDPR, in particular: encryption of connections by TLS, hashing of portal passwords, individual and nominative accounts, management of access rights on a need to know basis, regular backups, logging of access, updating of software components, confidentiality undertakings from personnel and trainers, and internal procedures for handling personal data breaches. In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, Carmagnole OÜ notifies the Estonian Data Protection Inspectorate within seventy two hours and, where the risk is high, informs the data subjects concerned.

12. Cookies

The use of cookies on the website is described in the Cookie Policy.

13. Amendments

This policy may be amended to reflect changes in the services or in the applicable law. The date of the last update appears at the top of this document. Material changes are brought to the attention of clients and portal users.

14. Contact

Any question or request relating to personal data may be sent to contact@carmagnole.eu or to Carmagnole OÜ, Ahtri tn 12, Kesklinna linnaosa, 15551 Tallinn, Harju maakond, Estonia.

If you subscribe to our newsletter, we store your email address, the language of your subscription, the date and the technical origin of the request. The legal basis is your consent (Article 6(1)(a) GDPR). We use this address only to send you our information. You may withdraw your consent at any time by writing to contact@carmagnole.eu or by using the unsubscribe link included in each message; your address is then deleted from the list.