Privacy policy

1. Controller

The controller for personal data processed on this website is ArrowStone OÜ, registry code 16154633, Telliskivi tn 57, Põhja-Tallinna linnaosa, 10412 Tallinn, Harju maakond, Estonia. Email: khrystyna.didukh@gmail.com. Please use this address for any privacy request.

2. What data we process, why, and on what legal basis

Contact form enquiries

Data: name, email address, and — if you choose to give them — company, role, team size and your message. Purpose: to reply to your enquiry and discuss a possible training or consulting engagement. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request). Retention: enquiries are deleted automatically 24 months after submission, unless they lead to a contract, in which case the statutory retention periods for business records apply.

AI readiness check and PDF checklist

The readiness score is calculated in your browser; nothing is stored unless you ask for the checklist. If you do, we store your email, optional company name, score and answers. Purpose: sending the checklist and, if you later contact us, preparing a relevant conversation. Legal basis: Art. 6(1)(a) GDPR (consent via the checkbox). Retention: deleted automatically after 24 months, or earlier on request.

Newsletter (double opt-in)

If you subscribe, we store your email, the time of consent and the confirmation status. Nothing is sent until you confirm via the link in our confirmation email. Unconfirmed sign-ups are deleted after 30 days. Legal basis: Art. 6(1)(a) GDPR. You can unsubscribe at any time.

Booking calendar and videos (click-to-load)

Where the site offers a booking calendar (Cal.com, Cal.com Inc., USA) or an embedded video, it loads only after you click. Until then no data is sent to those providers. Once loaded, the provider processes your IP address and the data you enter under its own privacy policy; legal basis Art. 6(1)(a) GDPR (your click) and, for bookings, Art. 6(1)(b).

Newsletter / marketing via the contact form (optional)

If you tick the optional, unticked-by-default box in the contact form, we record your consent to receive occasional updates by email. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw consent at any time by emailing us; withdrawal does not affect prior processing. Retention: until you withdraw consent.

Technical server logs

When you visit the site, our hosting provider automatically processes technical data such as IP address, date and time, requested page, browser and operating system. Purpose: delivering the site, security and error analysis. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website). Retention: short-term, typically no longer than 30 days, unless needed to investigate a security incident.

Analytics

This site currently uses no analytics or tracking tools. If analytics are introduced, they will only run after your consent (Art. 6(1)(a) GDPR) and this policy will be updated first.

3. Recipients and processors

Hosting and database: Lovable (Lovable Labs Incorporated) with a managed Supabase database. Region of data storage: European Union (to be confirmed). These providers act as processors under a data processing agreement and only process data on our instructions. We do not sell your data or share it with third parties for their own purposes. If a booking tool or email service is added, it will be listed here.

4. International transfers

Some of our service providers are based in, or may access data from, countries outside the EU/EEA (e.g. the United States). Where this happens, transfers are safeguarded by the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where applicable, the EU–US Data Privacy Framework.

5. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data rectified (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time, with effect for the future (Art. 7(3)).

To exercise any of these rights, email khrystyna.didukh@gmail.com. We respond within one month.

You also have the right to lodge a complaint with a supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee — or with the authority in your country of residence or work.

6. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. No AI system on this site makes decisions about you.

7. Cookies and local storage

This site sets no cookies and uses no trackers, analytics, advertising pixels or third-party embeds. Fonts are hosted on our own server, so your browser makes no requests to Google or other font services. Because nothing non-essential is used, there is no consent banner — and nothing to switch off.

Cookie settings: if we ever introduce optional cookies or analytics, a consent choice with equally prominent "Accept" and "Reject" buttons will appear before any of them run, and you will be able to change your choice here at any time.

8. Changes

We update this policy when our processing changes. The date above shows the latest version.