Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

dthn Technology Estonia OÜ
Ahtri tn 12
15551 Tallinn
Estonia

Represented by: Niels Heidbrink (Managing Director)
Email: niels.heidbrink@dthn.io
Phone: +372 5898 9763

2. Overview of Data Processing

We process personal data only to the extent necessary to provide a functional website, our content, and our services. The processing of personal data takes place only with your consent or where processing is permitted by law.

We process personal data based on the following legal grounds under GDPR:

• Art. 6(1)(a) – You have given consent for a specific purpose.
• Art. 6(1)(b) – Processing is necessary for the performance of a contract or pre-contractual measures.
• Art. 6(1)(f) – Processing is necessary for the purposes of our legitimate interests, provided your rights do not override those interests.

3. Data Flow Overview

When you submit a lead form, book a consultation via Calendly, or contact us by email, your data is processed in our service delivery stack.

Typical processing flow:

• Website form submissions, Calendly bookings, and email enquiries are received by us.
• YouTube videos embedded in privacy-enhanced mode are loaded only when the player is used.
• Data may be forwarded via Zapier webhooks as an integration relay.
• Data may be processed in Make workflows for routing, enrichment, and automation.
• Relevant customer and lead data is stored and managed in Close CRM.

Detailed information on each processor, legal basis, and transfer safeguards is provided in the sections below.

4. Server Log Files (AWS CloudFront)

Our website is hosted on Amazon Web Services (AWS) and served through AWS CloudFront, a content delivery network. When you access our website, your browser automatically transmits certain data for technical reasons. The following data is recorded in server access logs:

• IP address of the requesting device
• Date and time of the request
• URL of the requested resource
• HTTP status code
• Data volume transferred
• Referring URL (previously visited page)
• Browser type, version, and operating system

This data is processed on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in ensuring the technical functionality and security of our website. The log data is not merged with other data sources and is automatically deleted after 30 days.

Provider: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. AWS processes data in accordance with theAWS Privacy Notice.

5. Cookies and Consent

Our website uses cookies – small text files stored on your device by your browser. Some cookies are technically necessary for the website to function (e.g., session cookies). Other cookies are used for analytics and marketing purposes and are only set with your prior consent.

We distinguish between the following cookie categories:

• Necessary cookies – Required for basic website functionality. Legal basis: Art. 6(1)(f) GDPR.
• Analytics cookies – Help us understand how visitors interact with the website (e.g., Google Analytics). Legal basis: Art. 6(1)(a) GDPR (consent).
• Marketing cookies – Used for advertising and conversion tracking (e.g., Meta Pixel). Legal basis: Art. 6(1)(a) GDPR (consent).
• Media cookies – May be set when embedded media (e.g., YouTube player) is loaded or used. Legal basis: Art. 6(1)(a) GDPR (consent).

You can withdraw your consent at any time or manage your cookie preferences through your browser settings. Please note that disabling cookies may impair the functionality of the website.

6. Google Tag Manager

This website uses Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Tag Manager is a tool that allows us to manage tracking and analytics tags on our website without modifying the website code directly. Google Tag Manager itself does not collect personal data. However, it triggers other tags that may collect data. Google Tag Manager does not access this data.

For more information, see theGoogle Tag Manager Terms of Service.

7. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited (“Google”). Google Analytics uses cookies and similar technologies to analyse your use of the website. The information generated is usually transmitted to a Google server and stored there.

We currently use Google Analytics 4. IP anonymisation is enabled, meaning your IP address is truncated within EU/EEA member states before transmission.

Google Analytics processes the following data, among others:

• Anonymised IP address
• Pages visited, duration, and interactions
• Browser type and operating system
• Referral source
• Device information

Legal basis: Art. 6(1)(a) GDPR (consent). Google Analytics cookies are only set after you have given your consent. You may withdraw your consent at any time.

You can also prevent data collection by Google Analytics by installing theGoogle Analytics Opt-Out Browser Add-On.

For more information, see theGoogle Privacy Policy.

8. Meta Pixel (Facebook Pixel)

This website uses the Meta Pixel, a conversion tracking tool provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”).

The Meta Pixel enables us to track visitor behaviour after they have been redirected to our website by clicking on a Facebook or Instagram advertisement. This allows us to measure the effectiveness of advertising campaigns. The data collected is anonymous to us; we cannot see the personal data of individual users. However, the data is stored and processed by Meta and may be connected to your Facebook/Instagram profile.

The Meta Pixel may process the following data:

• HTTP header information (IP address, browser data, page location, referrer)
• Pixel-specific data (Pixel ID, Facebook cookie)
• Button click data and form field names
• Page metadata

Legal basis: Art. 6(1)(a) GDPR (consent). The Meta Pixel is only activated after you have given your consent. You may withdraw your consent at any time.

You can manage your advertising preferences in yourFacebook Ad Settings. For more information, see theMeta Privacy Policy.

9. Fonts

This website uses the Parkinsans font. It is delivered from our own web server together with the rest of the website. Your browser does not connect to Google or any other third-party font service for it.

10. YouTube (Privacy-Enhanced Mode)

We embed videos from YouTube using privacy-enhanced mode (youtube-nocookie.com). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

In privacy-enhanced mode, YouTube does not store information about visitors before video playback starts. Once you interact with or play a video, data may be transmitted to YouTube/Google, including IP address, browser and device information, referrer URL, and interaction data. Cookies or similar technologies may be set when the player is used.

Legal basis: Art. 6(1)(a) GDPR (consent).

For more information, see theGoogle Privacy PolicyandYouTube Terms of Service.

11. Calendly

We use Calendly, a scheduling tool provided by Calendly Inc, 115 E Main St., Ste A1B, Buford, GA 30518, USA, to allow you to book consultation appointments directly on our website.

The Calendly widget is embedded on our website and loads content from Calendly’s servers. When you interact with the widget, Calendly may collect the following data:

• Name and email address (entered by you when booking)
• Selected date and time of the appointment
• IP address and browser data
• Cookies set by Calendly

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures). You voluntarily provide your data to schedule a consultation with us.

Calendly booking data may be transferred to our automation stack (including Zapier and Make) and synchronized into Close CRM to manage enquiries and customer communication.

For more information, see theCalendly Privacy Notice.

12. Google Calendar (Appointment Booking)

To book initial calls, we use Google Calendar appointment booking pages, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The booking page is embedded in a booking window on our website. It is only loaded when you click “Load calendar” there. Only then does your browser connect to Google’s servers; in particular, your IP address and technical information about your browser are transferred to Google. This choice is remembered for the current browser tab; when you reopen the booking window, the calendar loads again. Alternatively, you can open the booking page directly at Google in a new tab.

When you book an appointment, Google processes the data you enter (for example name, email address and selected time) and makes it available to us.

In the booking window, you can also send us the result of one of our free checks by email. Your own email program opens with a prepared message; it is only sent if you press send yourself. Section 13 (Contact via Email) applies to this processing.

The legal basis for loading the calendar is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); for the booking itself it is Art. 6(1)(b) GDPR (pre-contractual measures). Google may also transfer data to the USA; Google is certified under the EU-US Data Privacy Framework.

For more information, seeGoogle’s privacy policy.

13. Contact via Email

If you contact us by email (e.g., atcontact@dthn.io), we will process the personal data you provide in your message (such as your name, email address, and message content) for the purpose of handling your enquiry.

Legal basis: Art. 6(1)(b) GDPR if your enquiry relates to the performance of a contract or pre-contractual measures, or Art. 6(1)(f) GDPR based on our legitimate interest in responding to enquiries directed at us.

Your data will be deleted once the purpose of storage no longer applies and no statutory retention obligations require further storage.

Where operationally required, enquiry data may be synchronized to Make, Zapier, and Close CRM to manage communication and follow-up.

14. Lead Generation Form

Our website provides a contact/lead generation form that allows you to submit your details (such as name, email address, company name, and your message) to express interest in our services. The form data is transmitted securely via AWS infrastructure (API Gateway and AWS Lambda), may be routed through Zapier and Make automations, and is stored for the purpose of following up on your enquiry.

Legal basis: Art. 6(1)(a) GDPR (consent) where you have actively submitted the form, or Art. 6(1)(b) GDPR for pre-contractual measures.

Your data will be retained for as long as necessary to process your enquiry and will be deleted once the purpose no longer applies, unless statutory retention obligations require otherwise.

15. Google reCAPTCHA

To protect our forms from spam and automated abuse, we may use Google reCAPTCHA, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

reCAPTCHA analyses whether data entered on our website is made by a human or by an automated program. For this purpose, reCAPTCHA processes personal data such as IP address, browser and device information, referrer URL, time spent on the website, mouse movements, and keyboard interactions. reCAPTCHA may also set cookies.

Legal basis: Art. 6(1)(f) GDPR. We have a legitimate interest in protecting our website and forms against misuse, fraud, and spam.

For more information, see theGoogle Privacy Policyand theGoogle Terms of Service.

16. Make (Automation Platform)

We use Make (Celonis Inc., One World Trade Center, 87th Floor, New York, NY, 10007, USA) as an automation platform to process and route lead and customer-related data between our website, Calendly, and Close CRM. Make automates operational steps such as lead routing, status updates, and workflow execution.

Data processed in Make may include:

• Name and contact information
• Company information and enquiry content
• Booking metadata and workflow status data

Legal basis: Art. 6(1)(b) GDPR for pre-contractual measures and contract performance, and Art. 6(1)(f) GDPR based on our legitimate interest in efficient internal process automation.

For more information, see theMake Privacy Notice.

17. Zapier (Webhook Relay)

We use Zapier (Zapier Inc., 548 Market St. #62411 San Francisco, CA 94104-5401, USA) as an integration relay to forward selected events and payloads between Close CRM and Make via webhooks. In this setup, Zapier acts as a technical proxy for data transport and automation handoff.

Depending on the workflow, personal data such as contact details, company data, and interaction metadata may pass through Zapier to trigger downstream automations.

Legal basis: Art. 6(1)(b) GDPR for pre-contractual measures and contract performance, and Art. 6(1)(f) GDPR based on our legitimate interest in a reliable, auditable integration architecture.

For more information, see theZapier Privacy Policy.

18. Close CRM

We use Close (Elastic Inc., PO Box 7775 ECM 86602, San Francisco, CA 94120, USA) as our customer relationship management system. When you interact with us (e.g., via email, contact form, or a booked consultation), your personal data may be stored and processed in Close CRM for the purpose of managing our business relationships, tracking communication, and providing our services.

Data may be entered directly by our team and/or synchronized through Make and Zapier automation workflows.

Data stored in Close CRM may include:

• Name and contact information
• Company name and role
• Communication history (emails, notes)
• Appointment and sales pipeline data

Legal basis: Art. 6(1)(b) GDPR for the performance of a contract or pre-contractual measures, or Art. 6(1)(f) GDPR based on our legitimate interest in efficiently managing customer relationships.

For more information, see theClose Privacy Policy.

19. Data Transfers to Third Countries

Some of the third-party services we use are provided by companies based in the United States. This means that personal data may be transferred to and processed in the USA. The following safeguards apply:

• EU-US Data Privacy Framework: Where the service provider is certified under the EU-US Data Privacy Framework (DPF), an adequate level of data protection is ensured in accordance with Art. 45 GDPR. This applies to Google LLC (including YouTube), Meta Platforms Inc., AWS, Calendly LLC, Elastic Inc. (Close), Zapier Inc., and Make.com, where applicable.
• Standard Contractual Clauses (SCCs): Where the DPF does not apply, data transfers are based on EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

20. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable legal retention obligations (e.g., tax and commercial law). Once the respective purpose no longer applies and no statutory retention periods require further storage, your data will be routinely deleted or anonymised.

Typical retention periods:

• Server log files: 30 days
• Contact enquiries: deleted after the enquiry has been fully resolved, unless a contractual relationship follows
• Automation workflow logs (Make/Zapier): retained only as long as necessary for operations, troubleshooting, and legal compliance
• Contractual and business data: up to 7 years (Estonian Accounting Act) or as required by applicable tax law
• Consent records: retained for the duration of the processing activity plus 3 years

21. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) – You may request confirmation of whether we process your personal data and obtain a copy of such data.
• Right to rectification (Art. 16 GDPR) – You may request correction of inaccurate data or completion of incomplete data.
• Right to erasure (Art. 17 GDPR) – You may request deletion of your personal data where no legal retention obligations apply.
• Right to restriction of processing (Art. 18 GDPR) – You may request that we restrict the processing of your data under certain circumstances.
• Right to data portability (Art. 20 GDPR) – You may request to receive your data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21 GDPR) – You may object to the processing of your personal data based on legitimate interests at any time.

To exercise any of these rights, please contact us atprivacy@dthn.io.

22. Right to Withdraw Consent

Where data processing is based on your consent (Art. 6(1)(a) GDPR), you have the right to withdraw your consent at any time with effect for the future. The lawfulness of data processing carried out on the basis of your consent before its withdrawal remains unaffected.

To withdraw your consent, please contact us atprivacy@dthn.io or adjust your cookie preferences through the consent management tool on this website.

23. Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR (Art. 77 GDPR).

The competent supervisory authority for our company is:

Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39
10134 Tallinn
Estonia
Phone: +372 627 4135
Email: info@aki.ee
Website: www.aki.ee

24. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in our data processing practices or legal requirements. The current version is always available on this page. We recommend reviewing this page periodically.