Privacy Policy
Last updated: 2026-09-14
HackIT Security OÜ ("we", "us") operates hackit.ee and is the data controller for the personal data described below. This policy explains what we collect, why, and what rights you have under the GDPR.
Data We Collect
When you use our contact form, we collect your name, email address, company name (optional), and any message you write. When you submit the form, we also briefly process your IP address (see below) — we do not otherwise track visitors or build profiles.
Why We Process It (Legal Basis)
Contact-form data is processed to respond to your inquiry and, where it concerns a possible security engagement, to take steps you request toward a contract (Art. 6(1)(b) GDPR); for general inquiries, our basis is a legitimate interest in responding to business communications (Art. 6(1)(f) GDPR). Your IP address is processed only to rate-limit the contact form against automated abuse, also under legitimate interest (Art. 6(1)(f) GDPR).
Third-Party Processors
We use a transactional email delivery provider, based in the United States, to deliver contact-form emails on our behalf, under a Data Processing Agreement. Because that provider is US-based, your message content is transferred outside the EU/EEA; this transfer is safeguarded by the provider's certification under the EU-U.S. Data Privacy Framework (including the UK Extension) and by Standard Contractual Clauses in its DPA. We also use a privacy-focused web analytics service for anonymised, aggregated page-view statistics — it sets no cookies and collects no personally identifiable information. The identity of these providers is available on request at privacy@hackit.ee.
Data Retention
We keep contact-form inquiries for as long as necessary to respond to you and, if an engagement follows, for the duration of that relationship and any legally required period afterward. If no engagement follows, you may ask us to erase your inquiry at any time. IP addresses used for rate limiting are held in server memory only, for at most 10 minutes, and are never written to a database or log file.
Cookies & Local Storage
We do not use tracking or advertising cookies. Our analytics service operates without cookies. Your light/dark theme preference is stored in your browser's local storage only — it stays on your device and is never sent to us.
Your Rights (GDPR)
You have the right to access, rectify, erase, or restrict the processing of your personal data, to object to processing based on legitimate interest, and to data portability. To exercise any of these, contact us at privacy@hackit.ee. Given the scale of our processing, we are not required to appoint a Data Protection Officer under Art. 37 GDPR — the email above reaches the people responsible for privacy matters directly. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or with the supervisory authority in your own EU/EEA country of residence.
Changes to This Policy
We may update this policy as our data practices change. The "Last updated" date above reflects the most recent revision; material changes will be reflected here.
Contact
HackIT Security OÜ, Tallinn, Estonia. contact@hackit.ee