How we handle personal information.

The controller of your personal data is:

For questions concerning privacy or your personal data, please contact us at the email address above.

When you submit an enquiry through our website, we may collect:

• your name;
• company or organisation;
• email address;
• information you include in your message.

If you contact us directly by email or another business communication channel, we may also process the contact details and information you choose to provide.

Please do not send sensitive personal information through the website enquiry form unless it is genuinely necessary.

We do not use the website enquiry form to subscribe you to marketing communications.

We process personal data where necessary to:

• review and respond to enquiries;
• communicate with prospective and existing clients;
• understand whether and how we may be able to assist;
• take steps at your request before entering into an agreement;
• manage our professional and business relationships;
• provide agreed services;
• maintain appropriate business and administrative records;
• establish, exercise or defend legal claims where necessary;
• comply with applicable legal obligations.

Depending on the circumstances, our legal basis under the GDPR is generally taking steps at your request before entering into a contract, performance of a contract, our legitimate interests in operating and protecting our business and managing professional relationships, or compliance with a legal obligation.

Where we rely on legitimate interests, we consider whether those interests are proportionate and whether your rights and interests override them.

Most personal data we process is provided directly by you.

We may also receive professional contact information through an organisation you represent, an introduction or referral, or other legitimate business correspondence.

Where appropriate, we may process publicly available professional information where this is relevant to an existing or prospective business relationship.

We do not sell personal data.

Access is limited to Marianna Costa and those members of our team who need the information for their work.

We may also use trusted service providers to support the operation of our business and website, including providers of:

• website hosting and technical infrastructure;
• business email;
• website forms and spam protection;
• IT and security services;
• professional advisers where necessary.

These providers may process personal data only as necessary to provide their services and subject to applicable data-protection requirements.

The website is hosted by Veebimajutus OÜ in Estonia, which also provides our business email. Website forms and spam protection are handled by the website itself and are not sent to any other provider.

We aim to use providers that process personal data within the European Economic Area where practical.

If personal data is transferred outside the EEA, we will ensure that an appropriate transfer mechanism or other safeguard required by applicable data-protection law is in place.

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, accounting or contractual requirements.

Our working retention policy is:

• Enquiries that do not become engagements: normally up to 24 months after the last meaningful contact.
• Client and engagement records: for the duration of the relationship and afterwards for the period reasonably required to meet legal, accounting, contractual and professional obligations.

Where information is no longer required, it will be deleted or securely anonymised.

Depending on the circumstances, the GDPR gives you the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete information;
• request deletion of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain personal data in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with a supervisory authority.

These rights are not absolute and may depend on the circumstances and legal basis for processing.

To exercise your rights, contact office@mariannacosta.ee.

We may need to verify your identity before responding to a request.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

Access to personal information is limited to people and service providers who have a legitimate need to access it.

Our use of cookies, analytics and similar technologies is explained separately in our Cookies notice.

The technologies actually used on the production website must always take precedence over any general statement in this policy.

We may update this Privacy Policy when our website, services, suppliers or legal obligations change.

The current version will always be published on this page together with its last-updated date.