Privacy Policy

1. Field of application

This Privacy Policy describes how Merakeen OÜ (“merakeen”, “we”, “us”) collects, uses, and protects personal data when you use merakeen.com.

Merakeen OÜ is an Estonian company (reg. code 17211921) with its legal address at Sepapaja 6, 15551 Tallinn, Estonia.

Our compliance and legal team oversees data processing activities. For privacy-related inquiries, contact compliance@merakeen.com.

2. Data protection principles

We apply the GDPR principles of lawfulness, fairness, transparency, data minimisation, purpose limitation, storage limitation, and integrity and confidentiality.

We designed this website to avoid unnecessary data collection:

• No analytics tools
• No advertising pixels
• No behavioural tracking
• No cookies that require consent

The site is intended to function without requesting personal data.

3. Information we collect

3.1 Information you choose to provide

If you contact us, we may process:

• Your name (if you provide it)
• Your email address
• The content of your message and any information you include voluntarily
• Any attachments you send

You decide what to share. We never ask for sensitive personal data unless it is necessary for your request.

3.2 Essential server-side logs

Our EU-based hosting in Frankfurt may generate and store essential server logs for security and operational purposes. These logs may include:

• IP address
• Date and time of request
• Requested URL and HTTP status
• User agent (browser and device information)
• Referrer (when provided by your browser)
• Technical identifiers needed to detect abuse or diagnose errors

These logs are not used to build user profiles, track you across sites, or perform marketing analytics.

4. Purposes and legal bases

We process personal data for the following purposes:

• Responding to your messages and requests Legal basis: legitimate interests (responding to enquiries) or taking steps at your request prior to entering a contract (Article 6(1)(b) GDPR), depending on context.

• Security, fraud prevention, and abuse detection Legal basis: legitimate interests (Article 6(1)(f) GDPR).

• Meeting legal obligations (where applicable) Legal basis: legal obligation (Article 6(1)(c) GDPR).

5. Do Not Track & Global Privacy Control

If your browser sends Do Not Track (DNT) or Global Privacy Control (GPC) signals, we do not use them for advertising or analytics decisions because we do not run such tracking on this site. We still treat these signals as a clear expression of your preference for minimal data collection.

6. Sharing of data and processors

We share personal data only when necessary to operate the website and handle communications. This may include:

• Our hosting provider (EU-based infrastructure)
• Email and IT service providers acting as processors under contract

We do not sell personal data and we do not share it with third parties for advertising.

7. International transfers

We striclty ensure your data stays in the European Economic Area. If a service provider processes data outside the EEA, we will ensure appropriate safeguards are in place (for example, Standard Contractual Clauses) and fully abide by GDPR.

9. Security

We use appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit (HTTPS)
• Access controls and least-privilege access
• Monitoring and logging to detect misuse
• Operational security measures appropriate to a small digital studio

No method of transmission or storage is completely risk-free, but we work to minimise risk.

10. Data retention

• Contact messages: retained only as long as necessary to respond, maintain a reasonable record of the interaction, and meet legal requirements.
• Server logs: retained for a limited period appropriate for security, troubleshooting, and legal compliance, then deleted or anonymised.

11. Your rights under the GDPR

You may have the right to:

• Access your personal data
• Rectify inaccurate data
• Request deletion (where applicable)
• Restrict or object to processing (where applicable)
• Receive a copy of your data (data portability, where applicable)

To exercise your rights, contact compliance@merakeen.com.

You also have the right to lodge a complaint with your supervisory authority. In Estonia, our supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

12. Policy updates

We may update this policy to reflect legal, technical, or operational changes. Updates will be published on this page.

Effective date: 3 April 2025