Last updated: 13 October 2026
This policy explains how personal data is used when you visit vectadesign.com, contact us or use the services available through this website.
1. Who is responsible for your data?
The controller is Osaühing Vecta Design (Vecta Design OÜ), registry code 11249560, Pärlimõisa tee 20, 80010 Pärnu, Estonia. For questions or privacy requests, email [email protected], call +372 442 3023, or write to our postal address. Further company details are in our Legal Notice.
2. Website visits and technical data
Delivering a webpage requires processing your IP address and the resource requested. Our website infrastructure may also process the time of the request, browser and device information, referring page, search terms entered on the site, response status and security events. We use this information to deliver pages and downloads, maintain availability, diagnose errors and prevent misuse. The legal basis is our legitimate interest in operating a secure and reliable business website, Article 6(1)(f) GDPR.
Amazon Web Services provides hosting, and Cloudflare supports website delivery and protection. Website administrators and technical service providers may access technical data where necessary to operate, support or secure the website. Technical records are retained according to the need to diagnose faults, detect misuse and investigate security incidents; records needed for an identified incident or legal claim may need to be retained until that matter is resolved.
3. Enquiries, forms and business communications
When you contact us by email, telephone or an available form, we process the information you provide, such as your name, business contact details, organisation, project requirements, message and attachments, to answer your enquiry and manage the requested service. Our business email is handled through Google. Please provide only information relevant to your request.
If you request a quotation or contract for yourself, the legal basis is taking steps at your request before a contract or performing a contract, Article 6(1)(b) GDPR. For enquiries from representatives of businesses and other general correspondence, we rely on our legitimate interest in responding and maintaining business relationships, Article 6(1)(f). Where a legal record-keeping obligation applies, the basis is Article 6(1)(c).
Providing contact and project information is voluntary, but we may be unable to answer or prepare a quotation without the information necessary for that request. We keep enquiry and project correspondence for handling the enquiry, agreed work and relevant follow-up, and where necessary for applicable warranty, statutory record-keeping and legal-claim periods. The relevant period depends on whether an enquiry results in a contract and whether a legal obligation or unresolved claim applies.
Some links and optional forms use Typeform. A form embedded on this site is blocked until you allow external services. When you use a Typeform form, Typeform processes technical information and the answers you choose to submit to deliver the form to us. The same enquiry purposes and retention criteria apply to answers received by us. You can instead email us directly. A link that opens Typeform’s own website is subject to that website’s privacy and cookie controls.
4. Accounts, requested transactions and comments
If you use an available account or transaction function, we process the account, contact and transaction details you provide to operate that function, fulfil your request and protect the account. The legal bases are Article 6(1)(b) for the requested service, Article 6(1)(f) for security and administration, and Article 6(1)(c) where statutory records are required. Account data is kept while the account is needed; transaction records may need to be retained for the applicable statutory and legal-claim periods after the account is closed.
If you submit a comment, we process the information entered and relevant technical information to moderate the discussion and prevent spam, based on Article 6(1)(f). Your chosen display name and approved comment can be visible to other visitors. Approved comments are retained while they remain relevant to the published discussion; moderation and abuse-prevention records are retained for handling moderation, misuse or related claims. Please do not put confidential information in a public comment.
5. Languages, cookies and optional content
Weglot is used to provide translated versions of the website. It processes page content and the information needed to display the language you request. The purpose is to provide an accessible multilingual website, based on our legitimate interest under Article 6(1)(f). Language preferences and translation storage depend on the feature used.
Complianz manages your privacy choices. Necessary consent-preference storage keeps the website aware of your choices and is used for consent administration and compliance, under Articles 6(1)(c) and 6(1)(f), as applicable. Optional external content uses your consent under Article 6(1)(a). Details of cookies, browser storage, purposes and durations are in our Cookie Policy.
Embedded YouTube videos are provided by Google Ireland Limited. They are blocked until you allow external services. When enabled, YouTube receives information such as your IP address, device/browser information, the page containing the video and your interactions with the player. Google may also process identifiers for its own purposes and associate activity with your Google account if you are signed in. See Google’s Privacy Policy.
The Google Analytics and Hotjar tracking scripts installed on this website are currently disabled. Our website font files are hosted locally. Ordinary links to social networks open the external service when you choose to follow the link; the external service then applies its own privacy rules.
You may reject optional services and still browse the website and contact us. Use Cookie settings to change or withdraw consent at any time. Withdrawal affects future processing and does not make processing before withdrawal unlawful. It also does not delete information already received by an external provider; you can exercise your rights with us or that provider as appropriate.
6. Recipients and international processing
Data may be available to staff handling your request and service providers supporting hosting, delivery, security, translation, email and forms, as described above. We may also disclose relevant information to professional advisers or competent authorities where needed to comply with law or establish, exercise or defend legal claims.
Some providers operate internationally and may process data outside the European Economic Area, including in the United States. The safeguards used by these providers include applicable European Commission adequacy decisions and Standard Contractual Clauses, depending on the recipient and transfer. These safeguards do not mean that every service is hosted only in the EU. Provider information is available from AWS, Cloudflare, Weglot and Google. Contact us if you need information about the recipients or safeguards applicable to your data, or a copy of relevant safeguards.
7. How long is information kept?
The purpose-specific criteria above determine retention. We consider whether the request or service is complete, whether a continuing customer relationship or warranty requires the record, whether statutory retention applies, and whether the record is needed for an actual or reasonably foreseeable legal claim. Information should not be retained merely because storage is available. Cookie and browser-storage durations are listed separately in the Cookie Policy. You can ask us about the retention period applicable to your particular information and request deletion where the GDPR permits it.
8. Your rights
Subject to the conditions in the GDPR, you may request access to and a copy of your data, correction, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your situation. You may object to direct marketing at any time. Where we rely on consent, you may withdraw it at any time.
Send requests to [email protected]. We may ask for information needed to confirm your identity and locate the relevant records. We respond within the applicable GDPR time limits, normally within one month. You may complain to Estonia’s Andmekaitse Inspektsioon, or the supervisory authority in your place of habitual residence, work or the alleged infringement.
9. Changes
We update this notice when our website or processing arrangements change. The date above identifies the current version. Material changes to optional processing will be reflected in the privacy choices presented on the site.