Depowise Privacy Policy.

1.1 Who is responsible for processing your data

Depowise OÜ serves as the data controller for personal data collected when visitors use the website. Full contact details appear at the end of this policy.

1.2 Persons affected and types of data processed

Website visitors are affected by data processing activities. The company collects information about access patterns through tracking technologies, including pages visited, duration of visits, navigation patterns, IP address, browser type, and version.

Visitors may also voluntarily provide personal details when booking demos, subscribing to communications, or contacting the company. This includes name, email, phone number, employer, and job position.

Data provision marked as mandatory is necessary for service delivery. Combining data from multiple sources occurs as needed.

1.3 Purposes and lawful basis for processing

Website functionality, performance improvement, and usage analytics rely on legitimate business interests. The company processes data to maintain security and enhance relevance.

Request responses and contract negotiations are supported by legitimate interests or contractual performance. Marketing communications are based on consent, which subscribers can withdraw at any time.

Personal data may be converted into anonymous or aggregated formats for testing, research, analytics, and service development. Anonymised information may be retained indefinitely.

1.4 Data retention

Personal data is retained only as long as necessary. Website usage data is kept for six months maximum. Request-related information is retained for one year to manage relationships and handle follow-up inquiries.

Longer retention periods may apply for dispute resolution, protecting lawful interests, or meeting legal requirements.

Archived or backup systems may contain data temporarily for system integrity and legal compliance purposes. Access remains strictly limited, with permanent deletion or anonymisation following the retention periods.

1.5 Cookies and tracking

Cookies are small files containing user identification codes and browsing history. The company uses them to distinguish users and monitor website improvements, while enabling partners to display relevant advertising.

The Cookie Policy is available on the website. Consent for cookies is managed through a cookie manager and can be withdrawn. Disabling all cookies may impair website functionality.

2.1 Who is responsible for processing your data

SaaS Products. Depowise acts as a data processor for customer-entered data, including personal information transmitted through the product. Customers serve as data controllers and must ensure valid processing authority. The company acts as a data controller for business contact information used for billing and support.

On-Premises Products. Generally, the company does not control or process customer data within on-premises installations. However, if customers grant access for support or maintenance, the company may act as a data processor. Business contact information for account administration remains under company control.

2.2 Persons affected and types of data processed

Affected parties include customer-appointed contact persons and employees reaching out to the company. Contact data includes first name, last name, email address, phone number, and job position.

Employees and individuals whose data enters Depowise Products are affected by processing. This may include work-related contact details and correspondence records.

2.3 Purposes and lawful basis for processing

Contact data is processed for contract administration and fulfilment. Legitimate interests protect the company’s rights in disputes and debt collection.

For data processor functions, customers control data processing purposes through Data Processing Agreements. SaaS customers can transmit, input, view, edit, and delete information through dashboards and APIs. On-premises customers grant explicit access when requesting support or maintenance services.

2.4 Data retention

Personal data is retained only as long as necessary. Customer data is kept for the contract duration plus three years. Accounting and billing data is retained seven years or per legal requirements.

Data on persons is retained during the contract term and deleted within 12 months after termination. Deletion requests from data subjects or customers are honoured unless legal requirements apply. Data deletion may prevent service continuation.

Backup systems retain data temporarily for system restoration and compliance. Permanent deletion or anonymisation follows applicable retention periods.

3.1 Storing and transferring your personal data

The company implements technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, change, or damage. Data is stored on secure cloud provider servers.

Personal data transfers outside the EU/EEA comply with GDPR Chapter V through adequacy decisions or Standard Contractual Clauses approved by the European Commission.

3.2 Recipients

Third-party service providers receive personal data to support company operations. Sub-processors include:

3.3 Your rights

Data subjects may exercise the following rights by submitting requests to the company:

• Right to information: obtaining clear details about data processing, purposes, and lawful basis.
• Right of access: requesting copies of personal data held by the company.
• Right to data portability: receiving data in structured, machine-readable formats, or requesting direct transfer to another controller where technically feasible.
• Right to rectification: correcting inaccurate or incomplete personal data.
• Right to restrict processing: requesting processing limitations in specific circumstances, including accuracy disputes or unlawful processing.
• Right to object: objecting to processing based on legitimate interests or direct marketing. The company ceases processing unless compelling legitimate grounds exist or legal claims require it.
• Right to erasure: requesting deletion when data is no longer necessary, consent is withdrawn, or processing is unlawful. Exceptions apply for legal compliance or claim establishment.
• Right to withdraw consent: withdrawing consent at any time without affecting prior lawful processing.
• Right to lodge a complaint: filing complaints with local data protection authorities regarding non-compliance.

3.4 Amendments to the privacy policy

The company may update this policy with reasonable notice through the website or email. The “last modified” date reflects current versions. The policy published on the company website is considered valid and effective.

3.5 Contacting us

Depowise OÜ
Estonian commercial register code: 16379409
Registered address: Liivalaia tn 36, 10132 Tallinn, Estonia
Email: dpo@depowise.com
Supervisory authority: Estonian Data Protection Inspectorate (www.aki.ee)