Privacy Policy
Last updated: 21 October 2026
This policy explains what personal data Huemare Group OÜ (“Huemare”, “we”, “us”) collects when you visit huemare.com or contact us through it, why we use it, how long we keep it and which rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Estonian Personal Data Protection Act.
1. Who is responsible for your data
The data controller is:
- Company
- Huemare Group OÜ (private limited company)
- Registry code
- 17268474 (view in register)
- Registered address
- A. Weizenbergi tn 32, 10127 Tallinn, Estonia
- VAT number
- EE102874095
- Privacy contact
- [email protected]
We are not required to appoint a Data Protection Officer. For any privacy question or request, write to [email protected].
2. What data we collect
2.1 When you visit the website
Our website is delivered through Cloudflare. To deliver the pages securely, Cloudflare processes technical data such as your IP address, browser type, device, requested page, date and time. We do not use analytics, advertising or tracking tools, we do not load third-party fonts, scripts or embeds, and we do not build visitor profiles.
2.2 When you contact us
Through the contact form: topic, name, email address and your message.
2.3 When you apply for startup investment or a growth partnership
Through the application form: name, email, profile link (e.g. LinkedIn or X), location, startup name and website, and business information you choose to share — for example your story, team, stage, revenue range, growth, acquisition channels, advertising spend, needs, target markets, challenges and a link to your pitch deck.
2.4 When you apply for a job
Through the job application form: name, email, phone (optional), city and country, profile or portfolio link, languages, availability, your motivation, whether you can work on-site in Tallinn, and your CV if you upload it. Please do not include sensitive information (such as health, religion or political opinions) or ID numbers in your CV or answers — we do not need it.
2.5 Abuse prevention
When you submit a form we store a one-way hashed (pseudonymised) version of your IP address to limit spam and repeated submissions. We cannot read your IP address from it.
2.6 When you email us
If you email us directly, we process your email address, the content of the message and any attachments.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Delivering the website securely, preventing attacks and abuse | Technical data, hashed IP | Legitimate interest — Art. 6(1)(f) |
| Answering your messages | Contact form data, emails | Legitimate interest — Art. 6(1)(f); steps before a contract — Art. 6(1)(b) where applicable |
| Assessing startup and growth-partnership applications | Application data | Steps at your request before entering into a contract — Art. 6(1)(b) |
| Recruitment for the role you applied for | Job application data, CV | Steps at your request before entering into a contract — Art. 6(1)(b) |
| Considering you for other or future roles | Job application data, CV | Your consent — Art. 6(1)(a), given with the optional checkbox; you can withdraw it at any time |
| Complying with legal obligations and defending legal claims | Relevant records | Legal obligation — Art. 6(1)(c); legitimate interest — Art. 6(1)(f) |
Where we rely on legitimate interest, our interest is to run a secure website and to respond to people who contact us. You can object at any time (see section 8).
4. How long we keep your data
| Data | Retention |
|---|---|
| Contact messages | 24 months after the last exchange, then deleted |
| Startup and growth-partnership applications | 24 months after submission, then deleted — or longer if we start working together (then the contract terms apply) |
| Job applications and CVs | 6 months after submission; 12 months if you ticked the optional box to be considered for other roles. Then deleted automatically — unless you are hired, or you ask us to delete them earlier |
| Hashed IP for abuse prevention | Stored with the submission and deleted together with it |
| Technical access data at Cloudflare | Short-term security logs according to Cloudflare’s retention, typically a few days |
Our systems delete expired applications and CVs automatically. Data may be kept longer only where the law requires it or to establish, exercise or defend legal claims.
5. Who receives your data
We do not sell personal data and do not share it for advertising. Inside Huemare, only the people who need it to handle your request can access it. We use these service providers (data processors) under data-processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting and delivery, security, form database (Cloudflare D1) and CV storage (Workers KV) | Database in the EU region (Eastern Europe); global network for delivery and storage replication |
| Google Ireland Ltd. / Google LLC (Google Workspace) | Our company email, when we correspond with you | EU and USA |
If we work together, your data may be shared with the Huemare group company or brand involved in the project. We may also disclose data to authorities, courts or advisers (such as lawyers and auditors) when legally required or necessary to protect our rights.
6. Transfers outside the EU/EEA
Some providers (Cloudflare and Google) may process data in the United States or other countries outside the EU/EEA. In those cases, transfers are protected by the EU–U.S. Data Privacy Framework (both providers are certified) and/or the European Commission’s Standard Contractual Clauses, together with additional safeguards such as encryption in transit. You can ask us for more information about these safeguards.
7. Security
We protect your data with appropriate technical and organisational measures, including: encrypted connections (HTTPS/TLS) everywhere, access to applications only through a password-protected private inbox, storage of IP addresses only as one-way hashes, spam protection, file-type and size checks for uploads, and automatic deletion after the retention periods. No system is 100% secure, but we work to keep risks low and will notify you and the authorities of a personal-data breach where the law requires it.
8. Your rights
Under the GDPR you have the right to:
- Access — get a copy of the personal data we hold about you (Art. 15);
- Rectification — have inaccurate data corrected (Art. 16);
- Erasure — ask us to delete your data (“right to be forgotten”) (Art. 17);
- Restriction — ask us to limit how we use your data (Art. 18);
- Data portability — receive data you gave us in a structured, machine-readable format (Art. 20);
- Object — object to processing based on legitimate interest (Art. 21);
- Withdraw consent at any time, without affecting processing before the withdrawal (Art. 7(3)).
To exercise any right, email [email protected] from the address you used with us. We answer within one month (extendable by two months for complex requests, in which case we will tell you). It is free of charge. We may ask for information to confirm your identity.
9. Right to complain
You can lodge a complaint with a data-protection supervisory authority, in particular in the EU country where you live or work. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia — [email protected] — www.aki.ee. We would appreciate the chance to resolve your concern first, so please contact us.
10. Cookies and local storage
We do not use advertising, analytics or tracking cookies, so we do not show a cookie banner.
- Local storage (your browser): if you close the announcement bar at the top of the site, your browser remembers it until the end of the month so it is not shown again. This is stored only on your device, is not sent to us and contains no personal data. You can clear it in your browser settings.
- Security cookies: Cloudflare may set strictly necessary cookies (for example
__cf_bmorcf_clearance) to tell humans and bots apart and protect the site. They are essential for security and do not track you across websites.
11. Other information
- Is providing data required? No. Using the website does not require you to give us personal data. Fields marked as required in our forms are needed to process your request; without them we cannot assess your application or reply.
- Automated decisions: we do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you. Every application is reviewed by a person.
- Children: our website and forms are not directed at children under 16, and we do not knowingly collect their data.
- Other brands: brands and companies operated by Huemare (such as Tarj Studio) may have their own privacy notices for their products.
12. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version. If changes are significant, we will highlight them on the website.