Privacy Policy & Data Protection Statement

1. Data Controller & Corporate Identification

This website (CodeMint Digital) and its associated graphic design, visual communication, brand systems, and design token engineering services are operated by Codemint Digital OÜ, a private limited company registered in the Republic of Estonia and acting as the Data Controller under Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR).

2. Categories of Processed Data & Legal Basis

In the delivery of our graphic design, brand architecture, and visual communication services, personal and technical data processing is strictly limited to what is necessary under Article 6(1)(b), (c), and (f) of the GDPR:

• Business Inquiries & Project Briefs (Art. 6(1)(b) GDPR): Full name, corporate email address, organization name, chosen service tier (€499–€4,999), and project specifications voluntarily submitted via our intake form or direct email correspondence.
• Network & Security Telemetry (Art. 6(1)(f) GDPR): IP routing headers, HTTP transit timestamps, user-agent data, and diagnostic security logs required to prevent brute-force attacks, mitigate anomalies, and ensure system uptime.
• Contractual & Statutory Records (Art. 6(1)(c) GDPR): Corporate invoicing details, Statements of Work (SOW), and VAT reverse charge compliance documentation retained in accordance with the Estonian Accounting Act.

3. Confidentiality & Non-Disclosure

All client proprietary brand strategies, unreleased design assets, and commercial specifications processed by Codemint Digital OÜ are governed by strict confidentiality obligations. We do not sell, lease, or monetize personal data or client project materials to third parties. Data is disclosed only to authorized infrastructure sub-processors under binding Data Processing Agreements (DPA) or when mandated by competent Estonian or European Union judicial authorities.

4. Data Security & Retention Periods

We implement physical, cryptographic, and organizational safeguards across all processing systems, including TLS 1.3 transport encryption, AES-256 storage encryption, isolated tenant environments, and role-based access controls.

Pre-contractual technical inquiries are retained for up to 12 months. Statutory accounting records and tax invoices are retained for 7 years as required by § 12 of the Estonian Accounting Act.

5. Rights of Data Subjects under GDPR

Under Articles 15–22 of the GDPR, you have the right to request access to your personal data, rectification of inaccurate data, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object to processing based on legitimate interests.

To exercise any of these rights, contact us at studio@codemint-digital.ee.

You also have the right to lodge a formal complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia, website: aki.ee).