Privacy Policy

1. Who We Are

This Privacy Policy applies to Manarah Advisory OÜ, a private limited company registered in Estonia (registry code: 17365125), with registered address in Tallinn, Estonia.

Manarah Advisory OÜ is the data controller for personal data collected through this website and through our client engagement process. We are subject to the General Data Protection Regulation (GDPR) as an entity established in the European Union.

For any data-related enquiries, contact us at:

2. Data We Collect and Why

We collect personal data only where necessary and only for specific, legitimate purposes. The personal data we collect includes:

• Name — to address you correctly in correspondence.
• Email address — to respond to your enquiry.
• Company name — optional; to understand the context of your enquiry.
• Message content — to understand your situation and respond appropriately.

This data is submitted voluntarily via the contact form on our website and is processed on the basis of your consent (Article 6(1)(a) GDPR) — specifically, your act of submitting the form — and our legitimate interest (Article 6(1)(f) GDPR) in responding to business enquiries.

We do not collect any special categories of personal data (Article 9 GDPR), and we do not use your data for automated decision-making or profiling.

3. How We Use Your Data

We use the data you submit through the contact form solely to:

• Respond to your enquiry about our services.
• Assess whether we are able to assist you.
• Follow up on our correspondence if you become a client.

We will not use your data for marketing communications, nor will we share it with third parties for their own marketing purposes.

4. Contact Form Processing (Formspree)

Our contact form is processed by Formspree, Inc., a third-party form submission service. When you submit the contact form, your data is transmitted to Formspree's servers and then forwarded to our email address. Formspree acts as a data processor on our behalf.

Formspree's privacy practices are governed by their own Privacy Policy. By submitting the contact form, you acknowledge that your data will be processed by Formspree as part of the transmission process.

5. Data Retention

We retain personal data submitted via the contact form for as long as is necessary to respond to your enquiry and manage any resulting client relationship. Specifically:

• Enquiries that do not result in an engagement: data is retained for up to 12 months from the date of last contact, after which it is deleted.
• Enquiries that result in a client engagement: data is retained for the duration of the engagement and for 5 years thereafter, in accordance with Estonian accounting and commercial law obligations.

After the applicable retention period, personal data is securely deleted or anonymised.

6. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may ask us to correct inaccurate or incomplete data.
• Right to erasure — you may request that we delete your personal data, subject to any legal retention obligations.
• Right to restriction of processing — you may ask us to limit how we use your data in certain circumstances.
• Right to data portability — you may request your data in a structured, machine-readable format.
• Right to object — you may object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us by email. We will respond within 30 days. In most cases, we will not charge a fee for such requests.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), or with the supervisory authority in your country of residence.

7. Cookies and Tracking

This website does not currently use cookies or third-party analytics tracking. If analytics tools are activated in the future (e.g. Google Analytics 4), this policy will be updated and a cookie consent mechanism will be implemented accordingly.

8. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Data transmitted via the contact form is encrypted in transit using HTTPS/TLS.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page reflects when the policy was last revised. We encourage you to review this page periodically.