1. Data controller
The controller of your personal data is Neoligrid OÜ, a private limited company registered in Estonia (registry code 17620965), located in Pärnu, Estonia. Contact: hello@secondop.eu.
We process personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Estonian Personal Data Protection Act (isikuandmete kaitse seadus).
2. Data we collect
2.1 Data you give us
- Contact form / order details: name, company name, email address, approximate quote value, and the description you provide.
- Vendor quotes and related documents you upload or email to us for review, which may contain personal data of you, your colleagues or the vendor's staff (names, emails, signatures, rates).
- Billing data: company details, invoice address, VAT number, payment confirmations.
- Correspondence: emails and call notes relating to your review.
2.2 Data collected automatically
- Server logs (IP address, browser type, pages requested, timestamps) kept for security and troubleshooting.
- Cookie and local-storage data as described in our Cookie Policy.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Responding to your enquiry and preparing a quote review | Contact data, quote documents | Art. 6(1)(b) — performance of a contract / pre-contractual steps |
| Invoicing and accounting | Billing data | Art. 6(1)(c) — legal obligation (Estonian Accounting Act) |
| Website security and troubleshooting | Server logs | Art. 6(1)(f) — legitimate interest |
| Anonymous analytics | Cookie data | Art. 6(1)(a) — consent |
| Service updates and occasional newsletters | Art. 6(1)(a) — consent (opt-out any time) | |
| Establishing or defending legal claims | Any relevant data | Art. 6(1)(f) — legitimate interest |
4. Vendor quotes and confidentiality
Aggregated, fully anonymised market statistics (e.g. "average hourly rate for Estonian web development") may be derived from reviews to improve our benchmarks. Such statistics never contain names, company identifiers or document extracts.
5. Retention
- Quote documents and review reports: 12 months after delivery, then deleted — or earlier on request.
- Contact-form submissions that do not lead to an order: 6 months.
- Accounting records (invoices): 7 years, as required by the Estonian Accounting Act.
- Server logs: up to 90 days.
- Email correspondence: up to 3 years for legal-claim purposes.
6. Sharing and processors
We do not sell personal data. We share data only with service providers acting on our instructions under data-processing agreements:
- Website hosting and data storage (cloud infrastructure providers).
- Email and document-collaboration providers.
- Accounting software and our accountant.
- Payment service providers (card payments / bank transfers).
We may disclose data where required by law, court order or a competent authority.
7. International transfers
Where a provider processes data outside the European Economic Area, we rely on an adequacy decision of the European Commission or on Standard Contractual Clauses with supplementary measures where needed.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data rectified;
- have data erased ("right to be forgotten") where there is no overriding legal reason to keep it;
- restrict or object to processing based on legitimate interest;
- receive your data in a portable format;
- withdraw consent at any time, without affecting prior processing;
- lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or your local supervisory authority.
To exercise any right, email hello@secondop.eu. We respond within one month.
9. Security
We apply appropriate technical and organisational measures, including encrypted transmission (HTTPS), access controls, two-factor authentication on our systems, and the principle of least privilege. Access to quote documents is limited to the reviewer assigned to your case.
10. Cookies
Our use of cookies and similar technologies is described in the separate Cookie Policy. You can change your preferences at any time via the "Cookie settings" link in the footer.
11. Changes to this policy
We may update this Privacy Policy from time to time. The current version is always published at secondop.eu/privacy.html with the date of the latest revision. Material changes will be highlighted on the website.
12. Contact
Neoligrid OÜ · Registry code 17620965 · Pärnu, Estonia
Email: hello@secondop.eu