1. Controller
The controller of your personal data is A'CAPPELLA MUSIC OÜ, registry code 12841940, VAT number EE102019274, address Narva mnt 5, 10117 Tallinn, Kesklinna linnaosa, Harju maakond, Estonia. You can contact us about data protection at support@acappellamusicou.com or by phone at +372 5837 1946.
2. What data we process
- Enquiry data: your name, email address, optional phone number, the topic you choose and the content of your message when you use the contact form or write to us.
- Correspondence and contract data: details exchanged while we prepare a proposal or provide services, such as contact persons, invoicing details and communication history.
- Technical data: IP address, browser type, requested pages and time of the request, recorded in server logs when you visit the website.
- Cookie choice: the consent choice you make in the cookie banner, stored in your browser.
- Advertising measurement data (only with your consent): identifiers and information about your visit collected through Microsoft Advertising Universal Event Tracking (UET), such as the pages viewed and whether you arrived from one of our ads.
We do not ask for special categories of personal data. Please do not include such data in your messages.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering your enquiry and preparing a proposal | Steps taken at your request before entering into a contract, Art. 6(1)(b); our legitimate interest in replying to business enquiries, Art. 6(1)(f) |
| Providing services under a contract | Performance of a contract, Art. 6(1)(b) |
| Keeping accounting records and invoices | Legal obligation, Art. 6(1)(c), under the Estonian Accounting Act |
| Operating and securing the website (server logs) | Legitimate interest in a secure, working website, Art. 6(1)(f) |
| Remembering your cookie choice | Legal obligation to record consent, Art. 6(1)(c), and legitimate interest, Art. 6(1)(f) |
| Measuring our Microsoft Advertising campaigns | Your consent, Art. 6(1)(a) |
4. How long we keep data
- Enquiries that do not lead to a contract: up to 24 months after our last contact.
- Contract and accounting documents: 7 years from the end of the financial year, as required by the Estonian Accounting Act.
- Server logs: up to 30 days, unless needed longer to investigate a security incident.
- Cookie choice: 12 months, after which we ask again.
- Microsoft UET cookies: see the cookie policy for each cookie's lifetime.
5. Recipients and processors
We do not sell personal data. We share it only where needed for the purposes above, with these categories of recipients:
- website hosting provider;
- email and form delivery service providers;
- IT and cloud storage service providers;
- accounting service providers;
- font delivery service (Google Fonts), which receives your IP address when your browser loads the website fonts;
- Microsoft Corporation and Microsoft Ireland Operations Limited, as recipients of advertising measurement data through Microsoft Advertising UET, only if you accept advertising cookies;
- public authorities, where the law requires us to disclose data.
Processors act on our instructions under data processing agreements.
6. Transfers outside the EU
Some service providers, including Microsoft, may process data in the United States. Such transfers rely on the EU-US Data Privacy Framework adequacy decision for providers certified under it, and otherwise on the European Commission's Standard Contractual Clauses.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data erased, where there is no legal reason to keep it;
- restrict processing in certain situations;
- receive your data in a portable format;
- object to processing based on our legitimate interests;
- withdraw your consent at any time, for example through the cookie settings, without affecting processing before withdrawal.
To use these rights, write to support@acappellamusicou.com. We reply within one month.
8. Supervisory authority
If you believe that we process your data unlawfully, you can lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, www.aki.ee, or with the supervisory authority of your EU country of residence.
9. Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections and restricted access to enquiries.
10. Changes
We update this policy when our processing changes. The date at the top shows the latest version.