Privacy Policy.

Introduction & Scope

This Policy applies to:

• Visitors to www.krattconsultancy.com and any sub-domain we operate;
• Prospects who fill out contact forms, request a call, or otherwise communicate with us;
• Clients and their nominated points of contact during an engagement;
• End users of websites, voice agents, automations, and content systems we ship for our clients (where we act as a processor on behalf of the client).

Where we provide Services to a Client and process personal data of the Client’s end users in the course of those Services, the Client is the controller and we are the processor; that processing is governed by the data-processing addendum ("DPA") referenced in our engagement, not this Policy. This Policy describes our processing as a controller (e.g. of leads, prospects, clients).

Data Controller

The data controller responsible for personal data processed under this Policy is:

• Propertybase OÜ (trading as “Kratt”)
• Registered office: Linda tn 3-3, 10411 Tallinn, Estonia
• Estonian commercial registry no.: 17416331
• VAT no.: not currently VAT-registered
• Contact: sales@krattconsultancy.com

Definitions

• "Personal data", any information relating to an identified or identifiable natural person.
• "Processing", any operation performed on personal data (collection, storage, use, disclosure, deletion, etc.).
• "Controller", the party that determines the purposes and means of processing.
• "Processor", the party that processes personal data on behalf of the controller.
• "Sub-processor", a third party engaged by us to process personal data on our behalf.
• Other terms have the meanings given in Article 4 of the GDPR.

Categories of Personal Data

We may collect and process the following categories of personal data:

Identification & Contact Data

Name, email address, phone number, business email, job title, company name, postal address, billing address.

Engagement Data

Content of inquiries, project requirements, communications (email, Slack, call recordings or transcripts where you are notified), notes from discovery calls, contracts, invoices.

Technical Data

IP address, browser type and version, device type, operating system, referrer, language, time zone, page-view timestamps, anonymous session identifiers.

Marketing Data

Email open and click events (only where you have consented), your preferences for receiving communications, unsubscribe history.

Financial Data

Bank or payment details necessary to issue invoices and process payments. Card data is handled by our payment processor and not stored by us.

What we do NOT collect

• We do not knowingly collect special-category data (Article 9 GDPR) unless you voluntarily provide it (e.g. accessibility needs);
• We do not collect data from children under 16;
• We do not buy data from data brokers.

How We Collect Data

• Directly from you, via forms, email, calls, contracts, support requests.
• Automatically, via cookies, server logs, and analytics on our website (see Section 8).
• From third parties, LinkedIn (publicly available profile data when we research a prospect), credit-reference agencies (only where required for contracting), authorised referrers.
• Through sub-processors, for example our CRM, calendar, and email-delivery providers, where we have configured them to capture data on our behalf.

Purposes of Processing

• To respond to your inquiries and prepare proposals;
• To enter into and perform a contract with you, including invoicing, project delivery, and post-launch support;
• To operate, maintain, and improve our website;
• To produce case studies, testimonials, and marketing materials (with consent or under legitimate interests with the right to object);
• To comply with legal obligations (accounting, tax, anti-money-laundering, regulatory requests);
• To protect our rights, property, or safety, including investigating and preventing fraud, abuse, or unlawful use of our services;
• To send you transactional and (with your consent) marketing communications.

Legal Bases (GDPR Article 6)

We rely on the following lawful bases:

• Contract (Art. 6(1)(b)), to take steps at your request before entering into a contract and to perform our contract with you.
• Legitimate interests (Art. 6(1)(f)), for prospect outreach to business contacts, marketing of our services to existing clients, fraud prevention, network security, and to administer our business. We have considered your rights and interests and concluded our processing does not override them. You may object at any time.
• Consent (Art. 6(1)(a)), for non-essential cookies, marketing emails to non-clients, and any case where consent is the most appropriate basis. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)), to comply with accounting, tax, AML, and regulatory laws.

Cookies & Tracking

We use cookies and similar technologies sparingly.

• Essential, a small number of cookies strictly required for the site to function (e.g. session, security, load balancing). These do not require consent.
• Analytics & marketing, we currently do not load analytics, advertising, retargeting, or social-media tracking cookies on this website. If we introduce privacy-respecting analytics (for example Plausible or PostHog) or any other non-essential cookie in future, we will request your consent first via a cookie banner and update this Policy before doing so.

You can block or delete cookies via your browser settings; doing so may limit website functionality.

Sub-Processors & Third Parties

We engage carefully selected third parties to provide infrastructure and tools. Each is bound by a data-processing agreement and processes data only on our instructions.

An up-to-date list is available on request from sales@krattconsultancy.com. We give existing clients 30 days’ written notice (where reasonably possible) of any new sub-processor handling their data, and you may object on reasonable grounds.

International Transfers

Some sub-processors are located outside the European Economic Area (EEA). Where personal data is transferred to a country that has not been recognised by the European Commission as providing an adequate level of protection, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented where required by additional technical and organisational measures (encryption, pseudonymisation, contractual restrictions);
• EU–US Data Privacy Framework certification of the recipient (where applicable);
• Other appropriate safeguards under Article 46 GDPR.

You may request a copy of the relevant safeguards by writing to sales@krattconsultancy.com.

Retention Periods

We do not keep personal data longer than necessary. Default retention periods:

• Inquiry forms & prospect emails, up to 24 months from last contact, then deletion or anonymisation.
• Client engagement records, for the duration of the engagement and 7 years thereafter (Estonian accounting and tax law).
• Invoices and accounting records, 7 years (Estonian Accounting Act).
• Email marketing data, until consent is withdrawn or 24 months of inactivity, whichever is first.
• Server logs & security records, 90 days.
• Cookie data, per the lifetime declared in the cookie banner (typically 30 days to 13 months).
• Call recordings/transcripts on our side, 30 days unless required for active dispute or longer retention is required by law.

After expiry of the applicable retention period, data is deleted, anonymised, or archived in a form that no longer permits identification.

Your Rights (GDPR)

If you are in the EEA, the UK, or another jurisdiction with equivalent rights, you have the following rights regarding your personal data:

Exercising your rights is free of charge in the vast majority of cases. We may charge a reasonable fee or refuse manifestly unfounded or excessive requests, as permitted by Article 12(5).

How to Exercise Your Rights

Send a request to sales@krattconsultancy.com describing the right you wish to exercise. We will respond within 30 days of receipt; if the request is complex we may extend this by a further 60 days, and we will notify you of the extension.

We may need to verify your identity before responding to protect your data; we will only request information strictly necessary for verification.

Where the data was provided to us by a Client (and we are the processor), we will direct you to the Client (the controller) and assist them in fulfilling your request.

Marketing & Communications

We send three categories of email:

• Transactional, project updates, contracts, invoices, important account notifications. Sent under the contract; cannot be unsubscribed without ending the engagement.
• Service-related, ToS or Privacy Policy changes, security or breach notifications, sub-processor changes. Sent under legal obligation; cannot be unsubscribed.
• Marketing, occasional notes on what we’re shipping, case studies, hiring announcements. Only sent with your consent (or to existing clients on a soft opt-in under Estonian/EU rules), and you can unsubscribe with one click via the link in every email.

Automated Decisions & AI

We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing.

Some of our internal tools use AI (lead scoring, ICP fit, response drafting). Outputs from such tools are recommendations only and are reviewed by a human before any decision is taken. AI outputs may be inaccurate; you have the right under Article 22 to obtain human intervention, express your view, and contest any decision.

When we provide AI-driven services to clients (voice agents, content generation, automations), the legal characterisation depends on the configuration and is governed by the DPA agreed with the client.

Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit (TLS) and at rest (AES-256 or equivalent) for sensitive data;
• Strong access controls: SSO, MFA, principle of least privilege, role-based access;
• Logging and monitoring of access to systems containing personal data;
• Hardened deployment infrastructure on reputable cloud providers;
• Regular security review of dependencies and sub-processors;
• Confidentiality obligations for all personnel and contractors;
• Backups and tested recovery procedures.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we work hard and continuously to protect the data entrusted to us.

Data Breach Notification

If we become aware of a personal-data breach affecting your personal data, we will:

• Notify the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) within 72 hours where required by Article 33 GDPR;
• Notify affected data subjects without undue delay where the breach is likely to result in a high risk to your rights and freedoms (Article 34);
• Document the breach, its effects, and remedial actions taken, regardless of whether notification is required.

For breaches affecting personal data we process on a Client’s behalf, we notify the Client as controller without undue delay per the DPA.

Children’s Data

Our website and services are intended for businesses and adults. We do not knowingly collect personal data from children under 16 years of age. If you believe we have inadvertently collected such data, please contact sales@krattconsultancy.com and we will delete it promptly.

Processor Role (B2B Engagements)

When we provide Services to a Client and process personal data of the Client’s end users, customers, or employees, we act as the processor and the Client is the controller. The relationship is governed by the DPA referenced in our SOW. In that capacity:

• We process personal data only on documented instructions from the Client;
• We do not use such personal data for our own purposes (including model training of third-party providers, where opt-out is configurable);
• We ensure persons authorised to process the data are bound by confidentiality;
• We assist the Client in fulfilling data-subject requests and notification obligations;
• We delete or return all such personal data at the end of the engagement, unless retention is required by law.

Changes to This Policy

We may update this Policy from time to time. The current version is always available at /privacy with a "last updated" date and version. For changes that materially affect your rights or our processing of your personal data, we will use commercially reasonable efforts to notify you in advance (e.g. by email or by an in-product banner).

Complaints

If you believe we have processed your personal data unlawfully, please contact sales@krattconsultancy.com first, we genuinely want to fix it. You also have the right to lodge a complaint with a data-protection supervisory authority, including:

• Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tõnismägi 3, 15197 Tallinn, Estonia · aki.ee
• Or the supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

Isikuandmete töötlemine otseturunduses (B2B, eesti keeles)

Kes me oleme. Kratt Consultancy on Propertybase OÜ (registrikood 17416331, Linda tn 3-3, 10411 Tallinn) kaubamärk. Kontakt: karl@krattconsultancy.com.

Mida me teeme. Saadame Eesti äriühingutele e-kirju, milles tutvustame oma teenuseid e-poodidele. Kirju läheb ühele ettevõttele kuni kolm. Iga kirja lõpus on link, millega saab edasistest kirjadest ühe klõpsuga loobuda.

Kust andmed pärinevad. Ettevõtte äriregistrisse kantud kontaktaadress ja juhatuse liikme nimi (äriregistri avaandmed), ettevõtte avalik veebileht ja äriregistris avaldatud majandusaasta aruanded. Muid andmeid me ei kogu.

Õiguslik alus. Õigustatud huvi (üldmääruse art 6 lg 1 p f): teenuste pakkumine äriühingule tema ametlikul kontaktaadressil. Kirjad ei sisalda eriliiki andmeid ega automaatseid otsuseid.

Kui kaua andmeid hoiame. Kuni kaks aastat nimekirja koostamisest. Kui te kirjadele ei vasta, eemaldame nime ja e-posti aadressi 90 päeva pärast viimast kirja. Loobumise fikseerime püsivalt, et me sama aadressi enam ei kasutaks. See on ainus asi, mida me loobumise järel alles hoiame.

Teie õigused. Võite igal ajal esitada vastuväite (art 21) kirja lõpus oleva lingi kaudu või e-kirjaga aadressile karl@krattconsultancy.com. Samal aadressil saab küsida, milliseid andmeid me teie kohta hoiame, ning nõuda nende parandamist või kustutamist. Vastame 30 päeva jooksul. Kaebuse saab esitada Andmekaitse Inspektsioonile (aki.ee).

Kes andmeid veel töötleb. Kirjad liiguvad Google Workspace'i kaudu, loobumislink töötab Vercelil, andmebaas asub meie serveris Hetzneris Euroopa Liidus.

Personal data in our UK business outreach

Who we are. Kratt Consultancy is a trading name of Propertybase OÜ, a company registered in Estonia (registry code 17416331, Linda tn 3-3, 10411 Tallinn, Estonia). Contact: karl@krattconsultancy.com.

What we do. We email founders and directors of UK creative, brand and digital agencies to offer our services. We write to each person at most four times over about two weeks, and we may send one LinkedIn connection request by hand. Every email tells you how to stop: reply “no” and we will not contact you again.

Where the data comes from. Companies House (company details, the names of directors and people with significant control, filed accounts), your agency’s own website, public job adverts and industry award shortlists. Your work email address is either published on your website or worked out from your name and your company’s domain. Before we write, we check that the address exists, with your company’s mail server (no email is sent in that check) and with an email verification service. We collect nothing else.

What we hold. Your name, your role, your work email address, your company’s name, website and public details, and the public signal that made us write (for example a job advert). If you reply, we also keep the conversation.

Legal basis. Legitimate interests (UK GDPR Article 6(1)(f)): offering our services to a company at a work address of its founder or director. We only email limited companies and LLPs. Under the Privacy and Electronic Communications Regulations (PECR), emails to these corporate subscribers do not need prior consent, as long as we say who we are and make it easy to opt out. We have carried out a legitimate-interests assessment; you can ask for a copy. The emails involve no special-category data and no automated decisions.

How long we keep it. Up to two years from when we compile the list. If you do not reply, we delete your name and email address 90 days after our last email. If you opt out, we keep a permanent record of that, so that we never use the address again. That record is the only thing we keep after you opt out.

Your rights. You can object at any time (UK GDPR Article 21): reply “no” to any email, or write to karl@krattconsultancy.com, and we stop straight away. You can also ask what we hold about you, and ask us to correct or delete it. We reply within one month.

Complaints. If you think we have handled your data wrongly, tell us first: by email to karl@krattconsultancy.com, through the form at krattconsultancy.com/contact, or by post to the address above. We acknowledge a complaint within 30 days and tell you the outcome. You can also complain to the Information Commission (ico.org.uk). Our lead supervisory authority in the EU is the Estonian Data Protection Inspectorate (aki.ee).

Who else processes the data. Our mailboxes run on Google Workspace. Emails are scheduled and sent through Instantly. Addresses are checked with MillionVerifier. Our database, including the do-not-contact list, is on our own server at Hetzner in the European Union. Transfers outside the UK and the EEA rely on the safeguards described in Section 10.

Contact & DPO

For privacy questions, data-subject requests, or to exercise any of your rights, contact:

We have not appointed a formal Data Protection Officer because our processing does not meet the thresholds in Article 37 GDPR. The Privacy contact above is empowered to handle data-protection matters and will involve external legal counsel where appropriate.