Privacy policy

Controller under the General Data Protection Regulation (GDPR): Haydamax OÜ, Narva mnt 5, 10117 Tallinn, Estonia, registry code 17351554, team@spng.space.

We are not required to appoint a data protection officer. Write to the address above with any question about your data.

The website runs on our own server at Hetzner Online GmbH in a data centre in Falkenstein, Germany. Hetzner processes data on our behalf under a data processing agreement (Art. 28 GDPR).

Every time a page is called up, the server records the IP address, the date and time, the address requested, the referring page, the browser and operating system, and the response status. We need this to deliver the site, to keep it secure and to find errors. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a secure, working website. The logs are deleted automatically after 14 days.

We count visits with Umami, an open-source tool that we run on our own server at Hetzner in Finland. Umami sets no cookies and builds no profile across websites. It records the page viewed, the referring page, the browser, the operating system, the type of device and the country derived from the IP address; the IP address itself is not stored. Legal basis: Art. 6 (1) (f) GDPR, our interest in knowing how the site is used. You may object at any time by email.

When you write to us through a form or by email, we process what you send: usually your name, email address, company and message, and in the project form your budget and timeline. We use it to answer you and, if you wish, to prepare an offer. Legal basis: Art. 6 (1) (b) GDPR (steps before a contract) and Art. 6 (1) (f) GDPR (answering enquiries).

Form messages are stored in the database on our server in Germany; email is handled by our own mail server at Hetzner in Finland. So that a message about impersonation or a complaint reaches us on the same day, a notification with the name, email address and text is also sent to us through the messenger Telegram (Telegram FZ-LLC, Dubai, United Arab Emirates), a country without an EU adequacy decision. Legal basis: Art. 6 (1) (f) GDPR. If you do not want this, send your message by email instead.

We delete enquiries once they have been dealt with and no contract follows, at the latest after three years. Where a contract follows, accounting law requires us to keep the records for seven years.

The public pages of this site set no cookies. A technically necessary sign-in cookie is used only for the site administrators.

Fonts, scripts, images and videos are delivered from our own server. No external content delivery networks, no Google Fonts and no embedded third-party players are used.

We do not sell or rent personal data and do not use it for advertising. Recipients are only our service providers named above and, where the law requires it, public authorities.

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), erased (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on legitimate interests (Art. 21). Consent you have given can be withdrawn at any time with effect for the future.

You may complain to a data protection supervisory authority, in particular in the country where you live or work. The authority responsible for us is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia.

All data is stored in the European Union. Wherever you live, you can exercise the rights above by writing to us, and we will also honour the rights given to you by the law of your country.

United Kingdom: UK GDPR; complaints to the Information Commissioner's Office. Switzerland: Federal Act on Data Protection; complaints to the Federal Data Protection and Information Commissioner. Norway and the rest of the EEA: GDPR; complaints to your national authority. Türkiye: Law No. 6698 (KVKK); rights under Article 11, complaints to the Personal Data Protection Authority. Ukraine: Law on Personal Data Protection; complaints to the Ukrainian Parliament Commissioner for Human Rights. United States: we do not sell or share personal information.

We make no automated decisions and do no profiling. You are not obliged to provide personal data; without contact details, however, we cannot answer you.

We update this policy when the site or the law changes. Version of 28 October 2026. In case of doubt, the German version applies.