Privacy Policy
Effective from: 23.09.2026 · Last updated: 23.09.2026
1. General
This privacy policy explains what personal data Granisten collects, for what purpose and on what legal basis we process it, who we share it with, how long we keep it and what rights you have in relation to your data.
We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), the Estonian Personal Data Protection Act and other applicable legislation.
This document exists in Estonian, Russian and English. In the event of any discrepancy between the language versions, the Estonian version prevails.
Data controller:
Granisten OÜ
Registry code: 14918606
VAT number: EE102234868
Registered address: Peterburi tee 16-56, 11411 Tallinn, Estonia
Workshop and showroom: Tartu mnt 80, Tallinn
E-mail: info@granisten.ee
Phone: +372 518 5218
Website: granisten.ee
For data protection matters, contact us at info@granisten.ee. We have not appointed a data protection officer, as the nature of our activity does not require one.
2. What personal data we process
2.1. When you send an enquiry. If you complete the quote request form on our website or contact us by e-mail, phone or WhatsApp, we process: your name, phone number, e-mail address (if you provide it), the type of service selected, your comment and the files attached to the form (a photo of the room, a plan or a drawing).
Please do not attach files showing other people or containing personal data (documents, private correspondence) that are not needed to handle your enquiry.
2.2. When preparing and performing a contract. The site address and access details, contact person’s details, measurements taken on site, drawings and photographs, the content of the order, delivery and installation dates, and correspondence relating to the work.
2.3. For invoicing. The invoice recipient’s name and address, for legal entities the company details and registry code, the invoice amount and payment information. We do not collect or store bank card details.
2.4. In the course of communication. The content of e-mails, WhatsApp messages and correspondence, and the time of contact.
2.5. When you use the website. IP address, device and browser data, approximate location at country or city level, pages visited and actions taken on the site, and the referring website. This data is collected through cookies and similar technologies — see our cookie policy for details.
2.6. Photographs of completed work. Photographs of finished countertops and fireplaces. We publish them in our portfolio, on the website and on social media only where you have given separate consent. Your name and the address of the property are not published with the photographs unless agreed otherwise.
3. Purposes of processing and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry, recommending materials and preparing a quote | Steps taken at your request prior to entering into a contract (GDPR Art. 6(1)(b)) |
| Performance of the contract: measuring, fabrication, delivery, installation, after-sales support | Performance of a contract (GDPR Art. 6(1)(b)) |
| Issuing invoices, accounting and meeting tax obligations | Compliance with a legal obligation (GDPR Art. 6(1)(c)), Accounting Act, Taxation Act |
| Handling complaints and establishing, exercising or defending legal claims | Legitimate interest in protecting our rights (GDPR Art. 6(1)(f)) |
| Website security, fault detection and prevention of automated spam submissions (including the form’s hidden check field) | Legitimate interest in the secure operation of the service (GDPR Art. 6(1)(f)) |
| Website usage statistics and measuring advertising performance (Google Analytics, Google Ads, Meta) | Consent (GDPR Art. 6(1)(a)) — given or withdrawn in the cookie notice |
| Publishing photographs of completed work in our portfolio and on social media | Consent (GDPR Art. 6(1)(a)) |
Providing personal data is not a statutory obligation, but your name, phone number and a photo or plan of the room are necessary for us to prepare a quote. Without them we cannot answer your enquiry in substance.
We do not take decisions about you based solely on automated processing, and we do not carry out profiling that produces legal effects for you.
4. Cookies
We use cookies on our website. Strictly necessary cookies are used on the basis of our legitimate interest, as the site does not work without them. Statistics and marketing cookies are used only with your consent, which you can give, change or withdraw in the cookie notice. The full list, purposes and storage periods are set out in our cookie policy.
5. Who we share data with
We do not sell personal data and do not make it available to third parties for their own marketing purposes. We share data only to the extent necessary to provide our service or to comply with a legal obligation:
Processors acting on our instructions: our hosting and infrastructure provider; the host of our content management system and enquiry database; our e-mail service provider; messaging applications through which enquiry notifications reach our sales team; web analytics and advertising providers; our accounting service provider; transport and installation partners where we involve them in a specific job.
Other recipients: legal advisers and debt recovery agents where necessary to protect a claim; public authorities where disclosure is required by law.
We have a data processing agreement in place with each processor, requiring them to protect the data and to use it only on our instructions.
6. Transfers outside the European Economic Area
Some of the service providers we use may process personal data outside the European Economic Area, primarily in the United States. Where this happens, the transfer takes place under Chapter V of the GDPR: on the basis of a European Commission adequacy decision, or on the basis of standard contractual clauses approved by the European Commission together with additional safeguards.
You may ask us for information about the safeguards applied, using the contact details above.
7. How long we keep data
Enquiries that did not lead to a contract — 12 months from the last contact, so that we can pick up the project again if you come back to us.
Contract-related data and job documentation — 3 years from the end of the contract. Where a longer limitation period applies to claims arising from the work, we keep the data until the end of that period.
Accounting source documents — 7 years from the end of the financial year in which the transaction took place (Accounting Act).
Data processed on the basis of consent (work photographs, marketing messages) — until consent is withdrawn.
Data collected through cookies — in accordance with the periods set out in the cookie policy.
Once the period expires, the data is deleted or anonymised.
8. Your rights
You have the right to: access your data and receive a copy of it; have inaccurate data corrected; request erasure where there is no longer a basis for processing; request restriction of processing; object to processing based on legitimate interest; receive your data in a portable format and have it transmitted to another controller; withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To make a request, write to info@granisten.ee. We respond within one month. Where a request is complex, we may extend this by a further two months and will inform you accordingly.
If you believe we are infringing your rights when processing personal data, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, Tallinn, e-mail info@aki.ee, website aki.ee) or to go to court.
9. Data security
We apply appropriate technical and organisational measures: an encrypted connection (HTTPS), access rights limited to those employees who need the data for their work, password protection, regular software updates and backups. Our employees and partners are required to keep the information they receive confidential.
10. Minors
Our services are intended for adults. We do not knowingly collect personal data from anyone under the age of 16. If we learn that we have received such data without parental consent, we will delete it.
11. Changes to this policy
We may update this privacy policy from time to time, for example when our services or the applicable law change. The current version is always on this page together with the date it was updated. We will announce significant changes prominently on the website.
12. Contact
Questions about the processing of personal data: Granisten OÜ, Peterburi tee 16-56, 11411 Tallinn · info@granisten.ee · +372 518 5218.