Privacy Policy

Last updated: 29 October 2026.

This notice explains how Tacterra handles information when you visit our website or contact us about our work.

Who is responsible

Tacterra is the trading name of Vulpon OÜ, Estonia. Vulpon OÜ is responsible for the personal information described here. For questions or privacy requests, email hello@tacterra.com.

When you contact us

Our contact form asks for your name, email address and message. Company name is optional. We use this information and subsequent correspondence to understand your enquiry, reply and discuss potential work. The required fields are needed to respond through the form. Please avoid including sensitive personal information or confidential information about other people.

Where you ask us to take steps towards a contract with you, our legal basis is Article 6(1)(b) GDPR. For other enquiries, including correspondence on behalf of a business, we rely on our legitimate interest in responding to enquiries and managing prospective client relationships under Article 6(1)(f). Sending a message does not subscribe you to marketing emails.

Messages are delivered to hello@tacterra.com, hosted by Veebimajutus. A copy is forwarded to a Google Gmail inbox used for Tacterra correspondence. The contact form does not create a separate message entry in WordPress in its email-enabled configuration.

Website operation and security

Our hosting and security tools process technical information to deliver the website, prevent abuse and investigate security incidents. This can include IP addresses, browser information, requested pages and access times. The form uses a temporary identifier derived from your IP address to limit repeated submissions. Our legal basis is our legitimate interest in operating a reliable and secure website under Article 6(1)(f) GDPR.

Website statistics

We use Plausible Analytics through Veebimajutus to understand how the website is used and improve it. Statistics include page visits, referral sources, browser and device types, and approximate location. Plausible processes IP address and browser information to calculate daily visitor counts, but does not store raw IP addresses or raw browser user-agent strings. It does not use cookies or persistent device identifiers, and visitor data is processed and stored in the EU. Our legal basis for the limited processing involved is our legitimate interest in understanding and improving the website under Article 6(1)(f) GDPR. See Plausible’s data policy.

Cookies and your choices

We use CookieYes to display cookie choices and keep a record of them. Its necessary cookieyes-consent cookie remembers your choice, including a rejection, for up to 365 days. CookieYes processes consent records and connection details to provide this service. Consent records include a consent identifier, your choices and when you made them. CookieYes’s current Free plan retains consent-log data for up to one year.

WordPress and website security tools also use necessary cookies when authorised users sign in to administer the site or access protected areas. These support authentication, security and saved administration preferences. They are separate from advertising cookies.

The website currently uses cookieless Plausible statistics rather than analytics or advertising cookies. You can reopen the CookieYes controls using the cookie icon on the page and change or withdraw optional consent. This does not affect the lawfulness of processing before withdrawal. Necessary cookies remain active. You can also delete or block cookies in your browser settings; doing so may affect sign-in and saved preferences. Any future optional tracking will need your consent before it runs, and this notice will be updated to describe it.

Who receives information

Access is limited to the people handling Tacterra enquiries and the providers needed to operate the website and correspondence. These include Elkdata OÜ, trading as Veebimajutus, for hosting and email; Google for the forwarded Gmail copy; CookieYes Limited for consent management; Plausible Analytics for website statistics; and website security and backup providers where needed to supply those services. Information may also be disclosed where required by law or necessary to establish, exercise or defend legal claims.

Processing outside the EEA

Some providers operate internationally, so information can be processed outside the European Economic Area, including in the United Kingdom and United States. Google describes its use of adequacy decisions, the EU–US Data Privacy Framework and standard contractual clauses in its data-transfer information. CookieYes’s data processing agreement incorporates standard contractual clauses for restricted transfers; its subprocessor list explains locations and transfer arrangements. Website security providers publish their own transfer information, including Wordfence / Defiant. Contact hello@tacterra.com to request further information about the arrangements relevant to your information.

How long information is kept

We keep enquiry correspondence while it is needed to resolve the enquiry and any related discussion. If a client relationship follows, relevant correspondence may be kept as part of that relationship. We also consider record-keeping obligations and the need to establish, exercise or defend legal claims. Technical and security records are kept according to their operational and security purpose and the relevant service settings. The form’s rate-limit counter expires after ten minutes. Cookie and consent-record periods are described above. Copies can remain in backups until those backups are replaced or expire.

Your rights

Depending on the circumstances, you can ask to access, correct or erase your information, restrict its use or receive a portable copy. You can object to processing based on legitimate interests and withdraw consent where processing relies on it. Email hello@tacterra.com to make a request. We may need to verify your identity. We normally respond within one month; if a permitted extension is needed, we will explain why within that month.

You can complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, or the relevant supervisory authority where you live or work. We do not use the contact form or website statistics to make decisions with legal or similarly significant effects based solely on automated processing.

Changes to this notice

We will update this page when the website or the way we handle information changes. The date at the top identifies the latest revision.