Privacy Policy

Changes to this page

Every change to this page since it was first published, drawn from the history of the file it is built from. Open a change to read exactly which lines moved.

1. 22 August 2026+1 −2 lines, commit 5ddb1e4

   A privacy policy you can diff: every legal page lists each change to its text with the date, the summary and the diff, drawn from the file's git history before each build; the hand kept updated date is gone and the sitemap takes the real one

   @@ -2,5 +2,4 @@
    title: "Privacy Policy"
    description: "How EkoHacks collects, uses, and protects your information"
   -updated: "2026-08-23"
    ---
    
   @@ -136,5 +135,5 @@ Our services are not directed at individuals under the age of 16. We do not know
    ## 11. Changes to This Policy
    
   -We may update this privacy policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
   +We may update this privacy policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. Every change is listed at the bottom of this page, with the date and the exact text that changed, drawn from the history of the file this page is built from. We encourage you to review it periodically.
    
    ## 12. Contact Us
   

2. 22 August 2026+49 −3 lines, commit 425efbc

   What we count, and what we refuse to know: a data inventory in the privacy policy listing every system that holds anything about a visitor, seat bookings through the dojo and Paddle described, the registration form that no longer existed removed from the policy and the code, the newsletter held in one system instead of two, and three counted events that carry nothing about anyone

   @@ -2,5 +2,5 @@
    title: "Privacy Policy"
    description: "How EkoHacks collects, uses, and protects your information"
   -updated: "2026-08-22"
   +updated: "2026-08-23"
    ---
    
   @@ -9,8 +9,8 @@ updated: "2026-08-22"
    EKOHACKS OÜ ("we", "us", "our") is a technology company registered in Estonia.
    
   -- **Registered name: **EKOHACKS OÜ
   -- **Registration number: **17182181
   -- **Registered address: **Järvevana tee 9, 11314 Tallinn, Estonia
   -- **Contact email: **connect@ekohacks.com
   +- **Registered name:** EKOHACKS OÜ
   +- **Registration number:** 17182181
   +- **Registered address:** Järvevana tee 9, 11314 Tallinn, Estonia
   +- **Contact email:** connect@ekohacks.com
    
    We are the data controller responsible for your personal data as described in this policy.
   @@ -28,7 +28,9 @@ When you submit our contact form, we collect your name, your email address, and
    When you subscribe to our newsletter, we collect your email address and, optionally, your name.
    
   -### Workshop Registration
   +### Seat Bookings
    
   -When you register for a workshop, we collect your first name, last name, email address, phone number (optional), experience level, and any additional message you choose to include (optional).
   +When you book a seat on a course or a dojo, the booking page is on our dojo at dojo.ekohacks.com and the checkout is provided by Paddle.com Market Ltd, acting as merchant of record. Paddle collects your name, email address, billing country and postcode, and your payment details; we never see your card number. We receive your name, email address, what you bought, and the transaction reference, so that we can give you your place and help you if something goes wrong.
   +
   +Until August 2026 this website had a workshop registration form. It is gone; registrations received through it are covered by the retention period in section 8.
    
    ## 3. Anonymised Usage Data
   @@ -38,4 +40,6 @@ When you register for a workshop, we collect your first name, last name, email a
    Since August 2026 this website counts page views with Plausible Analytics, a service operated by Plausible Insights OÜ in Estonia and hosted in the European Union. It sets no cookies and stores nothing on your device. For each page view it records the page address, the site you arrived from, the browser and operating system family, the device type, and the country, which it derives from your IP address and then discards; the IP address is never stored. To count visits within a day it uses a salted hash that cannot be reversed and is deleted every twenty four hours, so we cannot recognise you from one day to the next. We use the resulting aggregate figures to see which pages are read and where readers come from, and for nothing else.
    
   +Besides page views we count three things happening: a newsletter signup, a contact message being sent, and a seat booking being opened. Each is a count and nothing more. The count does not carry your email address, your message, the seat you chose, or anything else that could be joined to you.
   +
    We process this data on the basis of our legitimate interest (Article 6(1)(f)) in understanding how this website is used, in a form that cannot identify anyone. Plausible publishes its own data policy at plausible.io/data-policy.
    
   @@ -50,7 +54,7 @@ As anonymised data falls outside the scope of personal data under GDPR (Recital
    We use the data we collect for the following purposes:
    
   -- **Contact form submissions: **To respond to your enquiry and communicate with you about the subject of your message.
   -- **Newsletter subscriptions: **To send you our email newsletter containing updates, insights, and information about our services and workshops.
   -- **Workshop registrations: **To process your registration, confirm your place, send you workshop details, and communicate with you about the event.
   +- **Contact form submissions:** To respond to your enquiry and communicate with you about the subject of your message.
   +- **Newsletter subscriptions:** To send you our email newsletter containing updates, insights, and information about our services and workshops.
   +- **Seat bookings:** To give you your place on the course or dojo you booked, send you its details, and communicate with you about it.
    
    We do not sell, rent, or share your personal data with third parties for their marketing purposes.
   @@ -60,6 +64,8 @@ We do not sell, rent, or share your personal data with third parties for their m
    Under the General Data Protection Regulation (EU Regulation 2016/679), we process your personal data on the following legal bases:
    
   -- **Consent (Article 6(1)(a)): **When you subscribe to our newsletter, you give us your explicit consent to send you marketing communications. You may withdraw this consent at any time.
   -- **Legitimate interest (Article 6(1)(f)): **When you submit a contact form or register for a workshop, we process your data based on our legitimate interest in responding to your enquiry and providing you with the service you requested. We have assessed that this processing does not override your rights and freedoms.
   +- **Consent (Article 6(1)(a)):** When you subscribe to our newsletter, you give us your explicit consent to send you marketing communications. You may withdraw this consent at any time.
   +- **Contract (Article 6(1)(b)):** When you book a seat, we process your name, email address and order so that we can deliver what you bought.
   +- **Legal obligation (Article 6(1)(c)):** Records of purchases are kept for as long as accounting law requires.
   +- **Legitimate interest (Article 6(1)(f)):** When you submit a contact form, we process your data based on our legitimate interest in responding to your enquiry. Page view counting rests on the same basis, as described in section 3. We have assessed that this processing does not override your rights and freedoms.
    
    ## 6. Third Party Data Processors
   @@ -67,7 +73,8 @@ Under the General Data Protection Regulation (EU Regulation 2016/679), we proces
    We use the following third party service providers who process data on our behalf:
    
   -- **Loops.so: **Email marketing platform used to deliver our newsletter. Loops processes your email address and name (if provided) for newsletter delivery.
   -- **Netlify: **Web hosting and form processing platform. Contact and workshop registration submissions are submitted to and stored in Netlify Forms.
   -- **Plausible Insights OÜ: **Website analytics, hosted in the European Union. Processes the page view data described in section 3 and nothing else.
   +- **Loops.so:** Email marketing platform used to deliver our newsletter. Loops processes your email address and name (if provided) for newsletter delivery.
   +- **Netlify:** Web hosting and form processing platform. Contact form submissions are submitted to and stored in Netlify Forms.
   +- **Paddle.com Market Ltd:** Merchant of record for seat bookings. Paddle processes the payment and holds the billing details under its own privacy policy; we receive your name, email address and order.
   +- **Plausible Insights OÜ:** Website analytics, hosted in the European Union. Processes the page view data described in section 3 and nothing else.
    
    All processors are bound by data processing agreements and are required to handle your data in accordance with GDPR requirements.
   @@ -81,8 +88,24 @@ Some of our third party processors operate outside the European Economic Area (E
    We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:
    
   -- **Contact form submissions: **Retained for up to 12 months after our last communication with you, then deleted.
   -- **Newsletter subscriptions: **Retained until you unsubscribe. Upon unsubscription, your data is deleted within 30 days.
   -- **Workshop registrations: **Retained for up to 24 months after the workshop date for follow up communications and record keeping, then deleted.
   -- **Website analytics: **The daily hash used to count visits is deleted within twenty four hours. The aggregate figures, which contain no personal data, are kept.
   +- **Contact form submissions:** Retained for up to 12 months after our last communication with you, then deleted.
   +- **Newsletter subscriptions:** Retained until you unsubscribe. Upon unsubscription, your data is deleted within 30 days.
   +- **Seat bookings:** Your name, email address and order are kept for as long as Estonian accounting law requires purchase records to be kept, which is seven years.
   +- **Workshop registrations received before August 2026:** Retained for up to 24 months after the workshop date, then deleted.
   +- **Website analytics:** The daily hash used to count visits is deleted within twenty four hours. The aggregate figures, which contain no personal data, are kept.
   +
   +## 8a. Data Inventory
   +
   +Everything this website holds about a visitor, in one table. Each row is a system we use, what it holds, where it runs, why we hold it, and for how long. If a system is not in this table, it does not hold anything about you.
   +
   +| What | Held by | Where | Why | For how long |
   +| --- | --- | --- | --- | --- |
   +| Contact messages (name, email address, message) | Netlify Forms | United States | To reply to you | Up to 12 months after our last message |
   +| Newsletter subscriptions (email address, name if given) | Loops | United States | To send the newsletter you asked for | Until you unsubscribe, then deleted within 30 days |
   +| Seat bookings (name, email address, order, transaction reference) | Paddle, and our Paddle account | United Kingdom | To deliver what you bought, and because accounting law requires it | Seven years |
   +| Page views (page, referrer, browser and system family, device type, country) | Plausible | European Union | To see which pages are read and from where | Daily hash deleted within 24 hours; totals kept |
   +| Counts of newsletter signups, contact messages sent, and seat bookings opened | Plausible | European Union | To see whether the site's forms are used | Totals kept; nothing about you in them |
   +| Email you send us directly | Proton Mail | Switzerland | To reply to you | Until the conversation is over and the mailbox is tidied |
   +
   +Nothing else. No cookies, no advertising identifiers, no session recordings, no data brokers.
    
    ## 9. Your Rights Under GDPR
   @@ -90,11 +113,11 @@ We retain your personal data only for as long as necessary to fulfil the purpose
    As a data subject under GDPR, you have the following rights:
    
   -- **Right of access: **You can request a copy of the personal data we hold about you.
   -- **Right to rectification: **You can ask us to correct any inaccurate or incomplete data.
   -- **Right to erasure: **You can ask us to delete your personal data where there is no compelling reason for us to continue processing it.
   -- **Right to restrict processing: **You can ask us to suspend the processing of your personal data in certain circumstances.
   -- **Right to data portability: **You can request that we transfer your data to another organisation or directly to you, in a structured, commonly used, and machine readable format.
   -- **Right to object: **You can object to our processing of your personal data where we are relying on legitimate interest as our legal basis.
   -- **Right to withdraw consent: **Where we rely on your consent to process data (such as for the newsletter), you can withdraw that consent at any time. This does not affect the lawfulness of processing carried out before the withdrawal.
   +- **Right of access:** You can request a copy of the personal data we hold about you.
   +- **Right to rectification:** You can ask us to correct any inaccurate or incomplete data.
   +- **Right to erasure:** You can ask us to delete your personal data where there is no compelling reason for us to continue processing it.
   +- **Right to restrict processing:** You can ask us to suspend the processing of your personal data in certain circumstances.
   +- **Right to data portability:** You can request that we transfer your data to another organisation or directly to you, in a structured, commonly used, and machine readable format.
   +- **Right to object:** You can object to our processing of your personal data where we are relying on legitimate interest as our legal basis.
   +- **Right to withdraw consent:** Where we rely on your consent to process data (such as for the newsletter), you can withdraw that consent at any time. This does not affect the lawfulness of processing carried out before the withdrawal.
    
    To exercise any of these rights, please contact us at connect@ekohacks.com. We will respond to your request within 30 days.
   

3. 22 August 2026+12 −2 lines, commit 4c248b1

   We promised not to watch, then we needed to see: Plausible page view counting on the production host only, and the privacy policy that says so, in one commit

   @@ -2,5 +2,5 @@
    title: "Privacy Policy"
    description: "How EkoHacks collects, uses, and protects your information"
   -updated: "2026-06-06"
   +updated: "2026-08-22"
    ---
    
   @@ -18,5 +18,5 @@ We are the data controller responsible for your personal data as described in th
    ## 2. What Data We Collect
    
   -We only collect personal data that you voluntarily provide to us through our website forms. We do not use cookies, analytics tools, tracking pixels, or any automated data collection technologies.
   +We collect personal data only when you provide it to us through our website forms. We do not use cookies or tracking pixels. We count page views with one privacy preserving analytics service that sets no cookies and cannot identify you, described in section 3.
    
    ### Contact Form
   @@ -34,4 +34,12 @@ When you register for a workshop, we collect your first name, last name, email a
    ## 3. Anonymised Usage Data
    
   +### Website analytics
   +
   +Since August 2026 this website counts page views with Plausible Analytics, a service operated by Plausible Insights OÜ in Estonia and hosted in the European Union. It sets no cookies and stores nothing on your device. For each page view it records the page address, the site you arrived from, the browser and operating system family, the device type, and the country, which it derives from your IP address and then discards; the IP address is never stored. To count visits within a day it uses a salted hash that cannot be reversed and is deleted every twenty four hours, so we cannot recognise you from one day to the next. We use the resulting aggregate figures to see which pages are read and where readers come from, and for nothing else.
   +
   +We process this data on the basis of our legitimate interest (Article 6(1)(f)) in understanding how this website is used, in a form that cannot identify anyone. Plausible publishes its own data policy at plausible.io/data-policy.
   +
   +### Engineering metrics in our services
   +
    In certain services, we may collect anonymised, aggregated data related to software development activity, such as commit frequency, build performance, and defect metrics. This data is fully anonymised and cannot be used to identify any individual.
    
   @@ -61,4 +69,5 @@ We use the following third party service providers who process data on our behal
    - **Loops.so: **Email marketing platform used to deliver our newsletter. Loops processes your email address and name (if provided) for newsletter delivery.
    - **Netlify: **Web hosting and form processing platform. Contact and workshop registration submissions are submitted to and stored in Netlify Forms.
   +- **Plausible Insights OÜ: **Website analytics, hosted in the European Union. Processes the page view data described in section 3 and nothing else.
    
    All processors are bound by data processing agreements and are required to handle your data in accordance with GDPR requirements.
   @@ -75,4 +84,5 @@ We retain your personal data only for as long as necessary to fulfil the purpose
    - **Newsletter subscriptions: **Retained until you unsubscribe. Upon unsubscription, your data is deleted within 30 days.
    - **Workshop registrations: **Retained for up to 24 months after the workshop date for follow up communications and record keeping, then deleted.
   +- **Website analytics: **The daily hash used to count visits is deleted within twenty four hours. The aggregate figures, which contain no personal data, are kept.
    
    ## 9. Your Rights Under GDPR
   

4. 6 June 2026+115 −0 lines, commit ab2bb97

   Migrate legal pages off Sanity to @nuxt/content

   @@ -0,0 +1,115 @@
   +---
   +title: "Privacy Policy"
   +description: "How EkoHacks collects, uses, and protects your information"
   +updated: "2026-06-06"
   +---
   +
   +## 1. Who We Are
   +
   +EKOHACKS OÜ ("we", "us", "our") is a technology company registered in Estonia.
   +
   +- **Registered name: **EKOHACKS OÜ
   +- **Registration number: **17182181
   +- **Registered address: **Järvevana tee 9, 11314 Tallinn, Estonia
   +- **Contact email: **connect@ekohacks.com
   +
   +We are the data controller responsible for your personal data as described in this policy.
   +
   +## 2. What Data We Collect
   +
   +We only collect personal data that you voluntarily provide to us through our website forms. We do not use cookies, analytics tools, tracking pixels, or any automated data collection technologies.
   +
   +### Contact Form
   +
   +When you submit our contact form, we collect your name, your email address, and your message.
   +
   +### Newsletter Signup
   +
   +When you subscribe to our newsletter, we collect your email address and, optionally, your name.
   +
   +### Workshop Registration
   +
   +When you register for a workshop, we collect your first name, last name, email address, phone number (optional), experience level, and any additional message you choose to include (optional).
   +
   +## 3. Anonymised Usage Data
   +
   +In certain services, we may collect anonymised, aggregated data related to software development activity, such as commit frequency, build performance, and defect metrics. This data is fully anonymised and cannot be used to identify any individual.
   +
   +As anonymised data falls outside the scope of personal data under GDPR (Recital 26), it is not subject to the data protection rights described in this policy. We use this data solely to improve our services and provide insights to our clients.
   +
   +## 4. How We Use Your Data
   +
   +We use the data we collect for the following purposes:
   +
   +- **Contact form submissions: **To respond to your enquiry and communicate with you about the subject of your message.
   +- **Newsletter subscriptions: **To send you our email newsletter containing updates, insights, and information about our services and workshops.
   +- **Workshop registrations: **To process your registration, confirm your place, send you workshop details, and communicate with you about the event.
   +
   +We do not sell, rent, or share your personal data with third parties for their marketing purposes.
   +
   +## 5. Legal Basis for Processing
   +
   +Under the General Data Protection Regulation (EU Regulation 2016/679), we process your personal data on the following legal bases:
   +
   +- **Consent (Article 6(1)(a)): **When you subscribe to our newsletter, you give us your explicit consent to send you marketing communications. You may withdraw this consent at any time.
   +- **Legitimate interest (Article 6(1)(f)): **When you submit a contact form or register for a workshop, we process your data based on our legitimate interest in responding to your enquiry and providing you with the service you requested. We have assessed that this processing does not override your rights and freedoms.
   +
   +## 6. Third Party Data Processors
   +
   +We use the following third party service providers who process data on our behalf:
   +
   +- **Loops.so: **Email marketing platform used to deliver our newsletter. Loops processes your email address and name (if provided) for newsletter delivery.
   +- **Netlify: **Web hosting and form processing platform. Contact and workshop registration submissions are submitted to and stored in Netlify Forms.
   +
   +All processors are bound by data processing agreements and are required to handle your data in accordance with GDPR requirements.
   +
   +## 7. International Data Transfers
   +
   +Some of our third party processors operate outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or the processor's participation in recognised data protection frameworks.
   +
   +## 8. Data Retention
   +
   +We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:
   +
   +- **Contact form submissions: **Retained for up to 12 months after our last communication with you, then deleted.
   +- **Newsletter subscriptions: **Retained until you unsubscribe. Upon unsubscription, your data is deleted within 30 days.
   +- **Workshop registrations: **Retained for up to 24 months after the workshop date for follow up communications and record keeping, then deleted.
   +
   +## 9. Your Rights Under GDPR
   +
   +As a data subject under GDPR, you have the following rights:
   +
   +- **Right of access: **You can request a copy of the personal data we hold about you.
   +- **Right to rectification: **You can ask us to correct any inaccurate or incomplete data.
   +- **Right to erasure: **You can ask us to delete your personal data where there is no compelling reason for us to continue processing it.
   +- **Right to restrict processing: **You can ask us to suspend the processing of your personal data in certain circumstances.
   +- **Right to data portability: **You can request that we transfer your data to another organisation or directly to you, in a structured, commonly used, and machine readable format.
   +- **Right to object: **You can object to our processing of your personal data where we are relying on legitimate interest as our legal basis.
   +- **Right to withdraw consent: **Where we rely on your consent to process data (such as for the newsletter), you can withdraw that consent at any time. This does not affect the lawfulness of processing carried out before the withdrawal.
   +
   +To exercise any of these rights, please contact us at connect@ekohacks.com. We will respond to your request within 30 days.
   +
   +If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon):
   +
   +- **Andmekaitse Inspektsioon**
   +- Tatari 39, 10134 Tallinn, Estonia
   +- Website: www.aki.ee
   +- Email: info@aki.ee
   +
   +## 10. Children's Privacy
   +
   +Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child under 16, please contact us immediately at connect@ekohacks.com and we will take steps to delete that information.
   +
   +## 11. Changes to This Policy
   +
   +We may update this privacy policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
   +
   +## 12. Contact Us
   +
   +If you have any questions about this privacy policy or how we handle your personal data, please contact us:
   +
   +**EKOHACKS OÜ**
   +
   +Järvevana tee 9, 11314 Tallinn, Estonia
   +
   +Email: connect@ekohacks.com