Privacy Policy
Effective Date: January 1, 2026. Last Updated: February 2026.
1. Introduction and Data Controller Overview
This Privacy Policy governs the processing of personal data collected via happybundleloopster.forum (the "Platform"). The data controller responsible for your personal information is:
Nordic Hearth & Timberworks Ltd.
Company Registration No. 12948210
44 Birchwood Way, Pärnu & Tartu Timber Quarter, Tallinn, EE-10115, Estonia
Official Privacy Contact: [email protected]
2. Personal Information We Collect
We only collect information strictly necessary to fulfill your architectural blueprint requests, process guild communications, and maintain platform security:
- Voluntarily Provided Data: Name, professional entity, email address, physical construction site coordinates, and custom sauna engineering specifications submitted via our contact or consultation forms.
- Automated Device & Technical Data: IP address (anonymized), browser user-agent, operating system, referrer URL, pages visited, and timestamp logs used for cyber defense and traffic load balancing.
- Cookie Data: Session tokens and consent preferences stored locally in your browser (detailed in our Cookie Policy).
3. Lawful Basis and Purpose of Processing (GDPR Art. 6)
We process your data under the following legal frameworks pursuant to the EU General Data Protection Regulation (Regulation (EU) 2016/679):
- Performance of Contract (Art. 6(1)(b)): To prepare, deliver, and license architectural blueprints, CNC cutlists, and stove dimension specifications requested by you.
- Legitimate Interests (Art. 6(1)(f)): To safeguard our web infrastructure against distributed denial-of-service (DDoS) attacks and optimize content delivery performance.
- Explicit Consent (Art. 6(1)(a)): For non-essential analytics and persistent preferences managed via our consent engine.
4. Data Retention Periods
We retain technical server log files for a maximum of 90 days, after which they are securely purged. Blueprint consultation inquiries and customer correspondence are retained for 5 years to honor warranty, structural liability, and architectural support requirements under Estonian commercial law.
5. Your Statutory Data Protection Rights
Under GDPR and international privacy statutes, you hold enforceable rights regarding your personal data:
- Right to Access: Request a complete copy of all personal records held in our registries.
- Right to Rectification: Request correction of inaccurate architectural or contact records.
- Right to Erasure ("Right to Be Forgotten"): Request immediate permanent deletion of your personal records where legal retention obligations no longer apply.
- Right to Restrict Processing: Limit how we process your information during active disputes.
- Right to Data Portability: Obtain your data in a structured, machine-readable JSON or CSV format.
To exercise any of these rights, email our Data Officer at [email protected].
6. Third-Party Disclosures & International Transfers
We do not sell, rent, monetize, or trade your personal data with third-party advertising brokers. Data is only processed through certified EU-based cloud hosting providers bound by strict Data Processing Agreements (DPAs) compliant with Standard Contractual Clauses (SCCs).