Last updated:
1. Introduction and Data Controller Details
Tactical Technologies OÜ (“we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy informs you how we collect, store, handle, and protect personal data when you visit our website at www.tacticaltechnologiesou.com, interact with our services, or communicate with us.
Under data protection laws, including the General Data Protection Regulation (EU) 2016/679 we operate as the Data Controller responsible for your personal data.
Contact Details
Tactical Technologies OÜ
Narva Highway 5-78, Harju County, Tallinn, Estonia
Email: contact@tacticaltechnologiesou.com
Telephone: +438-388-9701
Registration Number: 16633954
2. The Personal Data We Collect
Personal data refers to any information about an identified or identifiable individual. Depending on how you interact with us, we may collect, use, and store different kinds of personal data:
- Identity & Contact Data: First name, last name, business email address, job title, company name, telephone number, and postal address when you submit enquiries, request proposals, or book consultations.
- Technical Data: Internet Protocol (IP) address, browser type and version, time zone setting and location, operating system, platform, device identifiers, and technical information about the device you use to access our website.
- Usage Data: Information about how you navigate and interact with our website, pages viewed, links clicked, session lengths, and referrers.
- Communication Data: Information contained in correspondence sent to us (such as enquiry notes, feedback, support requests, and survey responses).
- Marketing & Preferences Data: Your preferences in receiving marketing material from us and your communication preferences.
Note: We do not intentionally collect special category personal data (e.g., health, racial or ethnic origin, religious beliefs) or data relating to criminal convictions through this website.
3. How We Collect Your Personal Data
We use different methods to collect data from and about you:
- Direct Interactions: You provide your identity, contact, and communication details directly by filling in contact forms on our website, subscribing to publications, corresponding with us via email, phone, or post, or requesting business information.
- Automated Technologies or Interactions: As you interact with our website, we automatically collect technical and usage data using cookies, server logs, and similar technologies. (For full details, please refer to our Cookie Policy).
- Third Parties or Publicly Available Sources: We may receive technical data from analytics providers, hosting providers, or professional networking platforms (such as LinkedIn) in line with applicable privacy rules.
4. Lawful Bases and Purposes for Processing Personal Data
Under GDPR, we must have a valid lawful basis to process personal data. The table below sets out our purposes and corresponding lawful grounds:
| Purpose / Processing Activity | Type of Data | Lawful Basis for Processing |
|---|---|---|
| Responding to enquiries and consultations: Answering questions, assessing service fit, or providing information about our vendor management services. | Identity, Contact, Communication | Legitimate Interests (to communicate with potential clients and manage business development) or Contractual Necessity (taking steps prior to entering into a contract). |
| Delivering services and contractual performance: Managing vendor consultancy, systems guidance, or performance tracking agreements. | Identity, Contact, Financial/Billing (if applicable) | Contractual Necessity (performance of a contract to which you or your organisation is party). |
| Website administration, security, and troubleshooting: Ensuring system stability, investigating security breaches, and preventing fraud. | Technical, Usage | Legitimate Interests (ensuring website security, proper administration, and uninterrupted service) and Legal Obligation. |
| Website analytics and user experience improvement: Analysing how visitors use our site to optimise layout and content. | Technical, Usage | Consent (where required for non-essential tracking cookies) or Legitimate Interests (evaluating performance). |
| Direct B2B marketing: Sending updates, newsletters, or business communications regarding vendor management trends and services. | Identity, Contact, Marketing Preferences | Legitimate Interests (B2B commercial outreach, subject to opt-out rights) or Consent (where mandated by local direct marketing rules). |
| Compliance with legal and regulatory obligations: Maintaining corporate records, accounting, or cooperating with authorities. | Identity, Contact, Transactional | Legal Obligation. |
5. Sharing and Disclosing Personal Data
We do not sell, rent, or trade your personal data. We may share personal data with selected third parties solely for the purposes set out in Section 4:
- Service Providers and Subcontractors: Third-party vendors providing IT hosting, cloud infrastructure, email delivery, customer relationship management (CRM), and website analytics.
- Professional Advisers: Legal counsel, accountants, insurers, and auditors who provide consultancy, financial, or legal services.
- Public Authorities and Regulators: Law enforcement bodies, courts, or regulators when we are legally required to do so.
- Corporate Transactions: Third parties to whom we may choose to sell, transfer, or merge parts of our business or assets.
All third-party processors act under written contractual terms requiring them to maintain strict confidentiality and apply appropriate technical and organisational security measures in compliance with GDPR.
6. International Data Transfers
When personal data is transferred outside the European Economic Area (EEA) or the United Kingdom, we ensure that an equivalent level of data protection is applied by implementing appropriate safeguards, including:
- Transferring data to countries deemed by the European Commission or UK Information Commissioner to provide an adequate level of protection.
- Executing approved Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) / Addendum with the recipient organisation.
- Verifying valid international certification mechanisms (such as the EU-U.S. Data Privacy Framework or UK Extension, where applicable).
You may contact us for details regarding the specific transfer safeguards applied to your personal data.
7. Data Security
We have implemented technical, physical, and organisational security measures designed to prevent personal data from being accidentally lost, used, altered, disclosed, or accessed in an unauthorised manner. Access to personal data is restricted to employees, contractors, and agents who have a specific business need to know and are bound by confidentiality obligations.
We also maintain established procedures to address any suspected personal data breach and will notify you and relevant supervisory authorities when legally required to do so.
8. Data Retention Periods
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, reporting, or regulatory requirements.
When personal data is no longer needed, it is either securely deleted or irreversibly anonymised.
9. Your Legal Rights Under GDPR
Under European data protection law, you have specific rights regarding your personal data:
- Right of Access (Article 15): Request a copy of the personal data we hold about you and check that we are lawfully processing it.
- Right to Rectification (Article 16): Request correction of inaccurate or incomplete personal data.
- Right to Erasure / “Right to be Forgotten” (Article 17): Request the deletion of personal data where there is no legal reason for us to continue processing it.
- Right to Restriction of Processing (Article 18): Request that we suspend processing your data in certain circumstances (e.g., while verifying accuracy).
- Right to Data Portability (Article 20): Request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format.
- Right to Object (Article 21): Object to processing based on our legitimate interests or direct marketing at any time.
- Right to Withdraw Consent: Where we rely on your consent to process personal data, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
Exercising Your Rights
You do not have to pay a fee to access your personal data or exercise these rights. However, we may charge a reasonable fee or refuse to comply if a request is manifestly unfounded, repetitive, or excessive.
To exercise any of these rights, please contact us.
10. Cookies and Tracking Technologies
Our website uses cookies and similar tracking tools to distinguish you from other users, monitor website performance, and enhance navigation. Non-essential cookies (such as performance or analytics cookies) are only deployed with your prior consent. You can manage your preferences or withdraw consent at any time via our cookie management banner or by consulting our Cookie Policy.
11. Complaints and Supervisory Authority
If you have concerns about how we handle your personal data, we encourage you to contact us first so we can seek to resolve the matter directly.
You also have the right to lodge a complaint with an applicable data protection supervisory authority:
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): www.aki.ee
12. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in legal requirements, operational practices, or technology. Any revised version will be posted on this page with an updated revision date.