Last updated: 19 September 2026
This Privacy Policy explains how Baltivora Trade OÜ (“Baltivora”, “we”, “us”) processes personal data of visitors to the website baltivora.ee. It applies only to the website; separate arrangements govern the personal data processed in the context of established commercial relationships with our customers and suppliers.
1. Data Controller
Baltivora Trade OÜ
Narva mnt 13-27, 10151 Tallinn, Harju maakond, Estonia
Registry code: 17488371
Email for privacy matters: privacy@baltivora.ee
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR. For any privacy-related enquiry please write to the address above.
2. What personal data we process, and why
We collect the minimum amount of personal data needed to operate the website and to reply to enquiries. In detail:
2.1 Server access logs
Our web server automatically records technical information about each request: IP address, date and time, requested URL, HTTP response code, referring page and user-agent string. These logs are used to keep the site secure, diagnose problems and defend against abuse.
- Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in the security and correct operation of the service.
- Retention: 24 months.
2.2 Website analytics
We use Matomo Analytics to understand how the site is used in aggregate (pages viewed, referrers, approximate geographic region). Our Matomo installation is:
- self-hosted on infrastructure managed by our web agency Supero Ltd (Malta);
- configured not to use cookies or any other client-side identifier;
- configured to anonymise IP addresses before they are stored.
Because no persistent identifier is stored on your device and IP addresses are truncated at collection, no prior consent is required for this processing under the guidance of the CNIL and other EU supervisory authorities. For the same reason no cookie banner is shown on this website (see section 5).
- Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in measuring and improving the service.
- Retention: aggregated statistics may be kept indefinitely; individual visit records are kept for 13 months.
2.3 Contact form
When you send us a message through the Contact form, we collect the details you provide (such as name, company, email address, country, phone number if given, subject and message) together with your explicit consent to this Privacy Policy. We use these data solely to reply to your enquiry.
We do not add you to any newsletter or marketing list, and we do not use your details to send unsolicited commercial communications. If our exchange leads to a business relationship (customer or supplier), any further processing will take place on a different legal basis (contract or legal obligation) and, where required, will be documented separately.
- Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time by writing to privacy@baltivora.ee.
- Retention: up to 24 months from your last contact with us, after which the data are deleted.
- Spam protection: to prevent automated abuse we use Cloudflare Turnstile, a cookieless anti-bot mechanism. When you submit the form, your IP address and limited technical information about your browser are shared with Cloudflare, Inc. (United States) for this sole purpose. See Cloudflare’s privacy notice at cloudflare.com/privacypolicy/.
3. Who else has access to your data (processors)
We only share data with the third parties strictly required to run the service:
| Processor | Role | Location |
|---|---|---|
| Supero Ltd | Web hosting, server management, Matomo hosting | European Union |
| Cloudflare, Inc. | Spam protection on the Contact form (Turnstile) | United States |
Supero Ltd operates entirely within the European Union. Cloudflare processes only the limited data needed to challenge automated submissions on the Contact form, under Standard Contractual Clauses approved by the European Commission for transfers to third countries.
We do not sell, rent or otherwise transfer your personal data to any other third party.
4. Where your data is stored
All primary infrastructure and backups are located within the European Union. The only processing that takes place outside the EU is the Turnstile challenge described in section 2.3.
5. Cookies
The website uses only strictly necessary technical cookies (WordPress session cookies for logged-in editors of the site). No profiling, advertising or third-party tracking cookies are set, and our analytics tool (Matomo) does not use cookies either. For this reason no cookie consent banner is displayed, consistently with Article 5(3) of the ePrivacy Directive and the guidance of EU supervisory authorities.
6. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- ask for their rectification (Art. 16) or erasure (Art. 17);
- ask for restriction of the processing (Art. 18) or object to it (Art. 21);
- receive your data in a portable format (Art. 20);
- withdraw a consent you have given at any time, without affecting the lawfulness of prior processing (Art. 7(3)).
To exercise any of these rights please write to privacy@baltivora.ee. We will reply within 30 days.
7. Complaints
If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee.
8. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. Any substantial change will be announced on the homepage.