01Who processes the data
WebAdmin OÜ is the controller of your data. This means we decide why and how the data is used, and we answer for it.
- Company
- WebAdmin OÜ
- Registry code
- 14698205
- Address
- Hauka 13, 11315 Tallinn, Estonia
- info@webadmin.ee
- Phone
- +372 510 4603
This policy covers the webadmin.ee site and our services: websites and online shops, website maintenance, design, marketing and the free audits. Husly is our own platform. Husly accounts are covered by the Husly privacy policy.
While we build and maintain it, we may also see data about your site's visitors, such as form answers. We process it on your behalf and on your instructions. We agree the terms for this separately.
02What we collect and why
We collect data in seven situations. Each one says what the data is, why we need it, on what legal ground and how long we keep it. The grounds come from Article 6(1) of the General Data Protection Regulation (GDPR).
When you view the site
- Data
- Your IP address, browser and device, the page you opened and the time, the page you came from and any campaign tags in the link (utm).
- Why
- To keep the site working and protected from attacks, to find broken links and to know how much is read and what.
- Ground
- Legitimate interest (point f).
- How long
- The web server log 14 days. Daily visit summaries about 2 years, and they hold no personal data.
How we count visits. Our counter uses no cookies and stores nothing on your device. The server turns your IP address and browser details into a hash, a code from which the address cannot be recovered. The key of the hash changes every day, so we can count visitors today, but tomorrow we no longer recognise you. The day's working copy is deleted after 2 days. Only summaries stay: how many views, which pages, from which country and on which device. We find the country from the IP address on our own server, without an outside service.
When you open an address that does not exist. Then we note the IP address, the country and the city, the browser and the page you came from. This helps us find broken links and bots. For each missing address we keep the last 500 visits.
We also measure the site's speed: how fast it loads and responds to a tap. Nothing in these numbers identifies you.
When you write to us with a form
This covers the contact form and the quote request form.
- Data
- Your name, email and message. If you add them, also your phone and company. The choices you made in the form, such as the service, the budget and the deadline. Also where you came to the site from (for example Google or directly), which page you started on, the device type, the country and how many pages you viewed before writing.
- Why
- To answer you and make an offer. From the origin we see which channels bring us enquiries.
- Ground
- Taking steps at your request before a contract (point b). For the origin data, legitimate interest (point f).
- How long
- If no contract follows, 2 years from the last contact. If one does, we keep them like client data.
Your message is saved in our system, a copy comes to our mailbox and the enquiry creates a record in our client records, so that no message goes unanswered. Only the fields we need to answer you are required. Without them we cannot answer.
Against bots. We check invisibly whether a person filled in the form, and we also use Cloudflare Turnstile. By IP address we limit how many messages one address can send in a short time. A suspicious message goes to a separate spam folder. We can move a real message back from there, and the rest is deleted after 30 days.
An unfinished message. While you write, the text stays in your browser for 7 days, so it is not lost if the page closes by accident. It reaches us only when you press the send button.
When you email us or we talk on the phone
- Data
- Your name, email address or phone number, the content of the message and any attachments. For a call, the number, the time and the length.
- Why
- To communicate and do what you ask.
- Ground
- A contract or steps at your request before one (point b). Otherwise legitimate interest (point f).
- How long
- Like form messages: 2 years from the last contact, or for a client, by the contract.
Our mailbox info@webadmin.ee is on a Zone.eu server in Estonia. When writing a reply, a member of our staff may have artificial intelligence (Anthropic Claude) draft it. Then the text of the message is sent to Anthropic. A person always reads the reply through and sends it.
If we call you from our client records system, the call may be recorded and turned into text. You hear about this at the start of the call. There is a separate phone call privacy notice for this, which always shows the current setup.
When you run a free audit
The site has three free audits: the compliance audit, the search engine audit and the agent readiness audit.
- Data
- The address of the site you check, your IP address and the page you came to the audit from. To see all the findings, we also ask for your email address, your name if you wish, and your permission for us to write to you.
- Why
- To run the check and limit too frequent use. By giving your email address you get all the findings, and we may contact you if it looks like we can help.
- Ground
- The check is your request (point b). Writing to you is based on your consent (point a), which you can withdraw at any time.
- How long
- 2 years from the last contact.
Your email address creates a record in our client records. We do not add you to a newsletter or pass the address on to anyone.
When you buy a business card print file
- Data
- Your email and the name on the invoice. For a company invoice, the company name, the registry code, the VAT number and the address. The order (the design and the number of names) and the print file itself, with the card's texts and logo.
- Why
- To sell you the file, issue the invoice and send a link with which you can download the file again later.
- Ground
- A contract (point b). Keeping the invoice is a legal duty (point c).
- How long
- The invoice and the order 7 years, as the Accounting Act requires. We delete the print file earlier if you ask.
While you design, the card's texts, logo and colours stay only in your browser, so you can continue later. They are not sent to us before you buy. Payment happens on Stripe's page: you enter your card details there and we do not see them. After payment, the invoice and the file link come to your email. The file is in our file storage so that the link works.
When you are our client
- Data
- The contact person's name and details, the company's details, offers and the contract, invoices and payments, project materials (texts, pictures, logos), correspondence and the access you give us.
- Why
- To do the agreed work, invoice it and maintain the site.
- Ground
- A contract (point b). Accounting is a legal duty (point c).
- How long
- During the contract and 3 years after it ends, because claims can arise from a contract for that long. Invoices 7 years.
We keep passwords and other access details encrypted. Content marketing and social media marketing are done by our partner agency. If you order this work, we pass on to the partner only what the work needs, and we tell you the partner's name first.
When we contact you ourselves
We also offer our services to companies that have not written to us before. We use only public company contacts: those the company has itself entered in the business register or published on its website. We do not send such letters to private persons or sole traders, and we do not call them.
The ground is legitimate interest (point f). You can always object to direct marketing, and then we stop at once. There are two separate notices for this, which always show the current setup: the business letters privacy notice and the phone call privacy notice.
03Cookies and browser storage
A cookie is a small file a site leaves in your browser. Browser storage (localStorage and sessionStorage) works the same way. We use them only to make the site work and to remember your own choices.
What runs on this site
- Google Analyticsno
- Facebook (Meta) pixelno
- Advertising and tracking cookiesno
- Videos and maps from other sitesno
- Our own visit counter, without cookiesyes
- Fonts on the business card page from Google Fontsyes
- Pictures, font and files through Cloudflareyes
- Bot check by the formsyes
Checked on 3 October 2026. When we add a new tool to the site, we update this list.
The site's font comes from our own file storage. Only the business card page loads the card fonts from Google's server, so there Google sees your IP address and browser.
What the site leaves in your browser
| Name | Why | How long |
|---|---|---|
wa-locale | Remembers the language you chose. It is set when you change the language. | 1 year, cookie |
wa-color-mode | Remembers whether you chose the light or the dark view. | until you delete it |
wa-letter-draft:… | Keeps an unfinished message until you send it. | 7 days |
vk-… | The business card designer: your card, logo, recently used colours and the key of a purchased order. | until you delete it |
wa-showcase-favs | The ready-made designs you marked as favourites. | until you delete it |
wa-listen | Blog read-aloud: the place where you stopped listening. | until you close the tab |
All of these are needed for what you yourself do on the site, and none of them sends anything to a third party. That is why we do not ask for consent for them. You can delete them in your browser settings at any time.
04Who we share data with
We do not sell data to anyone. Only the companies that help us run the site and the service see data, and each sees only the part its work needs. They process the data on our behalf and on our instructions.
| Who | What they do | Where |
|---|---|---|
| Our own server | The site, the database, the forms, the client records and the backups. We run the server ourselves. | Estonia |
| Cloudflare | Delivers the site's pictures, font and files, protects the server from attacks, checks the forms for bots (Turnstile) and holds the files in our file storage. | EU and USA |
| The fonts on the business card page (Google Fonts). | USA | |
| Zone.eu | Our email mailbox and the domain's name servers. | Estonia |
| Resend | Sends the site's emails: form notifications, order confirmations and invoices. | USA |
| Stripe | Payment for the business card print file. | Ireland and USA |
| Anthropic | Artificial intelligence that helps our staff draft a reply to a message. Anthropic does not use this data to train its models. | USA |
| Twilio, ElevenLabs, Google | Only phone calls from our client records system. The details are in the phone call notice. | EU and USA |
| Partner agency | Only if you order content marketing or social media marketing. We tell you the partner's name before the work starts. | - |
| Public authorities | Only when the law requires it, for example the Tax and Customs Board. | Estonia |
The site also links to other sites, for example our Facebook and Instagram pages and the sites of our hosting partners Zone.eu and Veebimajutus.ee. These are only links. When you go there, that site's own privacy policy applies. If you buy on a partner's site, the partner learns that you came through us.
05Data outside Europe
Some service providers are US companies: Cloudflare, Google, Resend, Stripe, Anthropic, Twilio and ElevenLabs. When data leaves Europe, we use the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. They require the company to protect the data the same way as in Europe.
06How long we keep data
We keep data only as long as it is needed. When the time limit passes, we delete the data or change it so that it can no longer be linked to anyone.
| Data | How long |
|---|---|
| Web server log | 14 days. The application's error logs are deleted with every software update. |
| The day's working copy of visits | 2 days |
| Visit summaries, without personal data | about 2 years |
| Visits to missing addresses | the last 500 per address |
| Messages moved to the spam folder | 30 days |
| Enquiries and audits that did not lead to a contract | 2 years from the last contact |
| Client contract and project data | during the contract and 3 years after it ends |
| Invoices and accounting documents | 7 years |
| Business card order and print file | 7 years. We delete the file earlier if you ask. |
| Backups | up to 1 year. Deleted data disappears from the backups within that time. |
| Phone calls | see the phone call notice |
| Business letters and objections | see the business letters notice |
| What is in your browser | see section 3 |
07Your rights
You have these rights over your data. Using them is free.
Get a copy. Ask what we keep about you, and we send you a copy.
Have it corrected. If something is wrong, we correct it.
Have it deleted. We delete it unless we have a duty to keep the data, as with invoices.
Restrict its use. You can ask us not to use the data for a while, for example during a dispute.
Object. If we use data on the ground of legitimate interest, you can object to it. We stop direct marketing at once.
Take your data with you. You get the data as a file that another system can read.
Withdraw consent. If something is based on your consent, you can withdraw it at any time.
Write to info@webadmin.ee. We answer within one month, usually sooner. We may ask you to prove who you are, so that we do not give the data to the wrong person.
We make no automated decisions about you that have a legal or other significant effect on you. The bot check may move a suspicious message to the spam folder, but we see that folder and can move the message back.
If you think we break the data protection rules, you can turn to the Data Protection Inspectorate. But write to us first: things can often be solved faster.
08Security
The connection to the site is encrypted (HTTPS).
Only the people who need the data for their work can access it.
We keep passwords, keys and other secrets encrypted.
We back up the databases regularly and keep the backups on our server.
If a data breach happens that may affect you, we tell the Data Protection Inspectorate and, if needed, you as well, as the law requires.
Our services are meant for companies and adults. We do not knowingly collect children's data.
09Changes
When we change this policy, we put a new date here and briefly describe the change. We also tell clients about a larger change by email.