Privacy notice.

1. Data controller

The controller of personal data submitted through Torm & Maru is FOTO & GRAAFIKA OÜ, registry code 12950563. For privacy questions, email [email protected].

2. Data we process

The form provides us with your name, work email address, selected service interest and a description of the current situation and intended change. We also process your chosen language and limited technical security data connected with the request.

• To restrict spam, we use an identifier created from the IP address with a salted one-way hash and a list of request timestamps.
• We do not ask for special-category personal data. Please do not include health, political, biometric or other sensitive information in the free-text field.

3. Purpose and legal basis

We use the form data to assess the partnership opportunity, contact you and, at your request, prepare for a possible agreement. The legal basis is taking steps before entering into a contract at the data subject’s request (Article 6(1)(b) GDPR).

Protecting the form, limiting misuse and retaining necessary correspondence rely on our legitimate interest in keeping the service secure and resolving questions connected with a proposal (Article 6(1)(f) GDPR). We do not use proposal data for newsletters, profiling or advertising.

4. Recipients and service providers

Data is available within FOTO & GRAAFIKA only to people who need it to assess and answer the proposal. Cloudflare may process technical web traffic and security data, while Purelymail delivers the transactional email containing the proposal. Data may also be disclosed where required by law or a competent authority.

We do not sell the data or provide it to other companies for their own marketing. Where a provider processes data outside the European Economic Area, applicable data-transfer safeguards are used.

5. Retention

If no partnership begins, we normally retain the proposal and related correspondence for up to 12 months after the last substantive contact. This helps us avoid repeating an assessment and resolve questions connected with the request. If the proposal leads to an agreement, contractual and accounting records are retained for the period required by law or the agreement.

The anti-spam security records are pseudonymised and used for short-term hourly rate limiting. Expired records are cleaned by the server as the form is used.

6. Your rights

You may request access to and a copy of your data, correction of inaccurate data and, where applicable, deletion, restriction, portability or objection to processing based on legitimate interests. Contact [email protected]. We may ask you to verify your identity reasonably before releasing information.

If you believe your data has been handled incorrectly, you may lodge a complaint with the Estonian Data Protection Inspectorate.

7. Required information and automated decisions

Your name, work email, selected service interest, proposal description and acknowledgement of this notice are required so that we can assess and answer the proposal. The form cannot be submitted without them. We do not make automated decisions or profile applicants.

8. Changes to this notice

We may update this notice if the form, service providers or legal requirements change. This version is dated 12 September 2026.