Who is responsible

This section will cover: The controller's identity — Swiftmade OÜ — with its registration details, and the working route for privacy matters.

Which registration details identify the controller? The published identity must match official records and the legal notice exactly.
Which contact route serves privacy matters? A policy pointing at an unmonitored or unconfigured address fails the moment someone uses it.

What data we collect

This section will cover: The data categories tied to each real collection point on this site: the early-access form, the contact route, analytics and cookies.

What is the complete inventory of collection points and fields? The policy may describe only processing that exists; an inventory taken from the live site is the source.
Do server logs hold personal data, and which? Submissions are currently recorded server-side; whatever that captures belongs in this section.

Why we process it and on what basis

This section will cover: The purpose and lawful basis for each category above.

Which lawful basis applies to each purpose? Consent, contract and legitimate interest carry different obligations; counsel assigns them, not a template.
On what basis are early-access details used for follow-up? The form's consent wording must match the basis this section claims.

This section will cover: Only the processors actually engaged — no placeholder vendor list.

Which processors are engaged for hosting, analytics and email delivery, and where are they located? Naming an unengaged vendor — or omitting an engaged one — makes the policy false either way.

International transfers

This section will cover: Whether any processing leaves the EU/EEA, and if so under which mechanism.

Do any engaged processors transfer data outside the EU/EEA? If none do, this section says so; if any does, the transfer mechanism must be named.

How long we keep it

This section will cover: Retention per data category, owner-confirmed.

What is the retention period for each category? Invented periods are commitments nobody is keeping; each must be operationally confirmed.
How long are unsuccessful early-access requests kept? Most stored data on this site will come from requests that do not proceed.

Cookies and analytics

This section will cover: The exact tools in production, how the consent banner gates them, and how consent is withdrawn.

Does the described tooling match production behavior exactly? Analytics on this site are consent-gated; the policy must describe that mechanism as built, including withdrawal.

Your rights

This section will cover: The rights you hold and how to exercise them through the contact route.

How are data-subject requests received, verified and answered? A rights section without a working, tested route is decoration.

Complaints

This section will cover: The supervisory authority competent for the confirmed establishment.

Which supervisory authority is competent? It follows from the confirmed establishment; counsel names it from the record, not from assumption.

Children

This section will cover: The age position, consistent with what the product actually offers.

What age position does the product take, and does any age gating exist? The stated position must match real product behavior, not boilerplate.

Security

This section will cover: Only measures actually implemented — no certifications or claims without documents.

Which technical and organizational measures are actually in place? Overstated security is a liability; this section may only describe what exists.

Changes to this policy

This section will cover: How changes are made and announced, with a dated version history.

What is the change and notification process, and where is version history kept? A policy that changes silently cannot be relied on by anyone who accepted an earlier version.

Questions about this draft: contact us about privacy. See also the terms of use and the company details.