Effective from 31 October 2026. We care about your privacy. This policy explains which personal data AS Tiksoja Puidugrupp collects on tiksoja.eu, why we do it, how long we keep the data and what rights you have.

Who is responsible for your data

The controller is AS Tiksoja Puidugrupp (registry code 10151651), Tähtvere, 61410 Tartumaa, Estonia. For any privacy questions or requests, please contact martin@tiksoja.ee.

What data we collect and why

Contact form and enquiries

When you send us a contact form, a price list request or a production quote request, we process the data you enter: name, email, phone (optional), company, country, product interest, estimated volume, target market and your message. The form is sent by email to our sales team. It is not stored in the website database.

• Purpose: to answer your enquiry, prepare an offer and prepare a possible cooperation.
• Legal basis: steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)) and our legitimate interest in responding to business communication (Art. 6(1)(f)).
• Retention: up to 3 years after our last communication. If the enquiry leads to a contract, related documents are kept for 7 years as required by the Estonian Accounting Act.

Personal product catalogue link

Business customers may receive a personal link to our product catalogue from us. With the link we keep the contact person’s name, company, email and our note. We also record when the link was sent, how many times and when the catalogue was opened, and whether a quote request was sent from it (the selected models and your message). We do not store IP addresses. The quote list in the catalogue is kept only in your browser.

• Purpose: to share our catalogue with selected business partners, answer quote requests and plan follow-up contact.
• Legal basis: our legitimate interest in developing business relationships (GDPR Art. 6(1)(f)).
• Retention: until the link is deleted, and no longer than 2 years after it was last opened. A link that has never been opened is deleted no later than 2 years after it was created.

Website statistics (Google Analytics)

We use Google Analytics to understand how the website is used and to improve it. Statistics cookies are stored only with your consent. The statistics show us aggregate data, such as the pages visited, device and browser type, and approximate location at country or city level.

If you do not give consent, no cookies are stored. In that case the website only sends cookieless signals to Google (Google Consent Mode). These are used to estimate aggregate statistics and do not contain an identifier that identifies you.

• Legal basis: your consent (GDPR Art. 6(1)(a)). For cookieless signals, our legitimate interest in an aggregate overview of website use (Art. 6(1)(f)).
• Retention: up to 14 months.
• You can change or withdraw your consent at any time with the “Cookie settings” button in the corner of the page. Cookies are described in more detail in our Cookie Policy.

Spam protection and security

To protect our forms from spam we use Cloudflare Turnstile. It uses technical data (such as IP address and browser properties) to check that a form is filled in by a person. The data is not used for advertising. For security and troubleshooting, the web server keeps standard logs: IP address, time, page requested and browser.

• Legal basis: our legitimate interest in keeping the website secure and working (GDPR Art. 6(1)(f)).
• Retention: server logs and automatic website backups up to 30 days.

Who we share data with

We do not sell or rent personal data. Data is processed on our behalf and according to our instructions only by service providers that are needed to run the website and our communication:

• Zone Media OÜ (Estonia): website hosting and backups.
• Microsoft Ireland Operations Ltd: email (enquiries reach our Microsoft 365 mailboxes).
• Google Ireland Ltd: website statistics (Google Analytics). The product catalogue also loads fonts from Google Fonts.
• Cloudflare, Inc.: spam protection for forms (Turnstile).

Google, Microsoft and Cloudflare may also process data outside the European Economic Area, in particular in the USA. In that case the transfer is based on the EU–US Data Privacy Framework or on standard contractual clauses approved by the European Commission. We may also disclose data to public authorities where required by law.

Your rights

You have the right to:

• access your data and receive a copy of it;
• have inaccurate data corrected;
• request erasure of your data or restriction of its processing;
• object to processing based on legitimate interest;
• receive the data you provided in a machine-readable format (data portability);
• withdraw your consent at any time, without affecting the lawfulness of earlier processing.

You can send a request to martin@tiksoja.ee. We will reply within one month at the latest. If you believe we have infringed your rights, you can also contact the Estonian Data Protection Inspectorate (www.aki.ee, info@aki.ee) or the data protection authority in your country.

Other information

• We do not make automated decisions about you or profile you.
• Providing data is voluntary. Without contact details, however, we cannot answer your enquiry.
• The website links to LinkedIn, Facebook and Google Maps. When you open them, these services process data according to their own privacy terms.
• We protect data with an encrypted connection (HTTPS), restricted access rights and reliable service providers.

We may update this privacy policy if our activities or the law change. The current version is always on this page, with its effective date at the top.