Privacy Policy

1. Introduction

This Privacy Policy explains how Megfur OÜ (“Megfur”, “we”, “us”, or “our”) collects, uses, stores, and protects personal data when you visit our website, submit an enquiry, use our services, book a consultation, make a payment, or otherwise communicate with us. Megfur OÜ is committed to processing personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Estonian data-protection legislation. This Privacy Policy applies to personal data collected through our website, consultation booking process, customer communications, and related services.

2. Data Controller

The data controller responsible for your personal data is: Megfur OÜ Registry code: 17383896 Registered office: Tallinn, Estonia Email: info@megfurou.com Website: https://megfurou.com Megfur OÜ is responsible for determining how and why your personal data is processed in connection with our website, consultation services, customer communications and related business activities.

3. Data Protection Officer

Megfur OÜ is not required to appoint a Data Protection Officer (DPO) under Article 37 of the General Data Protection Regulation (GDPR), as our core activities do not involve large-scale processing of special categories of personal data or large-scale, regular and systematic monitoring of individuals. For any questions, requests or concerns relating to privacy or the processing of personal data, you can contact us directly at info@megfurou.com.

4. What Personal Data We Collect

Depending on how you interact with Megfur, we may collect the following categories of personal data: Information you provide directly • First name • Last name • Email address • Country or region • Information about your business • Information about what you are looking for assistance with • Information you provide during a consultation • Information contained in communications you send to us • Information relating to your booking • Information relating to payments and transactions We only request information that is reasonably necessary for the relevant purpose. Booking information When you schedule a consultation, we may process: • Your name • Email address • Appointment date and time • Booking and cancellation information • Information required to organise the online meeting Consultations may be scheduled through HubSpot and conducted using Google Meet. Payment information Payments for our consultation services are processed through Stripe. Megfur does not ordinarily receive or store your complete payment-card number, security code, or other full payment credentials. Payment information is processed by Stripe in accordance with its own privacy practices and applicable payment-security requirements. Stripe processes personal data in connection with payment transactions and may act as a controller and/or processor depending on the activity.

5. How We Use Your Personal Data

We may use your personal data for the following purposes: Providing our services • Process your consultation request • Understand what assistance you are seeking • Arrange and conduct your consultation • Communicate with you about your appointment • Provide information and guidance requested by you • Follow up after a consultation where appropriate Managing payments • Process payments • Confirm successful payments • Manage refunds where applicable • Maintain financial and transaction records • Meet accounting and legal obligations Managing our customer relationship • Maintain customer records • Respond to enquiries • Manage communications • Record relevant interactions • Provide customer support Legal and compliance purposes • Comply with legal obligations • Maintain accounting and tax records • Establish, exercise, or defend legal claims • Prevent fraud or misuse • Protect our business, systems, and customers Improving our services We may use information about how customers interact with our services to improve our website, consultation process, customer experience, and business operations, where permitted by law.

6. Legal Bases for Processing

Under the GDPR, we process personal data on one or more of the following legal bases: Performance of a contract We process personal data when it is necessary to provide a service you have requested or to take steps at your request before entering into a contract. For example, this includes processing information necessary to arrange and conduct your €99 Estonia Business Setup Consultation. Legal obligation We may process personal data where necessary to comply with legal obligations, including accounting, tax, financial, and other applicable regulatory requirements. Legitimate interests We may process personal data where necessary for our legitimate business interests, provided that those interests are not overridden by your fundamental rights and freedoms. This may include: • Managing our business • Maintaining customer records • Securing our systems • Preventing fraud and misuse • Communicating with customers about an existing service • Defending legal claims Consent Where required, we will ask for your consent before processing personal data for a purpose that requires consent. Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

7. Information About Your Business

During the consultation booking process, you may voluntarily provide information about your business, business plans, intended activities, or other circumstances. We use this information to understand your situation and prepare for or conduct the consultation. You should not provide sensitive personal information or information that is unnecessary for the consultation. Megfur's consultation service is intended to provide general business information and guidance. As explained in our Customer Terms & Disclaimer, the consultation does not constitute legal, tax, accounting, financial, investment, immigration, or other regulated professional advice.

8. Service Providers and Third Parties

We use selected third-party service providers to operate our website and provide our services. These may include: HubSpot We use HubSpot for customer relationship management, forms, appointment scheduling, and related business communications. Information submitted through our consultation form may be processed through HubSpot. HubSpot provides contractual data-processing arrangements for customers using its services, including mechanisms addressing international data transfers. Stripe We use Stripe to process consultation payments. Payment and transaction information may be processed by Stripe in accordance with Stripe's privacy policy and applicable data-protection requirements. Google Workspace / Google Calendar / Google Meet We use Google Workspace services to manage our business email, calendar, and online consultations. When you book a consultation, information necessary to schedule and conduct the meeting may be processed through these services. Other service providers We may use additional service providers where reasonably necessary to operate our business, provide requested services, maintain our systems, or comply with legal obligations. We require relevant service providers to process personal data only as necessary for the services they provide and, where required, under appropriate contractual data-protection arrangements.

9. Sharing Personal Data

We do not sell your personal data. We may disclose personal data to: • Service providers supporting our business operations • Payment processors • Technology and hosting providers • Professional advisers where necessary • Government authorities, regulators, courts, or law-enforcement bodies where legally required • Third-party service providers where you specifically request or authorise an introduction Referral partners As explained in our Customer Terms & Disclaimer, Megfur may introduce customers to third-party service providers where this is relevant to the customer's needs. If you choose to use a third-party provider, that provider may process your personal data under its own privacy policy and may become an independent data controller. Megfur does not control how an independent third-party provider processes your personal data after it has been lawfully shared with or provided to that provider. Where a referral involves a potential commission or commercial relationship, this is disclosed in accordance with our Customer Terms & Disclaimer.

10. International Data Transfers

Some of our service providers may process personal data outside the European Economic Area (“EEA”). Where personal data is transferred outside the EEA, we will take appropriate measures required by applicable data-protection law. These measures may include an adequacy decision, Standard Contractual Clauses, or another legally recognised transfer mechanism. For example, HubSpot states that its DPA incorporates EU Standard Contractual Clauses for relevant international transfers. Third-party providers such as Stripe and Google may also have their own international data-transfer mechanisms and privacy documentation.

11. Data Retention

We retain personal data only for as long as it is necessary to fulfil the purposes for which it was collected, to provide our services, maintain our business relationship with you, comply with legal and regulatory obligations, resolve disputes, establish, exercise or defend legal claims, and enforce our agreements. Different categories of personal data may therefore be retained for different periods. Consultation and customer information Information relating to enquiries, consultations and customer relationships is generally retained for as long as reasonably necessary to provide and administer our services, maintain appropriate business records, resolve disputes and establish, exercise or defend legal claims. Where the information is no longer required, it will be deleted or anonymised unless a longer retention period is required by law. Accounting, payment and tax records Accounting documents, invoices, payment records and other documents required for accounting or taxation purposes are retained for the periods required under Estonian law. In general, relevant accounting and tax documentation is retained for at least seven (7) years. Estonian law requires accounting documents to generally be preserved for seven years, while tax-related documents are generally required to be preserved for at least seven years. VAT invoices are also generally required to be retained for seven years. Marketing communications Where you have consented to receive marketing communications, we retain your contact details for marketing purposes until you withdraw your consent or we otherwise determine that the information is no longer necessary for that purpose. Website and cookie information Information collected through cookies and similar technologies is retained according to the applicable technology and cookie duration described in our Cookies section below. When personal data is no longer necessary for the relevant purpose and there is no legal requirement to retain it, we will securely delete, anonymise or otherwise dispose of it.

12. Data Security

We take reasonable technical and organisational measures to protect personal data against: • Unauthorised access • Accidental loss • Destruction • Alteration • Unauthorised disclosure • Other unlawful processing However, no internet-based service or electronic storage system can be guaranteed to be completely secure.

13. Your Rights Under the GDPR

Depending on the circumstances, you have the following rights under the GDPR: Right of access You may request confirmation as to whether we process your personal data and request a copy of that data. Right to rectification You may request correction of inaccurate or incomplete personal data. Right to erasure You may request deletion of your personal data where the applicable legal conditions are satisfied. Right to restriction You may request that we restrict processing of your personal data in certain circumstances. Right to object You may object to certain processing, including processing based on legitimate interests. Right to data portability Where applicable, you may request your personal data in a structured, commonly used, and machine-readable format and request that it be transferred to another controller. Right to withdraw consent Where processing is based on consent, you may withdraw that consent at any time. These rights are subject to the limitations and conditions established by applicable law.

14. How to Exercise Your Rights

To exercise your privacy rights, contact us: Email: info@megfurou.com Please provide sufficient information for us to understand your request and verify your identity where reasonably necessary. We will respond to your request within the timeframe required by applicable data-protection law.

15. Right to Lodge a Complaint

If you believe that Megfur has processed your personal data unlawfully, you have the right to lodge a complaint with the relevant supervisory authority. For Estonia, the supervisory authority is: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) You may also contact the supervisory authority in the EU Member State where you live, work, or where you believe an infringement occurred, where applicable.

16. Cookies and Similar Technologies

17. Children's Data

Our services are intended for adults and businesses. We do not knowingly collect personal data from children for the purpose of providing our business consultation services. If you believe that a child has provided us with personal data, please contact us at info@megfurou.com.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect: • Changes to our services • Changes to our technology providers • Changes in applicable legislation • Changes to our data-processing practices When we make material changes, we will update the “Last updated” date at the beginning of this Privacy Policy.

19. Contact Us

If you have any questions about this Privacy Policy or how Megfur processes your personal data, please contact: Megfur OÜ Email: info@megfurou.com Website: https://megfurou.com