Your data in Europe. GDPR compliant.

1. Data controller

The controller of your personal data is Infinite Labs OÜ, registry code 14889000, VAT EE102227228, Tallinn, Estonia.

Contact email for privacy matters: hello@infinitelabs.co

2. Data we collect

We only collect the data you voluntarily provide to us when filling in forms, booking a diagnostic or sending us an email. This data may include:

• First and last name
• Company and role
• Email address
• Phone number (if you provide it)
• Industry sector and a description of your situation

In addition, we collect basic technical data through our web analytics system (Umami, self-hosted in the EU): page views, browser, country. This data is anonymous and is never cross-referenced with your personal data.

3. Purposes of processing

• Responding to your contact or diagnostic request
• Sending you tailored commercial proposals if you request them
• Managing the contractual relationship if you decide to engage our services
• Complying with legal and tax obligations
• Improving our services through aggregated analysis

4. Legal basis for processing

The legal basis for processing is your explicit consent when filling in our forms and, where applicable, the performance of a contract.

5. Data retention

We retain your data for as long as necessary to fulfil the purposes described above, unless the law requires a different period. For commercial contacts without a signed contract, data is retained for a maximum of 24 months from the last contact.

6. Data location and transfers

All personal data is stored and processed exclusively on servers located in the European Union (mainly Frankfurt, Germany, via Hetzner). We do not carry out international transfers of data outside the European Economic Area without adequate safeguards.

When we use third-party services (SaaS providers, communication tools), we always select those offering EU data residency or equivalent guarantees.

7. Your rights

As a data subject, you have the right to:

• Access: know which of your data we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request the deletion of your data.
• Objection: object to the processing of your data.
• Restriction: request the restriction of processing.
• Portability: receive your data in a structured format.
• Complaint: lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or, under the GDPR, with the supervisory authority of your place of residence.

To exercise any of these rights, write to hello@infinitelabs.co, identifying yourself and specifying your request.

8. Security

We apply reasonable technical and organisational measures to protect your data: encryption in transit (HTTPS), role-based access control, log auditing, and backups on EU infrastructure. However, no system is completely invulnerable, and we cannot guarantee absolute security.

9. Changes to this policy

This policy may be updated. The date of the last update appears above. Substantial changes will be communicated by email to active contacts.