Privacy Policy
This privacy policy explains how Tehisintellekt OÜ collects and uses personal data when you visit tehisintellekt.ee, order a course, attend a course, book a consultation, contact us or subscribe to our newsletter.
We process personal data under the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act. Cookies used on the website are described in a separate cookie policy.
1. Controller
The controller of your personal data is:
- Tehisintellekt OÜ (“we”, “Tehisintellekt”)
- Estonian business registry code: 16967299
- VAT number: EE102729140
- Registered address: Jalgpalli 1, 11312 Tallinn, Eesti
- Tartu office: Narva mnt 18, 51009 Tartu
- E-mail: info@tehisintellekt.ee
- Phone: +372 5886 9046
- Member of the board: Eneli Eljand
We have not appointed a Data Protection Officer, as the law does not require us to. For any data protection question, or to exercise your rights, write to info@tehisintellekt.ee.
2. What data we collect
We collect only what we need to provide the service, or what you have consented to. We obtain the data mainly from you.
| Who and when | What data | Source |
|---|---|---|
| Website visitor | approximate location derived from IP address, device and browser data, pages viewed, referral source, clicks, scrolling and movement on the page | cookies and analytics - only with your consent |
| Person booking a consultation | name, e-mail, phone, chosen time, any notes you add | from you |
| Course customer | name, e-mail, phone, company name, registry code, VAT number and address, order and payment data, invoices, and if you choose to answer, where you heard about us | from you |
| Course participant (open course) | first and last name, e-mail and the Estonian personal identification code | from you or from the customer |
| Course participants (in-house course) | only the number of participants on the order line; if the customer wants confirmations we ask separately, by e-mail, for a participant list (name and personal identification code) | from the customer |
| On-site course customer | the address of the training venue | from you |
| Newsletter subscriber | e-mail address and the time consent was given | from you |
We do not collect special categories of personal data (health, beliefs and similar) and we do not knowingly process data about people under 16. If a participant needs an accommodation, we use that information only to organise the course and delete it afterwards.
3. Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Fulfilling the order: reserving the place, sending the joining link and materials, delivering the course | performance of a contract (GDPR Art 6(1)(b)) | until the order is fulfilled, then for the accounting retention period |
| Invoicing and accounting | legal obligation (Art 6(1)(c)), Estonian Accounting Act | 7 years from the end of the financial year in which the invoice was issued |
| Issuing a course completion confirmation | performance of a contract (Art 6(1)(b)) | the personal identification code for up to 180 days after the course, then anonymised automatically; where the course date can no longer be established, at the latest 545 days after the order was placed |
| Answering enquiries and preparing quotes | pre-contractual steps (Art 6(1)(b)) or legitimate interest (Art 6(1)(f)) | up to 2 years from the last contact |
| Abandoned-order reminder by e-mail | legitimate interest (Art 6(1)(f)) | until the order expires |
| Newsletter and marketing messages to private individuals | consent (Art 6(1)(a)), Electronic Communications Act § 103¹ | until consent is withdrawn |
| Marketing messages to a business customer’s work contact | legitimate interest (Art 6(1)(f)) | until you opt out |
| Contact person’s name, e-mail and phone for an internal training (to run the course and ask for pre-training details) | legitimate interest (Art 6(1)(f)) | until the training takes place and the following billing period |
| Analytics and marketing cookies | consent (Art 6(1)(a)) | see the cookie policy |
| Security of the website and store, prevention of misuse and fraud | legitimate interest (Art 6(1)(f)) | up to 12 months |
| Bringing and defending legal claims | legitimate interest (Art 6(1)(f)) | until the limitation period for the claim expires |
Placing an order requires the customer’s name, e-mail and address, and the payment details. Registering for an open course also requires each participant’s name, e-mail and personal identification code; ordering an in-house course collects no participant details, only the number of participants. Without these we cannot conclude the contract, issue an invoice or issue the confirmation. Allowing analytics and marketing cookies is always optional and refusing has no effect on ordering a course.
4. Estonian personal identification code
When registering for an open course we ask for an Estonian personal identification code for every participant, and it is required. The course completion confirmation is part of the service and it has to identify the participant unambiguously - without the code we can neither issue it nor register the participant. Ordering an in-house course does not ask for the code; a customer who wants confirmations for the participants sends the participant list separately before the course. We use the code for nothing else.
Public courses are delivered in Estonian unless stated otherwise for the course. The order form validates the code (11 digits, a valid date of birth and a check digit) so that a typo cannot reach the confirmation. The validation only establishes that the code is well-formed - we do not query the population register or any other register to verify it. If you do not have an Estonian personal identification code, write to info@tehisintellekt.ee and we will arrange the registration separately.
- A code submitted on the order form is stored encrypted in the database (AES-256-GCM) and is not shown in ordinary views.
- Access is limited to those of our staff whose job is issuing confirmations.
- A code submitted on the order form is anonymised automatically 180 days after the course. Where the course date can no longer be established, at the latest 545 days after the order was placed. After anonymisation even we cannot restore it.
- An in-house participant list sent to us by e-mail does not pass through the online store’s database and is not covered by the automatic anonymisation. We keep such a list only for as long as issuing the confirmations requires, and delete it afterwards - at the latest 180 days after the course.
- The code is not disclosed to third parties unless the law requires it.
5. Cookies
The website uses cookies. Necessary cookies are always in use, because the site does not work without them. Analytics and marketing cookies are used only with your prior consent, and you can withdraw that consent just as easily at any time.
A full list of the cookies used, their purpose and lifetime, and the button to change your consent, are on the cookie policy page.
6. Processors and recipients
We do not sell personal data. We use service providers who process data on our behalf and on our instructions, and we have data processing agreements with them.
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | hosting of the website and store | EU / US |
| Neon Inc. | database hosting | EU (Frankfurt) |
| Resend, Inc. | sending e-mail: order confirmations, invoices, reminders, newsletter | US |
| ESTO AS | payment solution (bank link, card payment). ESTO is an independent controller of the payment data | Estonia |
| Pipedrive OÜ | management of sales communication | Estonia / EU |
| Calendly LLC | booking consultation slots | US |
| Google Ireland Limited | analytics (with consent), address lookup and travel-time calculation for on-site courses, trainer calendars | EU / US |
| Meta Platforms Ireland Limited | marketing cookies (only with consent) | EU / US |
| Contentsquare SAS | analysis of how the website is used: clicks, scrolling and recordings of some visits (only with consent). Text is hidden in the recordings and nothing typed into forms is collected | EU (Ireland) |
| Acclouding OÜ | accounting software: preparing invoices and keeping the books. It receives the customer’s name, e-mail, phone, company registry and VAT numbers, and the invoice lines. Neither the personal identification code nor the address is sent there. | Estonia |
| Trainers and subcontractors | delivering the course - they receive only participant names and the organisational details they need | Estonia / EU |
When an on-site course is ordered, the venue address is sent to Google services to provide address suggestions and to calculate the trainer’s travel time and the travel cost. The address is not special category data for us, but please do not enter private personal remarks in the address field.
We may also disclose data to public authorities where the law requires it, and to our legal adviser or auditor where necessary to bring or defend a legal claim.
7. Transfers outside the European Economic Area
Some of the providers listed above are located outside the European Economic Area, or use sub-processors there, mainly in the United States. Such transfers rely on the European Commission’s standard contractual clauses and/or the EU-US Data Privacy Framework.
For more detail on the safeguards in place, write to us at info@tehisintellekt.ee.
8. AI tools used during training
During our courses we use publicly available AI tools (for example ChatGPT, Microsoft Copilot, Claude). Participants enter data into them themselves, and the providers of those tools are independent controllers in that respect - processing is governed by their own terms.
When practising during a course, please do not enter personal data, client data or trade secrets into AI tools unless your employer has clearly permitted it for that specific tool. The trainer reminds participants of this at the start and helps you work with sample data instead.
We do not use our customers’ or participants’ personal data to train AI models.
9. Direct marketing
We send marketing messages to private individuals only with prior consent. We currently do not collect marketing consent anywhere on this site - not at checkout and not elsewhere. If we start, we will ask for it separately and clearly. Consent given earlier can be withdrawn at any time using the link at the end of every marketing e-mail, or by writing to us.
We may send information about our courses to a business customer’s work contact on the basis of legitimate interest. Every such message contains a clear way to opt out.
E-mails relating to an order - order confirmation, invoice, payment reminder, the joining link and practical information - are not direct marketing and we send them even if you have opted out of marketing messages.
10. Your rights
In relation to your personal data you have the right to:
- access the data we process about you and receive a copy of it;
- rectify inaccurate or incomplete data;
- request erasure where there is no longer a basis for processing;
- restrict processing or object to processing based on legitimate interest, including direct marketing;
- withdraw consent - this does not affect the lawfulness of processing before withdrawal;
- receive the data in a portable format where processing is based on consent or a contract;
- lodge a complaint with the supervisory authority - see “Complaints”.
To exercise your rights, write to info@tehisintellekt.ee. We reply within one month. Where a request is complex we may extend that by up to two months and will tell you. Before releasing data we must be satisfied that the request comes from you.
Some data cannot be deleted before the statutory retention period ends - invoices, for example, must be kept for 7 years.
11. Security
- All communication with the website is encrypted (HTTPS/TLS).
- The personal identification code is encrypted in the database and access to it is restricted by role.
- Only named user accounts can access the admin environment, and only to the extent their work requires.
- We do not store card or bank details - they only pass through the payment provider’s environment.
- Our staff and trainers are bound by confidentiality obligations.
12. Automated decisions and profiling
We do not take decisions based solely on automated processing that would have legal consequences for you. The system calculates the course price and travel cost automatically, but that is the application of contract terms, not a decision about you.
Marketing cookies used with your consent allow advertising providers to show you targeted advertising elsewhere online. You can withdraw that consent at any time on the cookie policy page.
13. Complaints
If you believe we have processed your data unlawfully, please contact us first - we will try to explain and resolve the situation.
You always have the right to turn to the supervisory authority: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, +372 627 4135, aki.ee. You also have the right to go to court to protect your rights.
14. Changes to this policy
We update this policy when our services, our service providers or the law change. The date of the current version is shown at the top of this page. We notify newsletter subscribers by e-mail of significant changes.