Privacy policy

01 / Controller and contact

ArcentLabs OÜ, trading as CertiGraph, is the controller of personal data collected through this website and our direct enquiries and service communications. Registry code: 17505038. Registered address: Harju maakond, Tallinn, Kesklinna linnaosa, Tuukri tn 19, Tallinn 10120, Estonia. Contact for privacy matters: hello@certigraph.io.

Where we process personal data solely on behalf of a partner or client, that processing is governed by the relevant data processing agreement and documented instructions.

02 / Information we process

For an enquiry, we process the name, email address, company, optional WeChat ID, product links or ASINs, and message you provide. Subsequent correspondence may include information needed to prepare a quotation or carry out an order. Please limit personal data in product materials to what is necessary for the service.

If you order services, we may also process service and approval records, contact and operator details included in product documentation, and information required for invoicing and accounting. Hosting and email infrastructure may generate technical, delivery, error and security logs, including IP addresses and request times.

The form marks required fields. Providing information is voluntary, but without the required name, email address and product information we cannot process the form or provide a meaningful response.

03 / Purposes and lawful bases

We process enquiries to respond to your request, carry out a preliminary listing check and prepare a quotation. Article 6(1)(b) GDPR applies where this is necessary to take steps at your request before a contract with you, or to perform that contract. For communications with a company’s representative, Article 6(1)(f) applies where necessary for our legitimate interest in handling relevant business enquiries and administering the business relationship.

We use information needed to prepare and deliver ordered services on the applicable contractual basis, or legitimate interests in communicating with corporate representatives. We process accounting records to comply with legal obligations under Article 6(1)(c). Protecting the website and communications against misuse is our legitimate interest under Article 6(1)(f).

Submitting an enquiry, or confirming that you have read this policy, does not subscribe you to marketing. Enquiry details are used to respond to and handle that enquiry; if you subsequently order a service, relevant details are used for that service. Any marketing subscription will use a separate permission-based list and information provided when permission is requested. Consent may be withdrawn at any time without affecting the lawfulness of earlier processing.

04 / Service providers and disclosure

We use Hostinger for website hosting and business email. These services process information needed to host the pages, transmit and store enquiries and email correspondence, and support technical operation and security. Personnel may access information where necessary to handle the enquiry or deliver the agreed service.

We may disclose information to competent authorities where legally required. We do not sell personal data.

05 / Processing locations and transfers

Hostinger’s Data Processing Addendum describes its processing arrangements and includes contractual provisions for international transfers, including Standard Contractual Clauses where applicable. These provisions apply according to the relevant service and transfer circumstances.

Information about the processing locations and any transfer safeguards relevant to your personal data, including how to obtain information about those safeguards, may be requested at hello@certigraph.io.

06 / Retention

Enquiries that do not result in an order: we will retain personal data only while it is needed to handle the enquiry, ordinarily for no longer than 24 months after the last substantive communication. We will delete or anonymise personal data that is no longer needed for the purposes for which it was collected. A longer period requires a specific continuing need, such as a legal claim.

Client product and service files: retention is determined by the agreed service, documented instructions where applicable, and relevant contractual or legal obligations. Personal data is not automatically retained for ten years merely because it appears in a product file. The manufacturer’s GPSR documentation obligations and our agreed storage service are distinct.

Accounting records: retained for the period required by Estonian law; generally seven years from the end of the relevant financial year, with different starting points or periods where the law requires them.

Technical and email logs: retention depends on their operational or security purpose and the applicable Hostinger service settings. We will review the settings relevant to our services as part of retention management.

07 / Your rights

Subject to GDPR conditions and exceptions, you may request access, rectification, erasure, restriction of processing and data portability; object to processing based on legitimate interests; and withdraw consent where processing is based on consent. Contact hello@certigraph.io. We may request information necessary to verify your identity.

We normally respond within one month, subject to the GDPR’s permitted extensions. You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at aki.ee, or another competent supervisory authority.

08 / Cookies and technical operation

The pages use technical mechanisms to display content and submit forms, including form timing and a hidden anti-spam field. Hosting systems may generate access and security logs. These pages do not use optional analytics or advertising trackers. If such technologies are introduced, the relevant notice and any legally required consent mechanism must be in place before their use.

09 / Automated decisions and children

We do not use enquiry data for solely automated decisions producing legal or similarly significant effects. The services are directed to business users, rather than children.

10 / Changes to this policy

We will update this notice when relevant services, processing arrangements or legal requirements change. The date shown above identifies the latest revision.