Privacy Policy

1. Introduction and scope

This Privacy Policy (“Policy”) explains how Takian Corporation OÜ (“we”, “us”, “our”), which operates the Hubumo brand and the public website https://hubumo.eu, processes personal data in connection with: (i) visiting and using the website; (ii) demo, sales, and support enquiries; and (iii) related marketing and pre-contractual communications.

Customer-specific Hubumo venue installations, Manager portals, and production systems operated for contracted customers are governed by the applicable customer agreement, order form, and, where required, a separate data processing agreement under Article 28 of Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”). Where those agreements apply, they take precedence for the relevant processing activities.

This Policy is intended to satisfy the transparency requirements under Articles 12–14 of Regulation (EU) 2016/679 (the GDPR) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).

2. Controller identity

The data controller under this Policy is:

• Legal name: Takian Corporation OÜ
• Registry code (Estonian: äriregistri kood): 16081236
• VAT number (KMKR): EE102301283
• Legal form: private limited company (osaühing) incorporated under the laws of the Republic of Estonia
• Website: https://hubumo.eu
• Sales enquiries: sales@hubumo.eu
• Support and data protection requests: support@hubumo.eu

Takian Corporation OÜ · Registry code 16081236 · VAT number EE102301283

3. Applicable legal framework

Processing under this Policy is carried out primarily under the following legal frameworks:

• Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), including Article 5 (principles), Article 6 (lawfulness of processing), Article 7 (conditions for consent), Articles 12–14 (transparency), Articles 15–22 (data-subject rights), Articles 24–32 (controller responsibilities and security), and Chapter V (transfers of personal data);
• Directive 2002/58/EC (the ePrivacy Directive), as amended, concerning the confidentiality of communications and the storage of information on terminal equipment;
• Estonian Personal Data Protection Act (Isikuandmete kaitse seadus);
• Estonian Electronic Communications Act (Elektroonilise side seadus), where applicable to cookies and similar tracking technologies;
• Estonian Law of Obligations Act (Võlaõigusseadus, “VÕS”), where applicable to pre-contractual dealings and correspondence.

4. Categories of data subjects

We may process personal data relating to the following categories of individuals:

• visitors to hubumo.eu and individuals who interact with our public forms;
• representatives of venues, operators, agencies, and other organisations requesting a demo or commercial information;
• individuals who contact us by email at sales@hubumo.eu or support@hubumo.eu;
• representatives of prospective or existing business customers who engage in pre-contractual correspondence with us.

Hubumo’s marketing services are directed at businesses on a business-to-business basis. We do not knowingly solicit personal data from children under the age of 16 for marketing purposes.

5. Categories of personal data

5.1 Enquiry and contact details

When you submit a demo request or contact form, or otherwise contact us, we may process your full name, business email address, telephone number if provided, venue type, number of venues, place name, address or location identifiers, including Google Places identifiers when you select a place, the content of your message, and submission metadata such as the submission time, source page, and technical identifiers.

5.2 Technical and security data

When you visit hubumo.eu, we may process the IP address, browser and device type, operating system, referrer URL, pages viewed, access timestamps, and server or application logs necessary for security, abuse prevention, diagnostics, and service availability.

5.3 Cookies and similar technologies

As described in our Cookie Policy, we may store or access information on your device through cookies and similar technologies. Strictly necessary cookies may be used where required to provide and secure the website. Non-essential cookies are used only where an applicable lawful basis exists, typically your consent under Article 6(1)(a) of the GDPR and applicable ePrivacy requirements.

5.4 Correspondence

We may process emails and other communications you send to us, including attachments and our replies, for the purpose of managing your enquiry or correspondence with us.

5.5 Special categories of data

We do not intentionally collect special categories of personal data within the meaning of Article 9 of the GDPR through hubumo.eu. Please do not include such information in free-text fields. If you provide this information inadvertently, we will take reasonable steps to delete it where appropriate, unless we are required or permitted by law to retain or process it.

6. Purposes and legal bases (Article 6 GDPR)

We process personal data only where at least one lawful basis under Article 6(1) of the GDPR applies. The main purposes and corresponding legal bases are:

• Responding to demo and sales enquiries — Article 6(1)(b) of the GDPR, where processing is necessary to take steps at your request before entering into a contract, and/or Article 6(1)(f), where processing is based on our legitimate interests in responding to business enquiries and developing customer relationships, provided that those interests are not overridden by your rights and freedoms;
• Operating, securing, and improving hubumo.eu — Article 6(1)(f) of the GDPR, based on our legitimate interests in network and information security, fraud and abuse prevention, and maintaining service quality, consistent with Recital 49 of the GDPR;
• Complying with legal obligations — Article 6(1)(c) of the GDPR, including applicable accounting, tax, record-keeping, and supervisory requirements;
• Non-essential analytics or marketing cookies — consent under Article 6(1)(a) of the GDPR, where required, together with any consent required under applicable ePrivacy rules;
• Establishing, exercising, or defending legal claims — Article 6(1)(f) of the GDPR, based on our legitimate interests in protecting and enforcing our legal rights.

Where we rely on legitimate interests, you may object to the processing under Article 21 of the GDPR, as described in Section 11. Where we rely on your consent, you may withdraw that consent at any time under Article 7(3) of the GDPR. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

7. Recipients and processors

We do not sell personal data. We may disclose or otherwise make personal data available to the following recipients where necessary for the purposes described in this Policy:

• authorised personnel of Takian Corporation OÜ who require access to perform their duties, on a need-to-know basis;
• service providers acting as processors for hosting, email delivery, infrastructure, security, or IT support, under contracts that comply with Article 28 of the GDPR;
• professional advisers, including legal and accounting advisers, who are subject to confidentiality obligations;
• public authorities where disclosure is required by European Union or Member State law;
• a successor entity in connection with a merger, acquisition, restructuring, or reorganisation, subject to appropriate safeguards.

For customer-specific Hubumo installations, Takian Corporation OÜ processes venue data on the customer’s documented instructions and in accordance with the applicable agreements. Such data is not used as a shared marketing database across unrelated venues.

8. International transfers

We aim to process personal data within the European Economic Area (EEA). If personal data is transferred outside the EEA, we will ensure that the transfer is made in accordance with Chapter V of the GDPR using an appropriate safeguard, such as an adequacy decision under Article 45, standard contractual clauses under Article 46, or another lawful transfer mechanism. Further information is available on request.

9. Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, in accordance with the storage-limitation principle in Article 5(1)(e) of the GDPR. Our retention periods include the following:

• Enquiry and sales correspondence — generally for the duration of active follow-up and a reasonable period afterwards, typically up to 24 months after the last substantive interaction, unless a longer period is necessary to perform a contract, establish or defend legal claims, or comply with a legal obligation;
• Security and server logs — for a limited period determined by security and operational needs, typically up to 12 months, unless a longer period is necessary to investigate or resolve a security incident;
• Cookie data — as described in the Cookie Policy and, where applicable, until the relevant cookies expire or are deleted from your device.

When the applicable retention period ends, we delete or irreversibly anonymise the personal data, unless we are legally required to retain it for a longer period.

10. Security measures

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks to individuals’ rights and freedoms, we implement appropriate technical and organisational measures in accordance with Article 32 of the GDPR. These measures may include access controls, encryption of data in transit, least-privilege access, security logging, and confidentiality obligations for staff.

No method of transmission or storage is completely secure. Although we take appropriate security measures, we cannot guarantee the absolute security of information transmitted over the internet.

11. Your rights as a data subject

Subject to the conditions and exceptions set out in the GDPR and applicable Estonian law, you may have the following rights:

• Access — the right to obtain confirmation as to whether personal data concerning you is being processed and, where that is the case, to access that personal data under Article 15 of the GDPR;
• Rectification — the right to have inaccurate personal data corrected and incomplete personal data completed under Article 16 of the GDPR;
• Erasure (“right to be forgotten”) — the right to request deletion of personal data under Article 17 of the GDPR;
• Restriction of processing — the right to request that use of your personal data be restricted under Article 18 of the GDPR;
• Data portability — the right to receive personal data in a structured, commonly used and machine-readable format and to transmit those data to another controller under Article 20 of the GDPR, where applicable;
• Objection — the right to object to processing based on our legitimate interests under Article 6(1)(f) of the GDPR, including profiling related to that processing, under Article 21 of the GDPR;
• Withdrawal of consent — the right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal, under Article 7(3) of the GDPR;
• Automated decision-making — the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significant effects, as set out in Article 22 of the GDPR. We do not currently carry out such decision-making on hubumo.eu.

To exercise your rights, contact us at support@hubumo.eu. We may request additional information where necessary to verify your identity, in accordance with Article 12(6) of the GDPR. We will respond without undue delay and, in any event, within one month of receiving your request. This period may be extended by up to two further months where necessary, taking into account the complexity and number of requests. If an extension is required, we will inform you within the first month and explain the reason for the delay.

12. Complaints to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place where the alleged infringement occurred, under Article 77 of the GDPR.

In Estonia, the competent supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia. Website: https://www.aki.ee

13. Changes

This Policy may be updated from time to time to reflect changes in legal requirements, technology, or our organisational practices. The current version is identified by the “Last updated” date shown at the top of the Policy. Material changes will be communicated by updating that date and, where appropriate, providing additional notice on hubumo.eu or by other appropriate means.

14. Contact

For privacy enquiries and data-subject requests, please contact support@hubumo.eu. For commercial enquiries or demo requests, contact sales@hubumo.eu or submit the Request a demo form on hubumo.eu.