Legal
How OKADAR processes data
Below is a description of the data the service processes, the purposes of processing and the ways to exercise your rights.
Data controller
OKADAR OÜ, reg. code 17580757. Contact for data matters: okadar@mail.ee.
What data is processed
The service processes account and company data, contact details, project settings, subscription and invoice information, support requests and submitted enquiries. Technical security and usage data are also processed.
Purposes of processing
The data is needed to provide the service, perform the contract, process payments, meet legal obligations, ensure security, provide support and analyse how OKADAR works.
Legal bases
Depending on the purpose, the legal basis is performance of a contract, a legal obligation, legitimate interest or consent, where it is required.
Analytics events
The service may record opens, configuration changes, chosen options, WebAR launches, session duration, device and browser, language, referrer and country. The IP address is not saved in the analytics event store. For analytics, the server uses the IP address only briefly in memory to limit the request rate and protect against abuse. The country is provided by the Cloudflare delivery network when the site runs through it. Without the visitor's consent in the cookie banner of the site where the configurator is installed, only anonymous event counters are sent - without a visitor ID, page address or browser data, and nothing is stored in the browser. A random visitor ID (in browser storage), the page address, the referrer and browser data are used only after such consent.
Optional analytics
Google Analytics and other optional analytics tools are not loaded until the required consent is given. Declining does not restrict the core operation of the site. You can change your choice via "Cookie settings".
Recipients of data
To the extent necessary, data is shared with the infrastructure, e-mail, payment and analytics providers actually used. If data is transferred outside the EEA, the necessary information about such a transfer is provided.
Retention periods
Data is kept for as long as necessary for the relevant purpose or as required by law. Analytics events are kept for 180 days and then deleted automatically. Account sign-in sessions, with the IP address and browser details, serve security and are deleted after 30 days. The security log (account sign-ins and actions in the dashboard, with the IP address) is kept for 12 months and then deleted automatically.
Your rights
Where applicable, you may request access, rectification, erasure, restriction of processing or data portability, object to processing and withdraw consent. You also have the right to lodge a complaint with a supervisory authority. For requests, use okadar@mail.ee.