Privacy Policy

ASTARALTECH OÜ ("ASTARAL", "we", "us", or "our") is a private limited company (osaühing) registered in Estonia under registry code 17445077, with its registered office at Telliskivi tn 57, Põhja-Tallinna linnaosa, Tallinn, 10412, Estonia.

ASTARAL is a digital marketing agency specialising in cost-per-lead generation services ("AstaraLeadGen"). Our services connect users seeking products or services with business partners ("Partners") who can respond to their enquiries. We operate primarily in the United Kingdom and European Union markets.

This Privacy Policy describes how we collect, use, store, share, and protect personal data when you:

• Visit our website at www.astaral.eu (the "Site");
• Interact with any landing pages, lead capture forms, or interfaces operated by ASTARAL (the "Interfaces");
• Contact us by email or any other means;
• Use any of our services as a business Partner or prospective client.

This Policy is drafted in accordance with Regulation (EU) 2016/679 (the "GDPR"), the Estonian Personal Data Protection Act (isikuandmete kaitse seadus, "PDPA"), and all other applicable data protection legislation. It should be read alongside our Cookie Policy, available at www.astaral.eu/cookie-policy.

For the purposes of the GDPR, the data controller is:

Given the current scale of our operations, ASTARAL has not appointed a dedicated Data Protection Officer (DPO). All data protection enquiries may be addressed to privacy@astaral.eu or by post to the registered address above. Should our processing activities require the appointment of a DPO under Article 37 of the GDPR, this Policy will be updated accordingly.

3.1. Data collected through our Interfaces (lead generation)

When you complete a form to be connected with a Partner, we collect the personal data you provide. The categories of data collected depend on the specific service or product you are seeking:

Fields marked with an asterisk (*) on the Interfaces are mandatory. All other fields are optional.

3.2. Data collected after the lead referral

Following a referral, our Partners may provide us with limited feedback regarding the outcome of your enquiry (e.g. whether contact was established). This is strictly necessary to fulfil our contractual obligations towards our Partners and to measure service quality.

3.3. Technical data collected automatically

When you browse the Site or Interfaces, we automatically collect:

• IP address (in pseudonymised form where possible);
• Browser type and version, operating system;
• Device type (desktop, mobile, tablet);
• Pages visited, date and time of access, referring URL;
• Cookie and tracking identifiers (subject to your consent — see our Cookie Policy).

This technical data is not transferred to our Partners.

3.4. Business contact data

If you interact with us as a prospective or existing business Partner, we may collect your professional contact details through direct communications, networking events, or publicly available professional sources.

We process personal data for the following purposes:

Where we rely on legitimate interest, we have conducted a balancing test. You may request details by contacting us.

5.1. Transfer to Partners

We transfer the personal data you provide through our Interfaces to one or more Partners able to respond to your enquiry. Each Interface identifies the Partner(s) or their sector before you submit your data. Once transferred, the Partner becomes an independent data controller. Partners may only use your data to respond to your enquiry. Any further use requires separate consent. ASTARAL does not send direct marketing communications to end users.

5.2. Service providers

We use carefully selected third-party service providers acting as data processors on our behalf, located within the EEA or in countries ensuring an adequate level of protection. These providers assist us with functions such as tag management, conversion tracking, lead distribution, data storage, form hosting, and payment processing. Each provider is bound by a Data Processing Agreement (DPA) under Article 28 GDPR. A current list of sub-processors is available upon request at privacy@astaral.eu.

5.3. Transfers outside the EEA

ASTARAL endeavours to keep all personal data within the EEA. Where a transfer outside the EEA is necessary, we ensure appropriate safeguards, including adequacy decisions, Standard Contractual Clauses (SCCs), or other safeguards under Chapter V of the GDPR. You may request a copy of relevant safeguards at privacy@astaral.eu.

In the event of a pending claim or dispute, relevant data may be retained for the duration of proceedings plus any applicable statutory limitation period.

ASTARAL implements appropriate technical and organisational measures under Article 32 GDPR, including:

• Encryption of data in transit (TLS/SSL) and at rest;
• Access controls on a need-to-know basis;
• Pseudonymisation and anonymisation where feasible;
• Secure hosting within the EEA;
• Regular security reviews;
• Contractual security obligations on all sub-processors.

No transmission over the internet is entirely secure. We recommend you also take appropriate measures to protect your own data and devices.

Under the GDPR (Articles 15–22) and the Estonian PDPA, you have the following rights:

• Right of access (Art. 15): Obtain a copy of your personal data and information about processing.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion where data is no longer necessary, you withdraw consent, or you successfully object to processing.
• Right to restriction (Art. 18): Request suspension of processing in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interest. For direct marketing, no reason is required.
• Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting prior lawfulness.
• Right regarding automated decisions (Art. 22): Not be subject to solely automated decisions with legal effects. ASTARAL does not currently engage in fully automated decision-making.

8.1. How to exercise your rights

• By email: privacy@astaral.eu
• By post: ASTARALTECH OÜ, Attn: Privacy, Telliskivi tn 57, 10412 Tallinn, Estonia

We will respond within one (1) month. This may be extended by two (2) months for complex requests, with notice. We may request proof of identity. No fee is charged except for manifestly unfounded or excessive requests.

8.2. After your request

Where applicable, we will inform relevant Partners so they may also act on your request. We retain records of all data subject rights requests for five (5) years to demonstrate compliance.

8.3. Communications from Partners

ASTARAL does not send direct marketing to end users. To stop receiving marketing from a Partner, contact that Partner directly. Where we collected your consent for Partner communications, you may withdraw it by contacting us.

If you believe our processing does not comply with data protection law, you may lodge a complaint with:

You may also lodge a complaint with the supervisory authority in your EU/EEA Member State of habitual residence.

Our Site and Interfaces use cookies. Essential cookies do not require consent. Non-essential cookies (analytics, advertising, social media) are only placed with your explicit consent via the cookie banner. You may modify preferences at any time via the cookie settings in the Site footer. See our Cookie Policy at www.astaral.eu/cookie-policy.

Our services are not directed at individuals under 16. We do not knowingly collect data from children. If we become aware of such collection, we will delete it. Contact privacy@astaral.eu if you believe a child has provided us with data.

We may update this Policy to reflect changes in our practices or legislation. Amendments take effect upon publication on the Site. Where material changes are made, we will make reasonable efforts to notify you.