Your data — explained clearly.
We explain clearly what data we may collect, why we need it, who it may be shared with and what rights you have.
Who is responsible for your data
AKURA FASHION OÜ, trading under the brand FLET-AGENCY, is the controller of personal data we receive through flet-agency.com, contact forms, business correspondence, payments and direct contractual relationships.
We apply the GDPR, the Estonian Personal Data Protection Act and other mandatory EU and Estonian rules applicable to the relevant processing. For cookies and technologies stored on a user’s device, applicable electronic communications rules are also taken into account.
What data we may receive
Name, email, phone number, company, job title and country, if you provide them.
Messages, requirements, budget, timelines, files, specifications and business correspondence.
IP address, browser, device, language, visited pages, referral source, server logs and error logs.
Business details, proposals, contracts, invoices, payment statuses and project approvals.
Access to hosting, domain, DNS, CMS, repository, CRM, analytics, APIs and backups — only where necessary for the work.
We do not ask you to send special-category personal data through ordinary forms or email unless there is a specific need and an agreed process.
Why and on what legal basis we process data
- Before a contract. We respond to your enquiry, discuss the project and prepare an offer at your request.
- Performance of a contract. We develop, launch and support the project, communicate with the client and deliver the result.
- Legal obligation. We maintain accounting records, retain mandatory documents and respond to lawful requests from authorities.
- Legitimate interests. We protect the website and projects from spam and attacks, diagnose errors, maintain security and protect our legal rights.
- Consent. We use optional analytics, advertising technologies and other features where consent is legally required.
Submitting a form does not by itself create a contract or subscribe you to marketing communications.
Forms, email and communication
If you contact us through a form or email, we use the information provided to respond, assess the project and continue communication. To protect forms from spam and technical abuse, we may record the IP address, User-Agent and technical logs.
You decide what information to provide. However, without accurate contact details or enough information about the project, we may be unable to prepare a response or proposal.
Cookies, analytics and advertising
We use FLET-AGENCY’s own cookie settings. Analytics and advertising stay off until you allow them. You can accept, reject or change categories later using Cookie settings in the footer.
Your choice, date, language and settings version are stored in the flet_consent cookie and localStorage (flet.consent.v1) for 180 days. They contain no name, e-mail or tracking identifier. When a settings change requires a reload, an unfinished contact form may be temporarily stored in sessionStorage for up to 5 minutes and removed after restoration.
Required for core website functions, security and storing consent preferences.
May be enabled after the required consent to understand website usage and improve the site.
May be enabled after the required consent to measure advertising and configured advertising events.
Rejecting optional cookies does not block the core content of the website. We do not intend to send contact-form content, full email addresses or phone numbers to Google Analytics or Meta.
Service providers and data transfers
We do not sell or rent personal data. Where necessary, data may be shared with infrastructure and service providers, contractors and professional advisers who need the information for a specific task.
- Zone Media OÜ — hosting, server infrastructure and email.
- Google and Meta — only for the relevant functions and where required consent has been obtained.
- Stripe — where Stripe is used to process payment for a specific service; full card numbers and CVC codes are processed by the payment provider, not FLET-AGENCY.
- Contractors, accountants and advisers — to the extent required to provide the service and subject to appropriate confidentiality obligations.
If a provider processes data outside the European Economic Area, we rely on a transfer mechanism permitted by the GDPR, such as an adequacy decision or Standard Contractual Clauses. The EU-U.S. Data Privacy Framework is relied upon only where the recipient actually participates in it.
When we work with data in your project
When developing or supporting a website, store, CRM, client portal or other system, the client may give us technical access to data relating to its users. In that situation, the client is usually the controller and FLET-AGENCY acts as a processor.
We use such data only on the client’s documented instructions and to the extent necessary for the agreed work. Where the GDPR requires a data processing agreement, the parties enter into the appropriate agreement.
How long we keep data and how we protect it
We use reasonable technical and organisational measures, including HTTPS, access controls, updates, backups, secure transfer of credentials and removal of unnecessary permissions. No system can be guaranteed to be absolutely secure.
Your rights
Depending on the circumstances, the GDPR may give you rights to access, correction, erasure, restriction of processing, data portability, objection and withdrawal of consent. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Write to contact@flet-agency.com. We may ask you to verify your identity. We normally respond within one month; where permitted by the GDPR, this period may be extended and you will be informed.
If you believe your rights have been infringed, you may lodge a complaint with a supervisory authority. In Estonia, this is Andmekaitse Inspektsioon.
Policy updates
We may update this Policy when our services, providers, technologies or legal requirements change. The current version and update date will always be published on this page. If new processing requires separate consent, we will request it separately.
Our services are primarily intended for businesses and adult customers. The website is not designed to knowingly collect data from children.