Privacy policy

1. Summary

• We are a business-to-business digital agency. Most personal data we process belongs to people who contact us or who work at the companies we work with.
• Our website sets no cookies or trackers without your consent. Two small settings (your colour theme and your cookie choice) are kept in your browser's local storage because the site needs them to work.
• Optional page statistics are collected only if you say yes in the cookie dialog, and you can change your answer at any time from Cookie settings in the footer.
• We do not sell personal data and we do not use it for advertising profiles. We do not use the Meta Pixel, Google Ads tags or similar advertising tools on wiotly.com. If that ever changes, we will ask for your consent first and update this policy.
• Some services we rely on (Google, DigitalOcean, Meta, LinkedIn) are based in or owned from the United States. Transfers are covered by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses (see section 8).
• You can ask us at any time what data we hold about you, to correct or delete it, or to stop a particular use. Instructions are in section 10 and section 11.
• Our software products have their own privacy policies, for example the Photoclarus privacy policy. This policy covers everything else.

2. Who is responsible

Wiotly OÜ, a private limited company registered in Estonia (registry code 14201535), is the data controller for the processing described in this policy. We have not appointed a data protection officer because we are not required to; questions and requests go to contact@wiotly.com and are handled by the company's management.

For our Facebook, Instagram and LinkedIn pages, Wiotly and the platform operator are joint controllers for the audience statistics those platforms produce ("Page Insights"). See section 6.

3. Visiting wiotly.com

3.1 Server logs

When you open a page, our web server records the IP address of your device, the date and time, the page requested, the referring page, and your browser and operating system. We use these logs to keep the site running, to detect abuse and to fix errors. Legal basis: our legitimate interest in operating a secure website (GDPR Art. 6(1)(f)). Logs are deleted or anonymised after 30 days unless they are needed to investigate a security incident. The site is hosted by DigitalOcean, LLC (see section 7).

3.2 Cookies and local storage

wiotly.com does not set cookies. It stores the following items in your browser's local storage, which stay on your device and are not sent to us:

Essential items are stored on the basis of the ePrivacy exemption for storage that is strictly necessary to provide a service you asked for; no consent is needed. Optional analytics are loaded only after you choose "Yes, remember me" in the cookie dialog (consent, GDPR Art. 6(1)(a) and the Estonian Electronic Communications Act § 102¹). They give us anonymous statistics about which pages are visited and how visitors move through the site, and are never used for advertising. You can withdraw consent at any time by opening Cookie settings in the footer and choosing "Essentials only". Withdrawing does not affect the lawfulness of processing before withdrawal. Where we use an analytics tool, it is named in section 7.

3.3 Web fonts

Our pages load the typefaces Unbounded and Instrument Sans from Google Fonts. When a page loads, your browser requests the font files from Google's servers, which means Google LLC receives your IP address and browser details. Legal basis: our legitimate interest in a consistent, fast-loading site (Art. 6(1)(f)). Google's handling of this request is described in Google's privacy policy.

3.4 Booking a meeting

The "Book a meeting" buttons open Google Calendar appointment scheduling. When you book, Google processes the name, email address and any note you enter, together with the time you choose, and places the appointment in our Google Workspace calendar. We use that information to hold the meeting and to follow up on it. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b)) and our legitimate interest in responding to enquiries (Art. 6(1)(f)). Google acts as our processor for Google Workspace; the scheduling page itself is governed by Google's privacy policy.

3.5 Website chat

The chat bubble on our pages is provided by Typebot. It is an automated assistant that follows a scripted conversation and may, in some steps, use an AI language model to phrase answers; we tell you in the conversation when you are talking to an automated system rather than a person, as required by the EU Artificial Intelligence Act. The chat processes the messages you type and any contact details you choose to give (typically name, company, email address and what you need help with). Typebot stores conversations on our behalf on servers in the European Union, and we receive the contact details so that a person can follow up. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b)) and our legitimate interest in answering enquiries (Art. 6(1)(f)). Please do not enter sensitive information (such as health, financial or identity-document details) in the chat. Conversations are deleted from the chat tool within 12 months; contact details that lead to a sales conversation are kept as described in section 5.

3.6 Embedded content and links

Our Showcase and other pages may show images and content hosted by us. Where we link to other websites, including customer sites and social media platforms, their own privacy policies apply once you leave wiotly.com.

4. Contacting us

If you email, call or message us, we process your name, contact details, the content of your message and any attachments, so that we can answer you. Legal basis: steps taken at your request (Art. 6(1)(b)) or our legitimate interest in handling enquiries (Art. 6(1)(f)). We keep general correspondence for up to 24 months after the last exchange. Correspondence that is part of a customer relationship is kept as described in section 5.

If you are an existing customer and write to support@wiotly.com, your request is handled under the contract we have with your company (Art. 6(1)(b)) and kept for the duration of the contract plus the retention period in section 9.

5. Customers, prospects, partners and suppliers

When your company asks us for a proposal, becomes a customer, or works with us as a partner or supplier, we process the business contact data of the people involved: name, job title, employer, work email, phone number, communication history, meeting notes, contracts, project documentation, and billing and payment information. We use it to prepare offers, deliver and manage projects, provide support, invoice, keep accounts and comply with our legal obligations.

Legal bases: performance of a contract or pre-contractual steps (Art. 6(1)(b)); legal obligations, in particular the Estonian Accounting Act and tax law (Art. 6(1)(c)); and our legitimate interest in managing our business relationships and defending our legal rights (Art. 6(1)(f)). Where the contact person is not themselves our contracting party, we rely on our legitimate interest in communicating with our customer's staff.

During a project we may also process personal data that belongs to your customers or users, for example when we build or maintain your website, shop or integrations. In that case your company is the controller and Wiotly is the processor, acting under a data processing agreement that is part of our contract. We process that data only on your documented instructions.

5.1 Marketing communications

We send newsletters, event invitations or product news by email only if you have given consent (Art. 6(1)(a)) or if you are an existing customer and the message concerns services similar to the ones you bought, in which case we rely on our legitimate interest and the "soft opt-in" permitted by the ePrivacy rules (Art. 6(1)(f)). Every message contains an unsubscribe link, and you can also opt out by emailing us. We do not buy contact lists and we do not send unsolicited marketing to people who have never been in contact with us.

6. Social media and Meta

6.1 Our pages on Facebook, Instagram and LinkedIn

We run pages on Facebook and Instagram (operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) and on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). When you visit, follow, like, comment on or message these pages, the platform processes your data under its own policy: Meta Privacy Policy, LinkedIn Privacy Policy.

The platforms give us aggregated statistics about our audience ("Page Insights"), such as the number of visitors, reactions, and the age range, gender, country and language distribution of followers. For this processing Wiotly and the platform are joint controllers under GDPR Art. 26. The division of responsibilities is set out in Meta's Page Insights Controller Addendum and LinkedIn's Page Insights Joint Controller Addendum. Under those agreements the platform is responsible for the technical processing and for answering data-subject requests about Insights; you can also contact us and we will forward your request. We only ever see Insights in aggregated form and cannot identify you from them. Legal basis: our legitimate interest in understanding and improving our communication (Art. 6(1)(f)).

If you send us a direct message or comment, we process your public profile name and the content of the message to reply. We do not export follower lists or combine social-media data with other data about you.

6.2 Advertising on Meta, LinkedIn and Google

We may run paid campaigns on these platforms. Targeting uses the platforms' own audience categories (for example location, language, industry or job function), not data uploaded by us. We do not upload customer lists to build "Custom Audiences" or "Matched Audiences", and we do not use the Meta Pixel, Meta Conversions API, Google Ads conversion tags or LinkedIn Insight Tag on wiotly.com. If we start using any of these tools in future, they will be loaded only with your prior consent through the cookie dialog, and this policy will name them.

6.3 Meta platform requirements

If we offer a service that uses Meta's platform (for example Facebook Login, a Messenger or WhatsApp Business integration, or an Instagram integration for a customer project), we comply with the Meta Platform Terms and Developer Policies. In that case we process only the data you authorise through Meta's permission screen, use it only for the purpose described there, do not sell it or use it for advertising or credit decisions, keep it secure, and delete it when you ask or when it is no longer needed. Instructions for requesting deletion of any data we hold about you, including data obtained through Meta, are in section 11.

7. Who receives your data

We share personal data only with the service providers (processors) we need to run our business, with joint controllers as described in section 6, and with authorities when the law requires it. Our processors work under written data processing agreements and may use the data only on our instructions.

We may also disclose data to professional advisers (lawyers, auditors), to a buyer or successor in the event of a merger or sale of the business, and to courts, police or supervisory authorities where we are legally obliged to or where it is necessary to establish, exercise or defend legal claims.

8. Transfers outside the EU/EEA

Wiotly is based in Estonia and keeps its own data in the European Union. Some of our providers are headquartered in the United States or may access data from there. For such transfers we rely on one of the following safeguards under GDPR Chapter V: the European Commission's adequacy decision for the EU–US Data Privacy Framework, where the provider is certified; the Commission's Standard Contractual Clauses (2021/914) together with a transfer impact assessment; or, in rare cases, one of the derogations in Art. 49 (for example your explicit consent or the performance of a contract with you). You can ask us for a copy of the safeguards in place by emailing contact@wiotly.com.

9. How long we keep data

When a retention period ends, we delete the data or anonymise it so that it can no longer be linked to you.

10. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy (Art. 15).
• Rectify inaccurate or incomplete data (Art. 16).
• Erase your data where there is no longer a legal reason to keep it (Art. 17).
• Restrict processing in certain situations, for example while a dispute about accuracy is resolved (Art. 18).
• Data portability: receive data you gave us in a machine-readable format where processing is based on consent or contract (Art. 20).
• Object to processing based on our legitimate interests, and at any time to direct marketing (Art. 21). If you object to direct marketing we will stop immediately.
• Withdraw consent at any time where processing is based on consent, without affecting processing before the withdrawal (Art. 7(3)).
• Not be subject to automated decisions with legal or similarly significant effects (Art. 22). We do not make such decisions.
• Lodge a complaint with a supervisory authority, in particular the Estonian Data Protection Inspectorate (aki.ee, info@aki.ee) or the authority in the EU country where you live or work.

To exercise any of these rights, email contact@wiotly.com with "Privacy request" in the subject line. We reply within one month; if a request is complex we may extend this by up to two further months and will tell you why. We may ask you to confirm your identity before releasing data. Requests are free of charge unless they are manifestly unfounded or excessive.

11. How to request deletion of your data

You can ask us to delete the personal data we hold about you, including any data obtained through a Meta, LinkedIn or Google service, as follows:

1. Send an email to contact@wiotly.com with the subject "Data deletion request".
2. Tell us which email address, name, company or social-media account the data relates to, so that we can find it.
3. We confirm receipt within 5 working days and complete the deletion within 30 days, unless the law requires us to keep certain records (for example invoices under accounting law), in which case we tell you what is kept and why.
4. You receive a written confirmation when the deletion is complete.

For data stored in your own browser (theme and cookie choice), clear your browser's site data for wiotly.com or use Cookie settings in the footer. For data held by Meta, LinkedIn or Google themselves, use the deletion tools in your account on that platform.

12. Security

We protect personal data with technical and organisational measures appropriate to the risk: encrypted connections (HTTPS) to all our services, access limited to the people who need it, two-factor authentication on our accounts, separate development and production environments, regular software updates and backups, and written processor agreements. If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Data Protection Inspectorate within 72 hours and inform you without undue delay, as required by GDPR Art. 33 and 34.

13. Children

Our website and services are directed at businesses and are not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

14. Job applicants

If you apply to work with us, we process the information in your application (CV, cover letter, portfolio, contact details, interview notes and any references you ask us to contact) to assess your application and communicate with you. Legal basis: steps taken at your request before entering into an employment contract (Art. 6(1)(b)) and our legitimate interest in recruiting (Art. 6(1)(f)). We delete applications once the position is filled, unless you agree that we keep your details for up to 12 months for future openings.

15. Changes to this policy

We update this policy when our services, providers or the law change. The effective date at the top shows the current version. If a change materially affects how we use your data, we will draw attention to it on wiotly.com and, where we have your contact details and the change concerns you, by email.

16. Contact

Wiotly OÜ
Registry code 14201535
Tallinn, Estonia
Email: contact@wiotly.com
Web: wiotly.com

Effective 13 October 2026. Wiotly OÜ, registry code 14201535, VAT ID EE102245064, Tallinn, Estonia.