Privacy Policy

1. Who we are

Boolanga is the trading name of Delivery Tech OÜ, a private limited company incorporated under the laws of Estonia (registry code 14927551), with its registered office at Harju maakond, Järvevana tee 9, 11314, Tallinn, Estonia. In this Policy we refer to ourselves as “Boolanga”, “we”, “us”, or “our”.

For the personal data described in this Policy, Boolanga acts as the data controller within the meaning of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).

2. Scope of this policy

This Policy applies when you:

• visit boolanga.com or any subdomain we operate;
• contact us, request a proposal, or enter into a contract with us in your professional capacity;
• receive communications from us, including newsletters or marketing emails;
• attend events we host or co-host.

This Policy does not apply to personal data we process on behalf of our business clients (for example, employee names and shipping addresses provided by a client to fulfil an order). For that data we act as a data processor, and the processing is governed by a separate Data Processing Agreement (DPA) with the relevant client. A copy of our standard DPA is available on request from the contact in section 11.

This Policy also does not apply to third-party websites you may reach through links we provide; those sites have their own privacy practices.

3. Personal data we collect

3.1 Data you provide

When you contact us, request information, or enter into a business relationship with us, we may collect:

• Identification data: first and last name, professional title, employer.
• Contact data: business email address, business phone number, mailing or office address.
• Communication content: the messages, requests, and documents you send us.
• Commercial information needed to assess and deliver our services to your organisation.

3.2 Data we collect automatically

When you visit our website, we may automatically receive limited technical data such as IP address (truncated where feasible), browser type and version, operating system, language preference, referring URL, and timestamps. This data is collected through standard server logs and, where applicable, cookies. See our Cookie Policy for details on the cookies we use.

3.3 Data from third parties

We may receive your professional contact details from publicly available business sources (such as a company website or LinkedIn profile) where you have made them available for business outreach, or from a colleague who refers us to you. Where we have collected data this way and you would prefer we did not, please contact us using the details in section 11 and we will remove your data promptly.

4. Why we process your data

We process personal data for the following purposes:

• Responding to enquiries — to handle your contact form submission, email, or call and follow up appropriately.
• Providing our services — to negotiate, conclude, and perform contracts with our business clients, and to manage the relationship with the client’s representatives.
• Communications and marketing — to send you information about our services, industry insights, events, or product updates, where you have given consent or where we have a legitimate interest in B2B communications and you have not objected.
• Improvement of our services and website — to analyse aggregated usage patterns and improve site usability.
• Compliance and protection — to comply with applicable law (including tax, accounting, and anti-money-laundering obligations), protect our rights, and prevent fraud or misuse.

5. Legal bases under GDPR

We rely on the following lawful bases under Article 6 GDPR:

• Contract (Art. 6(1)(b)) — where processing is necessary to enter into or perform a contract with you or your organisation.
• Legitimate interests (Art. 6(1)(f)) — for B2B outreach to business contacts, securing our infrastructure, debugging and improving our services, and protecting our rights. We balance these interests against your rights and freedoms; you can object at any time (see section 9).
• Consent (Art. 6(1)(a)) — for non-essential cookies, marketing emails to non-customers, and any other processing where we explicitly ask for your consent. You may withdraw your consent at any time.
• Legal obligation (Art. 6(1)(c)) — to comply with Estonian and EU law, for example record-keeping for tax or accounting purposes.

We do not carry out automated decision-making producing legal effects, nor profiling within the meaning of Article 22 GDPR.

6. Sharing and recipients

We share personal data only as needed to operate our business. Categories of recipients include:

• Service providers acting on our instructions as data processors — for example, our hosting and cloud-storage providers, email service provider, CRM, helpdesk software, accounting software, applicant tracking system (GoHire), and meeting scheduling tools. We bind each processor by a written contract that meets the requirements of Article 28 GDPR.
• Professional advisors — lawyers, accountants, auditors — under duties of confidentiality.
• Authorities — public bodies, regulators, or courts, where we are legally required to disclose data, or where disclosure is necessary to establish, exercise, or defend legal claims.
• Successors — in connection with a merger, acquisition, reorganisation, or sale of assets, in which case we will require the recipient to honour this Policy or notify you in advance of any material change.

We do not sell personal data, and we do not share personal data with third parties for their own marketing purposes.

7. International transfers

Where possible we keep personal data within the European Economic Area (“EEA”). Some of our service providers operate from countries outside the EEA. When we transfer personal data outside the EEA, we rely on:

• an adequacy decision issued by the European Commission for the recipient country; or
• Standard Contractual Clauses approved by the European Commission, supplemented by additional safeguards where necessary in light of Schrems II.

You can request a copy of the safeguards we have in place by contacting us using the details in section 11.

8. Retention periods

We retain personal data only for as long as necessary for the purposes set out above and to comply with our legal and accounting obligations. Indicative retention periods are:

When we no longer need your data, we will delete it or anonymise it so that it can no longer be associated with you.

9. Your rights

Under the GDPR, you have the following rights with respect to your personal data:

• Access (Art. 15) — obtain confirmation of whether we are processing your data and a copy of it.
• Rectification (Art. 16) — have inaccurate or incomplete data corrected.
• Erasure (Art. 17) — have your data deleted, subject to certain exceptions (for example, where retention is required by law).
• Restriction of processing (Art. 18) — ask us to limit how we use your data in specific circumstances.
• Portability (Art. 20) — receive your data in a structured, machine-readable format and transmit it to another controller, where the processing is based on consent or contract and is carried out by automated means.
• Object (Art. 21) — object to processing based on our legitimate interests, including direct marketing. For direct marketing, we will stop processing immediately on receipt of your objection.
• Withdraw consent — where processing is based on your consent, you can withdraw it at any time; this does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us using the details in section 11. We may need to verify your identity before responding. We will reply within one month of receipt; this period may be extended by two further months for complex or numerous requests, in which case we will inform you within the first month.

10. Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Measures include encryption of data in transit (TLS/HTTPS), access controls and authentication, regular backups, vendor due-diligence, and staff training on data protection.

Our security programme is led by Helmi Aouali, IT, Automation & Security Manager, who is responsible for vulnerability management, security testing and incident response across Boolanga's systems. To report a security issue, email [email protected] (see also security.txt).

If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority in accordance with Articles 33 and 34 GDPR.

11. Contact and complaints

For any question about this Policy, to exercise your rights, or to request our standard Data Processing Agreement, please contact:

• Email: [email protected]
• Postal address: Delivery Tech OÜ — Privacy, Harju maakond, Järvevana tee 9, 11314, Tallinn, Estonia

If you are not satisfied with our response, you have the right to lodge a complaint with a data protection supervisory authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI):

• Web: www.aki.ee
• Email: [email protected]
• Address: Tatari 39, 10134 Tallinn, Estonia

If you reside in another EEA country, you may also complain to your local data protection authority. A list is available at edpb.europa.eu.

12. Changes to this policy

We may update this Policy from time to time to reflect changes in our practices, our services, or applicable law. The “Last updated” date at the top of this page indicates when the Policy was last revised. For material changes, we will provide additional notice (for example, by a banner on our website or by email where we have your contact details).