Legal

Privacy notice

Version 1.2, 19.10.2026

1. Who we are

Controller: Ampron OÜ, registry code 12357173, VAT EE101625180

Läike tee 34, Peetri, Rae vald, 75312 Harju maakond, Estonia

Data protection contact: [email protected]

We have not appointed a Data Protection Officer, because the law does not require one for a company of our size and activity. Send any data protection question to the address above.

2. What personal data we process and why

2.1 Website visitors and enquiries

If you email us, use the contact form or the product configurator, or send an enquiry list from our online store, we process your name, email address, company and message so we can answer you. With the enquiry we also receive the page you first landed on, the website that referred you (domain only) and any campaign tags in the link you followed. The store takes no payments.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in answering business enquiries and knowing which channels bring them.

2.2 Customers and prospective customers who contact us

If you are a contact person at a customer, or at a company that asks us for a quote, we process your name, job title, company, email address, telephone number, our correspondence, quotations, orders and invoices.

Purpose: running the business relationship, delivering contracts, support and service.

Legal basis: Art. 6(1)(b), contract or steps before a contract; Art. 6(1)(f), our legitimate interest in keeping an accurate record of the relationship.

Retention: invoices and accounting records, 7 years (Estonian Accounting Act); correspondence and customer records, for the relationship plus 3 years.

2.3 Sales outreach (if we wrote to you first)

We sometimes email people at companies that may need industrial displays, for example passenger-information systems in transport. If we wrote to you without your asking:

• What we hold: your name, work email address, company and role, where we found your address, and our messages to you.
• Where we got it: from public business sources: your company's website; public-sector and transport data portals; public procurement notices and tender documents; public business registers and published grant-recipient lists; trade-fair exhibitor lists and conference programmes; press releases and annual reports; and professional networking profiles such as LinkedIn, for your name and role. Where only your name and role are public, we may write to a work address in your company's standard format (for example firstname.lastname@company). We also use our own records of past correspondence with your company. Our first email tells you the specific source.
• Why: to offer products relevant to your role. We write to named people only when their role relates to our products. Otherwise we use the company's general address.
• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in B2B marketing, within § 103¹ of the Estonian Electronic Communications Act.
• Retention: if you don't reply, we delete your outreach record 12 months after our last message.
• Your right to object: you can tell us to stop at any time, free of charge. Reply "stop" or write to [email protected]. We then stop all marketing email to you, from every person and system at Ampron. We keep only your email address, company, the date and the message in which you objected, on our do-not-contact list. We keep that list without a time limit, because that is the only way to make sure you are never contacted for marketing again. Order, delivery and service emails are not marketing and are not affected.

2.4 Suppliers and subcontractors

We process the names, emails, telephone numbers and companies of contact people at our suppliers, for purchasing, contract management and payments.

Legal basis: Art. 6(1)(b) and Art. 6(1)(f).

Retention: 7 years.

2.5 Users of our remote management system (RMS)

If you are an authorised user of Ampron's remote display management system, we process your login identifier, access logs, sessions and configuration activity, to run the service, give support and audit access.

Legal basis: Art. 6(1)(b).

Retention: we are introducing automatic deletion after 12 months. Until that is in place, these records are kept and not yet deleted automatically. You can ask us to delete yours at any time (see §5).

2.6 Video surveillance at our premises

We operate cameras at Läike tee 34, Peetri: in production and storage areas, at the entrances, and at the gate and yard. There are no cameras in the rest room, changing room or toilets. We do not record audio and use no hidden cameras.

• Purposes: security of premises and property (theft, intrusion, damage; gate control and courier checks); the status of goods (stock, incoming goods, readiness of shipments: objects, never people's work rate, presence or behaviour); and occupational safety, meaning the review of a specific accident or dangerous situation.
• Legal basis: Art. 6(1)(f), our legitimate interest. We have documented a legitimate interest assessment and a data protection impact assessment. Write to us to see them.
• Retention: recordings are overwritten automatically after 30 days. An extract relating to a specific incident is kept until that incident is closed.
• Who sees it: a small number of authorised Ampron managers. An Ampron AI agent reviews individual still images, not video, for the purposes above. It describes objects only, does not identify people, and the images are not stored.
• Signs at the entrances give the short version of this information.

2.7 AI agents

Ampron uses AI agents for parts of its administration, sales correspondence and production management. An email from Ampron may have been written by an AI agent, and when it was, the email says so. The agents process the personal data described in this notice for the same purposes and on the same legal bases. The AI service is provided by our processor Anthropic (see §3 and §4); under our contract with Anthropic, our data is not used to train its models. We make no decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22).

2.8 Website: cookies and browser storage

An ordinary visit to ampron.eu sets no cookies, and we use no advertising or cross-site tracking.

• Cookies we set only when you act: ampron_session, when you log in (strictly necessary, 30 days); memos_theme, when you pick the light or dark theme (1 year, holds only "light" or "dark").
• Storage on your own device (localStorage): your store enquiry list; your product-configurator answers, including the contact details you type into the form, so a half-finished enquiry survives a page reload; the display-fit tool's dimensions; game high scores; your theme choice. This stays in your browser. We receive it only if you send an enquiry. You can clear it in your browser settings at any time.
• Storage until you close the tab (sessionStorage): the page you landed on, the referring website (domain only) and any campaign tags, which are attached to an enquiry if you send one; and which homepage image you were shown.
• Analytics: we count page views with Umami, which we host on our own server. It sets no cookies and assigns no identifier that follows you across sites. Results are aggregated.
• Security: our website runs behind Cloudflare, which protects it against attacks and runs the Turnstile anti-bot check on our forms. To do this Cloudflare processes your IP address and technical browser data, and may set a short-lived security cookie (__cf_bm).
• Legal basis: storage that is strictly necessary, or that you trigger yourself, needs no consent under the rules on storing information on your device (Art. 5(3) of the ePrivacy Directive, as implemented in the Estonian Electronic Communications Act). Analytics and security: Art. 6(1)(f), our legitimate interest in a secure, working website.

3. Who we share data with

We do not sell or rent personal data. We use these processors:

We also disclose personal data when the law requires it, for example to the Tax and Customs Board (EMTA), the Labour Inspectorate or law enforcement.

4. Transfers outside the EU/EEA

Anthropic processes data on infrastructure in the United States. That transfer is covered by the EU Standard Contractual Clauses (Commission Decision 2021/914) included in Anthropic's data processing addendum. Atlassian's and Cloudflare's data processing addenda also include the Standard Contractual Clauses for any transfer outside the EEA. We make no other routine transfers outside the EU/EEA. If you are a supplier contact outside the EU/EEA, write to us for details of your case.

5. Your rights

You have the right to:

• access the data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have data erased when there is no longer a legal ground to keep it (Art. 17). Some records, such as accounting records, must be kept by law;
• restrict processing while a dispute is resolved (Art. 18);
• object to processing based on our legitimate interest (Art. 21). An objection to direct marketing is always honoured;
• data portability, where processing is based on contract or consent and is automated (Art. 20).

Write to [email protected]. We reply within one month and do not charge, unless a request is manifestly unfounded or excessive.

6. Complaints

You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, [email protected], www.aki.ee.

7. Changes

We update this notice when our processing changes materially. The version date at the top shows the latest revision.