Last updated 1 September 2026
Privacy Policy
In short
- We collect only what the two forms on this site ask for, and each field is listed below with the reason for it.
- No consent is asked for or relied on for either form. There is no tick-box.
- Everything is stored on a server operated by Hostinger International Limited in Vilnius, Lithuania — inside the European Economic Area. No transfer outside the EEA takes place.
- No analytics, no advertising tag, no CDN, no third-party fonts, no chat widget. Nothing third-party runs on this site.
- Enquiry records are deleted after 24 months. Server access logs are deleted after 14 days.
1. Who is responsible for your data
The controller is 303 Team OÜ, a private limited company registered in Estonia under registry code 14359294, EU VAT EE102945487, at Laki tn 25-411, 12915 Tallinn, Mustamäe linnaosa, Harju maakond, Estonia.
For anything in this policy, write to help@303teamou.com. The company has not appointed a data protection officer, as it is not required to under Article 37 GDPR; enquiries go to the address above and are handled by the management board.
2. What we collect, and why — the project and consultation form
Every field on that form appears in the table below. Nothing else about you is recorded with the submission.
| Field | Required? | Why it is collected | Lawful basis |
|---|---|---|---|
| Organisation | Required | Identifies the organisation the enquiry is made on behalf of. This site serves business clients, so we need to know which organisation we would be contracting with. | 6(1)(b) |
| Your name | Required | So a reply is addressed to the right person. | 6(1)(b) |
| Work email address | Required | The only channel we use to reply. Without it the enquiry cannot be answered at all. | 6(1)(b) |
| Type of engagement | Required | Determines which of our services the enquiry concerns and whether we are able to take it on. | 6(1)(b) |
| What you want built, reviewed or changed | Required | The substance of the enquiry. Without a description of the work there is nothing to respond to. | 6(1)(b) |
| Indicative budget band | Optional | Optional. Leaving it blank changes nothing about how the enquiry is handled, and you may object at any time to our processing it under Article 21. Legitimate interest: Our interest in judging early whether the scope described and the budget available are compatible, so that neither side spends time on an engagement that cannot proceed. | 6(1)(f) |
Retention. Enquiry records are kept for 24 months from submission and then deleted. If an engagement follows, the record becomes part of the contract file and is kept for as long as Estonian accounting and limitation rules require.
3. What we collect, and why — the general contact form
| Field | Required? | Why it is collected | Lawful basis |
|---|---|---|---|
| Your name | Required | So a reply is addressed to the right person. Legitimate interest: Our interest in answering correspondence addressed to us, from businesses and individuals alike. | 6(1)(f) |
| Email address | Required | The only channel we use to reply. Legitimate interest: Our interest in answering correspondence addressed to us, from businesses and individuals alike. | 6(1)(f) |
| Subject | Required | Routes the message to the right person. Legitimate interest: Our interest in answering correspondence addressed to us, from businesses and individuals alike. | 6(1)(f) |
| Message | Required | The substance of the message. Legitimate interest: Our interest in answering correspondence addressed to us, from businesses and individuals alike. | 6(1)(f) |
Retention. Messages are kept for 24 months from receipt and then deleted.
4. Recorded automatically with a submission
| Field | Required? | Why it is collected | Lawful basis |
|---|---|---|---|
| Time of submission | Required | Needed to apply the retention period and to order enquiries. | 6(1)(b) |
| Lawful basis recorded for the row | Required | The Article 6 basis the record rests on, stored with the record so it is auditable later. Legitimate interest: Our interest in being able to demonstrate compliance under Article 5(2). | 6(1)(f) |
| Version of the notice you were shown | Required | Records which wording of this notice was on screen when you submitted. Legitimate interest: Our interest in being able to demonstrate compliance under Article 5(2). | 6(1)(f) |
Your IP address is not stored in the enquiry record. The web server writes it to an access log, kept for 14 days for security and abuse handling, which is a separate record and is not linked to what you submit.
5. Why we do not ask for consent
Answering a business enquiry does not run on consent. Where you ask us about a possible engagement, the required fields are processed under Article 6(1)(b) — steps taken at your request before entering a contract: they are the steps taken at your request before a contract could be entered into. Optional fields, and the general contact form, run on Article 6(1)(f) — legitimate interests, with the interest named beside each field in the tables above.
Consent under Article 6(1)(a) is a separate basis, and consent that you must give in order to submit a form is not freely given within the meaning of Article 7(4). A tick-box demanding it would therefore be both unnecessary and invalid, so there is none, and no field on this site records one. Where a field rests on legitimate interests you have the right to object at any time under Article 21; write to help@303teamou.com and we will stop, unless we can demonstrate compelling legitimate grounds that override your interests.
6. Where your data is processed
This website and its database run on a virtual private server operated by Hostinger International Limited (AS47583) in Vilnius, Lithuania. Lithuania is a member state of the European Union and of the European Economic Area, so no transfer to a third country takes place and no Chapter V safeguard — standard contractual clauses, adequacy decision or derogation — is required for it.
We did not take that location from an IP-address database. Measured from inside the server on 2026-09-01: upstream peering at BALT-IX (Vilnius), round-trip times of 10.1 ms to Stockholm, 10.4 ms to Helsinki, 25.6 ms to Nuremberg, 100.0 ms to Ashburn and 168.4 ms to Singapore, and a RIPE RDAP record showing country LT. The full method is published on the legal identity page, and if the hosting arrangement changes this section will be rewritten before, not after.
Processors
These are the only third parties involved in processing anything you send us. Each acts on our instructions as a processor under Article 28. Note that a disclosure to a processor is still a transfer of data: what we can accurately say is that your data is not disclosed to any third party for that party’s own purposes — not that it never leaves our hands.
- Hostinger International Limited — Hosting and infrastructure provider (virtual private server). Lithuania (EEA). Everything the site stores or serves: submitted enquiry records, server logs and site files, on disk in the provider’s facility.
- Hostinger International Limited — Mailbox provider for the help@303teamou.com address. Lithuania (EEA). Any message you send to help@303teamou.com and its contents.
What is deliberately not used
- No content delivery network — every asset is served from the origin server.
- No analytics or statistics package of any kind.
- No advertising or remarketing tag is active. Microsoft Consent Mode v2 is wired with all consent signals defaulting to denied, and no tag identifier is configured, so nothing third-party loads.
- No web fonts are fetched from a third party; all typefaces are the ones already on your device.
- No customer-relationship, chat, session-recording or A/B-testing service.
- No social network buttons, embeds, pixels or iframes.
- No cookies are set by any third party, because no third-party code runs.
7. What happens to a submission
A submission is written to the database on our server and nothing more. Outbound email from this site is switched off until sender authentication for the domain (SPF, DKIM and DMARC) is fully configured, so submissions are not emailed anywhere — they are read directly from the system. No page on this site claims otherwise; every such sentence is derived from one flag in the code so that the pages cannot contradict each other.
Submissions are not used to build a profile, are not added to a marketing list, are not sold, and are not subject to automated decision-making or profiling within the meaning of Article 22.
8. Cookies and local storage
This site sets no cookies at all — not first-party, not third-party, not analytics, not advertising. The only thing written to your device is a single browser localStorage entry named t303-consent, which records your answer to the storage banner so you are not asked again. That is strictly necessary for a service you have explicitly requested and is exempt from consent under Article 5(3) of the ePrivacy Directive, as transposed in Estonian law.
Microsoft Consent Mode v2 signals are set to denied by default before anything else loads, and are updated only if you choose to allow a category. There is currently no Microsoft Advertising UET tag configured for this domain, so nothing third-party loads in either case. The full detail is on the Cookie Policy page.
9. Server logs
The web server writes an access log containing the requesting IP address, timestamp, requested URL, response status, user agent and referrer. It exists to keep the service running and to deal with abuse — the legitimate interest under Article 6(1)(f) — is kept for 14 days and is then rotated out. It is not joined to anything you submit through a form and is not used to analyse visitor behaviour.
10. Your rights
Under the GDPR you have the right to:
- Access (Article 15) — a copy of the personal data we hold about you.
- Rectification (Article 16) — correction of anything inaccurate.
- Erasure (Article 17) — deletion, where one of the grounds in that Article applies.
- Restriction (Article 18) and portability (Article 20).
- Objection (Article 21) — to any processing that rests on legitimate interests, at any time.
- Not to be subject to automated decision-making (Article 22) — which does not arise here, as none takes place.
Send a request to help@303teamou.com. We will respond within one month of receipt, as Article 12(3) requires, and will tell you if we need to extend that and why. There is no charge for a request unless it is manifestly unfounded or excessive.
If you are not satisfied with how we handle a request you may complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn — aki.ee. You may also complain to the supervisory authority of the EU or EEA state where you live or work.
11. Security
The site is served over HTTPS. The database listens on the server’s loopback interface only and is not reachable from the internet; the firewall additionally blocks its port from outside. Application secrets are held in a file outside the web root, readable only by the account the application runs as. Access to the server is by SSH key; password authentication is disabled.
No system is perfectly secure, and we do not claim this one is. If you find a vulnerability, please tell us at help@303teamou.com before disclosing it publicly, and we will work with you on a fix.
12. Children
This is a business-to-business website. It is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us information, write to us and it will be deleted.
13. Changes to this policy
The version of this notice that was on screen when you submitted a form is recorded with your submission, as notice_version. The current version is 2026-09-01. If we change this policy in a way that affects how existing records are handled, we will say so here and date the change.