PRIVACY POLICY

1. Controller and scope

This Privacy Policy explains how pohjasoft OÜ ("we", "us", "Controller") processes personal data in connection with the E2 Software online stores, customer support, orders, licensing, subscriptions and marketing.

Controller: pohjasoft OÜ; registry code 17479277; VAT ID EE103017929; registered office Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia. Privacy contacts: info@e2software.eu and info@pohjasoft.eu. Websites: e2software.eu, e2software.de, e2software.pl and e2software.fr.

2. Personal data we process

Depending on your interaction with us, we may process identification and contact data (such as name, company, address, e-mail and telephone number if provided); account and authentication data; billing, VAT and transaction data; order and product data; delivery data; Microsoft tenant/domain/administrator information needed to provision CSP or subscription products; support communications and diagnostic information; device, IP address, browser, security and log data; cookie/consent preferences; and marketing preferences.

Where a business customer provides data relating to its employees, administrators or end users, the business customer is responsible for having an appropriate basis to provide that data to us.

3. Purposes and legal bases

We process data to take steps at your request and perform contracts, including processing orders, payments, invoices, digital delivery, tenant provisioning, physical delivery, support, returns and complaints. The legal basis is performance of a contract or pre-contractual steps.

We process accounting, tax, fraud-prevention and other records where necessary to comply with legal obligations.

We may process security logs, prevent abuse and fraud, protect our legal claims, improve service reliability and administer our business on the basis of our legitimate interests, after balancing those interests against your rights.

Where required, we rely on consent for optional cookies, certain analytics/marketing technologies and electronic marketing. Consent may be withdrawn at any time without affecting prior lawful processing.

4. Payments

Payments may be processed through Stripe or by bank transfer. Payment providers may process payment identifiers, transaction details, device/security information and other data under their own privacy terms. We normally receive payment status and transaction information needed to fulfil and account for the order rather than full payment-card credentials.

5. Microsoft, licensing and tenant provisioning

For Microsoft CSP, Microsoft 365 and related products, information necessary to create or manage a tenant, assign licences, verify entitlement or provide support may be shared with Microsoft and relevant authorised distributors/resellers or service providers. The data shared is limited to what is reasonably necessary for the requested product or support activity.

6. Physical delivery and other recipients

For physical products, necessary delivery information may be shared with warehouses, fulfilment partners and carriers. We may also use hosting, cloud, e-mail, accounting, customer-support, security, professional-adviser and IT providers. Recipients receive only data reasonably necessary for their role and act as processors or independent controllers depending on the service and applicable law.

7. International transfers

Some service providers may process personal data outside the European Economic Area. Where GDPR requires safeguards for such transfers, we use an applicable lawful transfer mechanism, such as an adequacy decision, Standard Contractual Clauses, or another mechanism permitted by law. You may contact us for information about applicable safeguards.

8. Retention

We keep personal data only for as long as necessary for the relevant purpose and applicable legal requirements. Order, invoice and accounting records are retained for the period required by applicable tax/accounting law and for establishment, exercise or defence of legal claims. Support and operational records are retained for a proportionate period based on the issue and product lifecycle. Marketing data is retained until consent is withdrawn, an objection is made, or it is no longer needed, subject to limited suppression records needed to respect opt-outs. Security logs and cookie identifiers are retained for limited periods appropriate to their purpose.

9. Marketing and newsletters

If you subscribe to marketing or where another lawful basis permits it, we may send information about E2 Software products, renewals, offers and related services. You can unsubscribe at any time using the link in the message or by contacting us. Withdrawal of marketing consent does not affect transactional messages needed for orders, licences, subscriptions, security or support.

10. Cookies and similar technologies

We use cookies and similar technologies as described in our Cookie Policy. Strictly necessary technologies may be used without consent where permitted by law. Optional analytics, preference or marketing technologies are activated only where the applicable legal requirements, including consent where required, are satisfied.

11. Your data-protection rights

Subject to the GDPR and applicable law, you may have the right to access your personal data; rectify inaccurate data; request erasure; restrict processing; receive certain data in a portable format; object to processing based on legitimate interests; and withdraw consent at any time. Where applicable, you also have rights concerning solely automated decisions that produce legal or similarly significant effects.

Requests can be sent to info@e2software.eu or info@pohjasoft.eu. We may need to verify your identity before acting on a request.

12. Complaints

You have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the EU/EEA country of your habitual residence, place of work or the place of the alleged infringement. As the Controller is established in Estonia, the Estonian Data Protection Inspectorate may also be relevant. We encourage you to contact us first so that we can try to resolve the issue.

13. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. No system can guarantee absolute security; customers should also protect their accounts, credentials, licences and administrator access.

14. Data from other sources

We normally obtain data directly from you or the business you represent. We may also receive relevant data from payment providers, Microsoft/distributors, delivery providers, fraud/security services or public business registers where necessary for an order, compliance, support or fraud prevention.

15. Automated decision-making

We do not intend to make decisions producing legal or similarly significant effects about customers solely by automated processing unless this is necessary and lawful and the required safeguards are provided. Automated tools may nevertheless be used to flag potentially fraudulent or abusive transactions for review.

16. Children

Our products are not specifically directed at children. A person placing an order must have the legal capacity required by applicable law. We do not knowingly seek to collect children's personal data for marketing purposes.

17. Changes and contact

We may update this Privacy Policy to reflect changes in our services, providers or law. The current version will be published on the relevant website with its effective date.

Privacy enquiries: info@e2software.eu / info@pohjasoft.eu. Postal address: Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia.