1. Who is responsible for your data
tross kkeys OÜ (registry code 17549658), a private limited company registered in the Republic of Estonia, registered address Loosivälja tee 2, Metsakasti küla, Viimsi vald, Harju maakond 74019, Estonia. E‑mail: privacy@trossremote.com. Management board: Timo Tross.
tross kkeys OÜ ("we", "us", "Tross Remote") is the controller of personal data processed through the website trossremote.com (the "Website") and in connection with our marketing and sales activities. We process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR") and the Estonian Personal Data Protection Act (isikuandmete kaitse seadus).
2. Scope of this policy
This policy applies to visitors of the Website, people who contact us or request a call, and representatives of prospective and existing customers. Where we deliver our HomeDesk IT service to a customer and process personal data of that customer's employees on its behalf, we act as a processor. That processing is governed by the Data Processing Agreement concluded with the customer, not by this policy.
3. What personal data we collect
3.1 Data you give us
- Contact and request data — name, company, work e‑mail, approximate number of remote employees and the content of your message when you use the contact form or e‑mail us.
- Business relationship data — contact details of customer representatives, contract and billing information, correspondence and meeting notes.
3.2 Data collected automatically
- Technical log data — IP address, date and time of access, requested pages, referrer, browser and operating system. Our hosting provider (Cloudflare) collects this to deliver the Website securely.
- Cookie and consent data — a first-party cookie that stores your cookie choices. Analytics cookies are only set if you consent. See the Cookie Policy.
We do not collect special categories of personal data through the Website and ask you not to send us any.
4. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Operating, securing and delivering the Website | Technical log data, necessary cookies | Art. 6(1)(f) — legitimate interest in a functioning, secure website |
| Responding to enquiries and call requests | Contact and request data | Art. 6(1)(b) — steps prior to entering a contract; Art. 6(1)(f) — legitimate interest in responding |
| Preparing offers, concluding and performing contracts | Business relationship data | Art. 6(1)(b) — contract performance |
| Accounting, tax and legal obligations | Billing data, contracts | Art. 6(1)(c) — legal obligation (Estonian Accounting Act, Taxation Act) |
| Business-to-business marketing to existing contacts | Contact data | Art. 6(1)(f) — legitimate interest; you may object at any time |
| Website analytics | Pseudonymous usage data | Art. 6(1)(a) — consent (via cookie banner) |
| Establishing, exercising or defending legal claims | Any of the above | Art. 6(1)(f) — legitimate interest |
5. Who receives your data
We share personal data only with service providers that process it on our behalf under written data processing terms, and with authorities where legally required. Our main categories of providers are:
- Hosting and content delivery — Cloudflare, Inc. (EU edge locations; see Section 6).
- Business e‑mail and productivity — Microsoft 365 (EU data boundary).
- Accounting and invoicing — Estonian accounting software and our accountant.
- Professional advisers — lawyers, auditors, insurers, where necessary.
We do not sell personal data and do not share it with third parties for their own marketing.
6. International transfers
We store personal data in the European Union / European Economic Area. Where a provider may access data from outside the EEA (for example global support teams), the transfer is protected by an adequacy decision of the European Commission (including the EU‑US Data Privacy Framework where the provider is certified) or by the Standard Contractual Clauses together with supplementary measures. You may request a copy of the relevant safeguards.
7. How long we keep data
- Enquiries that do not lead to a contract — up to 12 months after our last contact.
- Customer contract data — for the duration of the contract and 3 years thereafter (general limitation period under the Estonian General Part of the Civil Code Act), unless a longer period is required.
- Accounting records — 7 years from the end of the financial year (Estonian Accounting Act § 12).
- Technical logs — up to 30 days, unless needed to investigate a security incident.
- Cookie consent record — 12 months.
8. How we protect data
Security is our business. We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS) and at rest, multi-factor authentication for all staff accounts, least-privilege access, endpoint protection and logging, tested backups and a documented incident response procedure. Where a personal data breach is likely to result in a risk to your rights, we will notify the Estonian Data Protection Inspectorate within 72 hours and, where required, you.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- rectification of inaccurate or incomplete data (Art. 16);
- erasure ("right to be forgotten") in the circumstances set out in Art. 17;
- restriction of processing (Art. 18);
- data portability of data you provided to us (Art. 20);
- object to processing based on legitimate interest, including direct marketing, at any time (Art. 21);
- withdraw consent at any time without affecting prior processing (Art. 7(3)) — for cookies, use "Cookie settings" in the footer.
To exercise your rights, e‑mail privacy@trossremote.com. We respond within one month. We may ask you to verify your identity. You also have the right to lodge a complaint with the supervisory authority: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), Tatari 39, 10134 Tallinn, www.aki.ee, info@aki.ee, or with the authority of your habitual residence.
10. Cookies and similar technologies
The Website uses strictly necessary cookies and, subject to your consent, analytics cookies. Full details, including names, purposes and durations, are in our Cookie Policy.
11. Children
Our services are directed at businesses. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
12. Changes to this policy
We may update this policy to reflect changes in law or in our services. The current version is always published on this page with the date of the last update. Material changes will be highlighted on the Website.
13. Contact
tross kkeys OÜ · Loosivälja tee 2, Metsakasti küla, Viimsi vald, Harju maakond 74019, Estonia · privacy@trossremote.com · info@trossremote.com