Privacy Policy

1. Overview & controller

BlackForest Timberworks ("we", "us", "our", "the agency") provides marketing, branding, and strategic communication services for the timber, woodworking, and forestry industries. This Privacy Policy explains how we collect, use, disclose, and protect your information when you interact with our website, engage our services, or communicate with our team. We comply with the EU General Data Protection Regulation (GDPR), the Estonian Personal Data Protection Act, and applicable international frameworks.

2. Information we collect

2.1 Personal data you provide

• Identity & contact details: name, email address, phone number, job title, company name, business address.
• Business & project data: information shared via contact forms, proposals, or during consultations regarding timber marketing, sawmill branding, export strategies, or sustainability communications.
• Billing information: necessary for invoicing and service agreements (processed via secure third-party gateways).

2.2 Automatically collected data

• Technical data: IP address, browser type, device identifiers, referring URLs, pages visited, timestamp — collected via cookies and analytics tools (anonymised where possible).
• Correspondence records: emails and messages exchanged with our team for service delivery and security.

3. How we use your information

We process personal data only on valid legal grounds (GDPR Article 6). Purposes include:

• To respond to inquiries and deliver marketing, branding, and strategic services for timber businesses.
• To manage client relationships, proposals, contracts, and campaign execution.
• To enhance website functionality and personalize user experience.
• To send industry insights, forestry market updates, or service announcements (only with explicit consent, which you may withdraw at any time).
• To comply with legal obligations (tax, regulatory requests, anti-fraud measures).

4. Legal basis for processing (GDPR)

• Contractual necessity: To perform agreements with clients and business partners.
• Legitimate interests: To operate, improve, and secure our services (analytics, fraud prevention, direct marketing to existing business contacts).
• Consent: For non-essential cookies, newsletters, and optional data sharing.
• Legal obligation: Compliance with Estonian and EU laws (e.g., record-keeping, tax regulations).

5. Data sharing & third parties

We never sell or rent personal data. Information may be shared with:

• Service providers: IT hosting, analytics (privacy-friendly), CRM platforms, email delivery services — all under strict data processing agreements.
• Industry partners: Forestry media, trade platforms, subcontractors only when necessary for campaign delivery and under confidentiality obligations.
• Authorities: If required by law, court order, or to protect our legal rights.

All third parties operate within the EEA or provide equivalent GDPR safeguards (Standard Contractual Clauses).

6. International data transfers

Your information is primarily stored within the European Economic Area (EEA). Should any transfer to non-EEA countries occur (e.g., for global timber trade partnerships), we implement appropriate safeguards such as EU Standard Contractual Clauses or adequacy decisions to ensure your data remains protected.

7. Data security & retention

We employ industry-standard security measures: encryption, access controls, firewalls, and regular audits. Retention periods are determined by purpose:

After retention expiry, data is securely deleted or irreversibly anonymised.

8. Your privacy rights

Under GDPR and Estonian law, you have the following rights regarding your personal data:

• Right to access: Obtain confirmation and a copy of your data.
• Right to rectification: Correct inaccurate or incomplete information.
• Right to erasure ("right to be forgotten"): Request deletion under certain conditions.
• Right to restrict processing: Limit how we use your data.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent: For any processing based on consent (e.g., newsletters).

To exercise these rights, email privacy@blackforest.ee. We will respond within 30 days. If unsatisfied, you may lodge a complaint with the Estonian Data Protection Inspectorate (AKI) — www.aki.ee.

9. Cookies & tracking technologies

Our website uses essential cookies (functional) and analytical cookies to improve experience and security. You can manage cookie preferences via browser settings. We do not deploy intrusive advertising cookies without prior consent.

10. Confidentiality & timber industry data

As a marketing agency serving the timber and forestry sector, we treat all business information — including supply chain details, pricing strategies, and trade relationships — with the highest level of discretion. We do not disclose sensitive commercial data to third parties without explicit client authorization.

11. Children's privacy

Our services are directed toward timber industry professionals, forestry businesses, and B2B clients. We do not knowingly collect data from individuals under 18 years of age.

12. Changes to this policy

We may update this Privacy Policy to reflect legal or operational changes. Material revisions will be communicated via website notice or direct email. The "Last updated" date at the top indicates the latest version. We encourage periodic review.

13. Contact information

For any privacy-related inquiries, data requests, or concerns:

• Email: privacy@blackforest.ee
• Phone: +372 5349 6337
• Postal: BlackForest Timberworks, Väike-Põllu tn 1, 86705 Tori vald, Estonia
• Contact person: Cavrana Algerina (Data Protection Officer)

We are committed to resolving any privacy concerns transparently and in full compliance with GDPR standards.