Privacy Policy

Last updated: 30 July 2026

Data Controller
Scope of This Policy
Personal Data We Collect
Legal Basis for Processing
How We Use Your Data
Who We Share Data With
International Data Transfers
Data Retention
Your Rights Under GDPR
Cookies
Security
Children's Privacy
Changes to This Policy
Contact & Complaints

1. Data Controller

The data controller for personal data processed in connection with the website altosstone.online and our services is:

Altos Stone
Lääne tee 4, 76907 Harju maakond, Estonia
Email: info@altosstone.online

This Privacy Policy explains how Altos Stone ("we", "us", "our") collects, uses, stores, and shares personal data in accordance with the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") and applicable Estonian data protection legislation.

2. Scope of This Policy

This Policy applies to personal data we collect from visitors to the Site, prospective and current clients, suppliers, and anyone who contacts us by email or through the Site. It does not govern the data-handling practices of third-party platforms or tools used in project delivery — those parties act under their own policies, or under separate data processing agreements where required.

3. Personal Data We Collect

Category	Examples	How Collected
Contact data	Name, email address, telephone number, company name, project address	Provided directly by you via email or enquiry
Project data	Dimensions, material specifications, photos, architectural drawings provided for quotation purposes	Provided directly by you in the course of requesting a quote or placing an order
Technical / usage data	IP address, browser type and version, pages visited, referral source, device type	Collected automatically via cookies and server logs when you browse the Site
Communications	Content of emails and messages exchanged with us	Generated when you contact us
Transaction data	Quotation references, order details, invoicing information	Generated during a commercial engagement

We do not collect or process special categories of personal data (such as health data, biometric data, or political opinions) through the Site.

4. Legal Basis for Processing

We rely on the following legal bases under Article 6 GDPR:

Contract — processing necessary to respond to a quotation request and to perform a supply or fabrication contract with you (Article 6(1)(b));
Legitimate interests — operating and improving the Site, responding to business enquiries, and maintaining records, where our interests are not overridden by your rights (Article 6(1)(f));
Consent — for non-essential cookies and similar technologies placed on your device (Article 6(1)(a)); you may withdraw consent at any time;
Legal obligation — where we are required by law to retain or disclose information (Article 6(1)(c)).

5. How We Use Your Data

To respond to enquiries and prepare quotations for engineered stone products;
To manage orders, fabrication, delivery, and invoicing;
To operate, maintain, and improve the Site;
To analyse Site usage in aggregate (where cookies are accepted);
To comply with legal, tax, and regulatory obligations;
To communicate with you about your order or project where necessary.

We do not sell personal data. We may share data with:

IT and hosting providers supporting our website, email, and business systems, acting as processors under our instructions;
Analytics providers, only where you have consented to non-essential cookies;
Logistics and delivery partners, to the extent necessary to deliver products to your site;
Professional advisers (legal, accounting, insurance) where necessary for our business;
Public authorities, where required by applicable law or legal process.

7. International Data Transfers

Altos Stone is based in Estonia, within the European Economic Area (EEA). Where we engage service providers outside the EEA, we ensure appropriate safeguards are in place as required by GDPR, including Standard Contractual Clauses approved by the European Commission, or transfers to countries covered by an adequacy decision.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected. Client and transaction records are typically retained for seven years for accounting and legal purposes. Enquiry correspondence that does not result in a contract is retained for up to two years. Technical usage data from cookies is retained for the periods specified in our Cookie Policy. When data is no longer needed, we securely delete or anonymize it.

9. Your Rights Under GDPR

If you are in the EEA or a jurisdiction that affords similar rights, you have the right to:

Access — request a copy of the personal data we hold about you (Article 15);
Rectification — request correction of inaccurate or incomplete data (Article 16);
Erasure ("right to be forgotten") — request deletion of your data, subject to legal exceptions (Article 17);
Restriction of processing — request that we limit how we use your data in certain circumstances (Article 18);
Data portability — receive a copy of your data in a structured, commonly used, machine-readable format (Article 20);
Object — object to processing based on legitimate interests, including profiling (Article 21);
Withdraw consent — withdraw any previously given consent at any time, without affecting the lawfulness of earlier processing (Article 7(3)).

To exercise any of these rights, or to opt out of non-essential data processing (including cookie-based analytics or advertising), email info@altosstone.online. We will respond within the timeframe required by GDPR (generally one month). You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the supervisory authority in your EU member state.

10. Cookies

The Site uses cookies and similar tracking technologies. Full details — including the categories of cookies used, their purposes, duration, and how to manage your preferences — are set out in our Cookie Policy. You can also manage your cookie preferences at any time by selecting "Cookie Preferences" in the footer.

11. Security

We apply appropriate technical and organizational security measures to protect your personal data against accidental or unauthorized access, loss, alteration, or disclosure. No internet transmission or storage system can guarantee absolute security; if you have reason to believe your interaction with us has been compromised, please contact us immediately.

12. Children's Privacy

The Site and our Services are directed at business and adult consumers. We do not knowingly collect personal data from individuals under the age of 16. If we become aware that a child has provided personal data without appropriate parental consent, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. The "Last updated" date at the top of this page indicates when the Policy was most recently revised. We encourage you to review this page periodically.

14. Contact & Complaints

For questions about this Policy, to exercise your data protection rights, or to submit an opt-out request (including opting out of marketing communications or non-essential cookie processing), contact: