Privacy and data protection policy

RSR Shenzhou Company OÜ

Effective date: 1 September 2026. Last updated: 12 October 2026.

1. Controller and scope

The controller is RSR Shenzhou Company OÜ, Estonian Commercial Register code 17362300, with its registered office at Harju maakond, Tallinn, Lasnamäe linnaosa, Sepapaja tn 6, 15551, Estonia. Privacy contact: gpdr@rsrshenzhou.com. This is a company mailbox, not the contact of an appointed data protection officer.

This policy covers https://roisplatform.com and our own management of enquiries, demonstrations, quotations, newsletter subscriptions, contracting and support for ROIS Platform. Regulation (EU) 2016/679 (GDPR) and applicable Estonian legislation apply.

Where a customer enters personal data into the ERP and determines the purposes and means, the customer acts as controller and the company as processor, following the customer’s instructions and the Article 28 GDPR processing agreement. This policy does not replace that agreement or the information the customer must provide to affected individuals. Requests concerning that data will be handled with the customer acting as controller.

2. Data processed and sources

The website channels will collect the following information:

• Contact: name, professional email and message required; company and telephone optional.
• Quotation or demonstration: name, professional email and company required; role, telephone and requirements optional.
• Newsletter: email and separate consent required; name optional.
• Contracting: company name, tax identification, billing address, representative and email required; telephone optional.
• Support: user identification or email and issue description required; attachments optional.
• Chat: message; name and email optional for a reply.
• WhatsApp: telephone number and conversation content; name optional.

This website has no user accounts or registration. Do not provide sensitive data or unnecessary third-party information.

Browsing may generate IP address, date and time, browser, requested resources and access, error or security logs. Technical logs will be limited to date and time, requested resource, request outcome, browser and necessary connection data. They will not include passwords, credentials, form bodies or complete conversations. IP addresses will be shortened or pseudonymised where the full address is unnecessary. Audience measurement is explained in section 8: it uses no cookies and stores nothing on your device.

Data comes from you, your interactions or the company providing your professional details. In the latter case, Article 14 GDPR information will be provided within the applicable time limits unless a legal exception applies. Without required data we may be unable to handle the request or provide the service.

3. Purposes and legal bases

• Enquiries, quotations and demonstrations: precontractual steps requested by the individual (Article 6(1)(b) GDPR), or legitimate interests in handling general enquiries and relationships with company representatives (Article 6(1)(f)).
• Contracting and support: performance of a contract where the individual is a party (Article 6(1)(b)), or legitimate interests in managing the customer company relationship (Article 6(1)(f)).
• Newsletter and promotional communications: the recipient’s specific consent (Article 6(1)(a)). Subscription is optional and may be cancelled through the unsubscribe link or by writing to gpdr@rsrshenzhou.com. Necessary communications about contracted services rely on the basis applicable to that service.
• Operation, abuse prevention and security: legitimate interests in protecting the website and systems (Article 6(1)(f)), using proportionate measures.
• Legal compliance and rights: applicable accounting, tax and data protection obligations (Article 6(1)(c)).
• Claims: legitimate interests in establishing, exercising or defending legal claims (Article 6(1)(f)).
• Analytics and advertising using technologies requiring consent: prior consent, separate for each purpose (Article 6(1)(a)), once the tools have been defined and disclosed.

Contacting us or contracting does not constitute consent to advertising. Chat or WhatsApp, if available, will be voluntary channels; email may also be used. Email is managed through Microsoft 365; the newsletter and AI chat are in-house solutions, and WhatsApp will be integrated into the website.

4. Retention

The company will apply the following retention periods. They must only apply while data remains necessary for the relevant purpose; maximum periods do not, by themselves, justify retention.

• Enquiries not leading to a contract: up to one year from closure.
• Customer relationship management: during the relationship and then up to two years from termination, limited to necessary data. Legal obligations or claims may require specific documents to be retained longer.
• Accounting documents: generally seven years from the end of the financial year in which the transaction was recorded, under section 12 of the Estonian Accounting Act; documents relating to long-term rights or obligations are retained for seven years after their validity expires.
• Technical and security logs: a maximum of two years from each entry. Within that maximum, routine operation, error and performance logs will be retained for up to 90 days to diagnose and resolve issues. Only significant security events, administrative changes and anomalous access may be retained for up to two years to correlate events, investigate abuse and check corrective measures. Data and access will be limited to authorised personnel, with annual necessity reviews and earlier deletion when no longer useful. Evidence of confirmed incidents follows its specific period. The two-year period does not cover all browsing or require extension of providers’ ordinary retention.
• Audience statistics (Plausible): up to 36 months, with no IP address or identifiers that would let a person be recognised. See section 8.
• Incident evidence: up to five years from closure of the incident, limited to what is necessary to investigate, document action and address liability.
• Privacy requests and handling evidence: up to three years from closure of the request.
• Newsletter: while the subscription remains active; after unsubscribing, only minimum information needed to honour objections and demonstrate consent. Minimum evidence of consent, its scope, date, information version and withdrawal will be retained for three years from unsubscribing or the last authorised communication, whichever is later, solely to demonstrate compliance and address claims. The suppression list will retain only email, date and reason for unsubscribing while the company maintains that marketing channel, with annual review. It will be deleted when the channel permanently ceases or superseded by subsequent valid consent. It will not be used for other purposes.

Data entered into the ERP by the customer as controller will be returned or deleted according to the customer’s instructions and the processing agreement when the service ends, unless retention is legally required. The two-year period does not automatically apply to all ERP content. After termination, the customer will have up to one year to request export. Data and backups will be deleted no later than the end of that year, subject to earlier deletion or return instructions and specific legal obligations. The processing agreement must specify the process and scope of backup cycles.

Data will be deleted or anonymised when periods expire; retention for obligations or claims will be limited to necessary data and authorised access.

5. Providers and recipients

The infrastructure uses Hetzner for servers hosted in Europe, MongoDB Cloud for the database and Vercel to publish the frontend. Providers will access data according to the contracted service and configuration, under the relevant processing agreement. Email, newsletter, chat, maintenance and advisory providers may also be involved as necessary for their functions. Data may be disclosed to authorities or courts where legally required.

Email is provided through Microsoft 365. The newsletter uses an in-house solution and the chat an in-house artificial intelligence solution. WhatsApp will be integrated within the website. An in-house solution may still involve infrastructure, delivery or AI model providers.

The in-house chat uses Ollama as its AI execution tool and WhatsApp is integrated directly through Meta. The chat will run Qwen3:8b through Ollama on Hetzner servers within the EEA, with cloud features disabled and no conversations sent to the model developer. Administrative access will be limited to company personnel authorised for support and operation. Microsoft 365 will provide email under Microsoft’s data protection terms applicable to the subscription; WhatsApp will be integrated directly through Meta under WhatsApp Business terms; and Plausible Insights OÜ (Estonia) provides audience measurement under its data processing agreement. The newsletter will be managed in-house. External providers will not be enabled to reuse conversations for their own training.

6. Location and international transfers

According to the company’s confirmation, hosting and access for its Hetzner, MongoDB Cloud and Vercel infrastructure remain within the European Economic Area (EEA), including Norway. This statement concerns the contracted configuration and must remain consistent with the providers and subprocessors used.

Audience measurement is provided by Plausible Insights OÜ (Estonia), which states that it processes and stores data in the European Union (Hetzner servers in Falkenstein, Germany); no transfers outside the EEA are foreseen for this tool. Introducing other external services requires a separate assessment of recipients and potential transfers outside the EEA. An adequacy decision will only apply while valid and covering the recipient and transfer; coverage will be checked for US entities participating in the EU-US framework. Otherwise, European Commission standard contractual clauses, a transfer assessment and any necessary supplementary measures will be required. The same approach will apply to Microsoft 365 and WhatsApp/Meta where their services or subprocessors involve access outside the EEA. No transfer will be activated without first identifying recipients, destinations and sufficient safeguards. The current list and copies of safeguards may be requested at gpdr@rsrshenzhou.com. Where transfers occur, the applicable adequacy decision or safeguards and how to obtain a copy will be disclosed.

7. Your rights

You may request access, rectification, erasure, restriction and, where applicable, portability of your data. You may object to processing based on legitimate interests on grounds relating to your particular situation. If direct marketing takes place, you may object to it at any time. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Write to gpdr@rsrshenzhou.com or our registered office, explaining your request. We will only ask for additional identification information where we have reasonable doubts about your identity. We will respond without undue delay and generally within one month; this may be extended by up to two further months due to the complexity or number of requests, with notice within the first month. Exercising your rights is free, subject to statutory exceptions for manifestly unfounded or excessive requests.

You may lodge a complaint with Andmekaitse Inspektsioon, the Estonian data protection authority: www.aki.ee, info@aki.ee, Tatari 39, 10134 Tallinn, Estonia. You may also contact the supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement, without having to contact us first. In Spain, the authority is the Agencia Española de Protección de Datos (www.aepd.es).

8. Cookies and audience measurement

This website does not set cookies or store information on your device; this is explained in the Cookie policy. Apart from the measurement tool described below, it does not use any other third-party analytics or advertising tools.

To know how many people visit each page and to improve the website, the company uses Plausible Analytics, a service of Plausible Insights OÜ (Västriku tn 2, 50403 Tartu, Estonia; registry code 14709274), which acts as processor on the company’s behalf under its data processing agreement (Article 28 GDPR).

• Data: address of the page visited (without parameters, except campaign ones), referring page, device type, browser and operating system, approximate country, region and city, and reading time and scroll depth. Plausible receives the IP address and browser details with every request but does not store them: it uses them to calculate a daily identifier with a key that is deleted every 24 hours, which does not allow a person to be recognised from one day to the next or on other websites.
• Use of the site: which buttons and links are clicked (for example, “Request a demo”, WhatsApp or email), how far through the film you get and whether the contact form has been submitted, without anything you type into it.
• Purpose and legal basis: to understand how the website is used and improve it; legitimate interests (Article 6(1)(f) GDPR). The data is not used for other purposes or shared with third parties for their own purposes.
• Recipients and location: Plausible. According to the provider, data is processed and stored in the European Union (Hetzner servers in Falkenstein, Germany), and it uses Bunny, a European provider based in Slovenia, to deliver its script. No transfers outside the EEA are foreseen for this tool.
• Retention: up to 36 months.
• Rights: you may object to this measurement at any time; section 5 of the Cookie policy explains how. Your other rights and the right to complain to an authority are set out in section 7.

If a technology requiring consent were introduced in the future (for example, analytics with cookies or advertising), consent would be requested before it is activated and this policy would be updated.

9. Security and automated decisions

The company will implement technical and organisational measures appropriate to the risk. The website will use HTTPS with TLS encryption to protect communications. Administrative and infrastructure access will be restricted by role, using individual accounts, multifactor authentication where available, permission reviews and removal when authorisation ends. Security updates, restricted-access backups and incident detection and handling procedures will be applied.

According to the information provided by the company, no solely automated decisions with legal or similarly significant effects or profiling take place. This information must be reviewed if newly introduced tools change the processing.

The chat informs users that they are interacting with an artificial intelligence system and processes messages to answer enquiries. Responses may contain errors and may be checked with the company by email. Use will be voluntary.

The company plans to reuse chat conversations to train and improve its AI. That use relies on the user’s specific, optional and separate consent (Article 6(1)(a) GDPR). Conversations will not be used for training without that authorisation, and refusal will not prevent assistance through the chat. Consent may be withdrawn by writing to gpdr@rsrshenzhou.com, without affecting the lawfulness of earlier processing. Training will select only text excerpts from authorised conversations to improve answers about ROIS Platform. Attachments, credentials, customer data entered into the ERP, special categories of data and unnecessary third-party content will be excluded. Direct identifiers will be removed and filtering and human review applied before inclusion; excerpts will be treated as personal data unless effective anonymisation is demonstrated. The dataset will be kept separate from contact records, accessible only to authorised development/AI personnel within the EEA using the local Ollama configuration described. It will not be disclosed for third-party training. Excerpts will be retained for up to twelve months from inclusion or until consent is withdrawn, whichever is earlier. Model versions will be reviewed at least annually; replaced versions will be retained for no more than six months for rollback, with restricted access. Withdrawal may be requested at gpdr@rsrshenzhou.com and will stop new uses of the associated dataset; identifiable excerpts will be deleted and the model assessed for containing or reproducing personal data. Where needed to fulfil rights, unlearning, retraining or retirement of the affected version will be applied, without promising that deleting source text alone removes its potential influence on parameters. Traceability and minimum evidence of authorisation and action will be retained for three years after withdrawal. Training will not be activated until these controls and complete user information are in place.

10. Changes

This policy will be updated when processing activities or legal requirements change. If data is to be used for a new purpose, the required information will be provided before that processing begins, and consent will be obtained where necessary.