// privacy policy
Privacy policy
Last reviewed 2026-08-26. This policy describes 2beconsultou.com and the enquiry forms on it.
The short version
- This site sets no cookies and loads nothing from any other company — no analytics, no advertising tag, no third-party font, no chat widget, no map.
- The only data we hold about you is what you type into a form, plus a server log entry with a truncated IP address.
- No form asks for consent, because answering a business enquiry does not rest on consent.
- Nothing is sold, shared or used for profiling. There is no marketing list.
- We do not yet state where the site is hosted, because hosting has not been provisioned. Section 6 says so plainly rather than naming a location we have not verified.
1. Who is responsible
The controller of the personal data described here is 2BE Consult OÜ (Private limited company), registry code 12830480, EU VAT EE101793216, registered at Lauka tn 4c-2, 11625 Tallinn, Nõmme linnaosa, Harju maakond, Estonia. You can verify those details in the Estonian Business Register.
Data-protection contact: support@2beconsultou.com. No Data Protection Officer is required under GDPR Art. 37 for processing of this scale; data-protection requests are handled by the management board at the address and mailbox above.
2. What we collect, field by field
Everything below matches the live forms and the database schema exactly. If a field is not in this table, this site does not collect it.
2.1 Project audit form — required fields
Lawful basis: Article 6(1)(b) GDPR — processing necessary to take steps at your request before entering into a contract. Without these fields the enquiry cannot be answered, which is what makes them necessary rather than merely useful.
| Stored as | Field | Why it is processed | Basis | Kept for |
|---|---|---|---|---|
| company_name | Organisation name | To know which organisation is asking, and to address the reply correctly. | Art. 6(1)(b) | 24 months |
| contact_name | Contact name | So the reply is addressed to a person. | Art. 6(1)(b) | 24 months |
| contact_email | Work email address | The channel used to reply. Without it the enquiry cannot be answered at all. | Art. 6(1)(b) | 24 months |
| architecture_type, tech_stack, infrastructure_type, integration_surface, delivery_mode | Scope answers | The substance of the request: they decide whether we can help, and how. | Art. 6(1)(b) | 24 months |
| technical_requirements | What you want to achieve | The description of the work you are asking us to assess. | Art. 6(1)(b) | 24 months |
2.2 Project audit form — optional fields
Lawful basis: Article 6(1)(f) GDPR — our legitimate interest in being able to reach you through the channel you chose and in scoping a conversation efficiently. An optional field cannot sit under Art. 6(1)(b), because that basis covers only what is necessary, and a field the form itself calls optional is not. You may object at any time under Article 21, and leaving these blank changes nothing about how your enquiry is handled.
| Stored as | Field | Why it is processed | Basis | Kept for |
|---|---|---|---|---|
| contact_phone | Telephone number | Only used if you would rather be called. Leaving it blank changes nothing. | Art. 6(1)(f) | 24 months |
| estimated_budget | Budget range | Your own planning range, so we can say early whether scope and range are compatible. | Art. 6(1)(f) | 24 months |
| compliance_requirements | Regulatory context | Obligations that change how the work must be done. | Art. 6(1)(f) | 24 months |
2.3 Contact form — required fields
Lawful basis: Article 6(1)(b) where you are asking about an engagement, and Article 6(1)(f) — our legitimate interest in answering enquiries addressed to us — for anything else.
| Stored as | Field | Why it is processed | Basis | Kept for |
|---|---|---|---|---|
| sender_name | Your name | So the reply is addressed to a person. | Art. 6(1)(b) / (f) | 24 months |
| sender_email | Email address | The channel used to answer you. | Art. 6(1)(b) / (f) | 24 months |
| subject | Subject | So the message reaches the right person here. | Art. 6(1)(b) / (f) | 24 months |
| message | Message | The content of your enquiry — what we read and answer. | Art. 6(1)(b) / (f) | 24 months |
2.4 Contact form — optional field
| Stored as | Field | Why it is processed | Basis | Kept for |
|---|---|---|---|---|
| phone | Telephone number | Only used if you would prefer a call. | Art. 6(1)(f) | 24 months |
2.5 Server logs
Every request writes a log line containing the time, the path, the response status and a truncated IP address — the last octet of an IPv4 address is set to zero, and an IPv6 address is cut to its first 48 bits. Message content is never written to a log. Basis: Article 6(1)(f), our legitimate interest in keeping the service available and defending it against abuse. Retention: 30 days, after which the file is deleted by the application itself rather than by a policy nobody enforces.
Submission rate limiting counts submissions against a keyed hash of the truncated address. The raw address is never written to disk and the hash cannot be reversed without the site key. Counters expire within 24 hours.
2.6 What we do not collect
- No cookies of any kind, first-party or third-party.
- No analytics, page-view counting, session recording or heat mapping.
- No advertising or conversion tag. The Consent Mode framework is in place and set to denied, but no tag exists.
- No newsletter, mailing list or marketing automation.
- No profiling and no automated decision-making with legal or similarly significant effects (Art. 22).
- No special-category data (Art. 9). Please do not put any into a form.
3. No consent is asked for or relied on
No form on this site asks you to tick a consent box. Answering a business enquiry does not rest on consent, and consent demanded as the price of submitting a form would not be freely given under Art. 7(4).
This matters practically: you will not find a tick-box on any form here, and there is no consent field in the API. If you have seen a site demand agreement to its privacy policy before it will accept an enquiry, that is not how Article 6 works, and the resulting record rests on a basis the site has misdescribed.
4. How long we keep things
- Project audit enquiries: 24 months from submission.
- Contact messages: 24 months from submission.
- Server logs: 30 days.
- Rate-limit counters: under 24 hours.
- Your cookie choice: stored on your own device until you clear it; nothing is stored on our side.
Where an enquiry becomes an engagement, the record moves into the contract file and is kept for as long as Estonian accounting and limitation law requires.
5. Who else sees your data
Nobody, other than the provider that hosts this website and its database. Your submission is not disclosed to third parties for their own purposes. We say it that way rather than claiming “no transfers to third parties”, because a hosting provider is a processor and using one is itself a transfer — an absolute promise there would be untrue the moment it was written.
Deliberately not used on this site: content delivery networks, web fonts, analytics, tag managers, advertising networks, chat widgets, embedded video, maps, CRM systems and third-party email marketing.
Your enquiry is stored in our own database. Outbound notification mail is switched off on this service, so we read submissions in the application itself — writing directly to the mailbox below reaches us the same day.
6. Where the data is processed
Hosting for this website has not been provisioned yet. Until it is, this site makes no claim about where its data is processed. The privacy policy says exactly that instead of naming a location.
We are stating this rather than writing a comfortable sentence about European hosting, because a data-residency claim made before the server exists is a claim waiting to become false — and it would sit in the one document where being wrong matters most. When hosting is provisioned, this section will name the provider, the country and the city, and — if that country is outside the European Economic Area — the Chapter V transfer mechanism relied on, with the date the location was established.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable form (Art. 20);
- object to processing based on our legitimate interests (Art. 21) — which is every optional field on this site, and the server logs.
Write to support@2beconsultou.com and we will answer within one month, as Art. 12(3) requires. There is no charge, and we will not ask you to justify the request.
If you are not satisfied, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) — Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, +372 627 4135. You may also complain to the supervisory authority in your own country of residence.
8. Security
- The site is served over HTTPS, and the API accepts requests only from its own origin.
- Database access uses parameterised statements exclusively; no value from a form is ever concatenated into SQL.
- Application logs are scrubbed of email addresses, names and message content before they are written.
- Submissions are rate-limited per truncated address, and forms carry an invisible field that only automated scripts fill in.
- No production credential is stored in the application repository.
No system is perfectly secure, and this policy does not promise that one is. If you find a security problem with this site, write to support@2beconsultou.com and we will respond.
9. Children
This is a business-to-business site. It is not directed at children and we do not knowingly collect data from anyone under 16.
10. Changes
When this policy changes materially, the review date at the top changes with it. The site publishes a build identifier in the footer linked to /version.json, so you can always tell which version of this page you are reading — useful if a cached copy disagrees with the live one.
11. Related pages
Cookie and storage policy · Terms of service · Legal identity and register data