// privacy policy
Privacy policy
Last reviewed 2026-08-26. This policy describes 2beconsultou.com and the enquiry forms on it.
The short version
- This site sets no cookies and loads nothing from any other company — no analytics, no advertising tag, no third-party font, no chat widget, no map.
- The only data we hold about you is what you type into a form, plus a server log entry with a truncated IP address.
- No form asks for consent, because answering a business enquiry does not rest on consent.
- Nothing is sold, shared or used for profiling. There is no marketing list.
- The site runs on a server in the United States, which is outside the European Economic Area. Section 6 names the provider, the location, how we established it, and the safeguard the transfer relies on.
1. Who is responsible
The controller of the personal data described here is 2BE Consult OÜ (Private limited company), registry code 12830480, EU VAT EE101793216, registered at Lauka tn 4c-2, 11625 Tallinn, Nõmme linnaosa, Harju maakond, Estonia. You can verify those details in the Estonian Business Register.
Data-protection contact: support@2beconsultou.com. No Data Protection Officer is required under GDPR Art. 37 for processing of this scale; data-protection requests are handled by the management board at the address and mailbox above.
2. What we collect, field by field
Everything below matches the live forms and the database schema exactly. If a field is not in this table, this site does not collect it.
2.1 Project audit form — required fields
Lawful basis: Article 6(1)(b) GDPR — processing necessary to take steps at your request before entering into a contract. Without these fields the enquiry cannot be answered, which is what makes them necessary rather than merely useful.
| Stored as | Field | Why it is processed | Basis | Kept for |
|---|---|---|---|---|
| company_name | Organisation name | To know which organisation is asking, and to address the reply correctly. | Art. 6(1)(b) | 24 months |
| contact_name | Contact name | So the reply is addressed to a person. | Art. 6(1)(b) | 24 months |
| contact_email | Work email address | The channel used to reply. Without it the enquiry cannot be answered at all. | Art. 6(1)(b) | 24 months |
| architecture_type, tech_stack, infrastructure_type, integration_surface, delivery_mode | Scope answers | The substance of the request: they decide whether we can help, and how. | Art. 6(1)(b) | 24 months |
| technical_requirements | What you want to achieve | The description of the work you are asking us to assess. | Art. 6(1)(b) | 24 months |
2.2 Project audit form — optional fields
Lawful basis: Article 6(1)(f) GDPR — our legitimate interest in being able to reach you through the channel you chose and in scoping a conversation efficiently. An optional field cannot sit under Art. 6(1)(b), because that basis covers only what is necessary, and a field the form itself calls optional is not. You may object at any time under Article 21, and leaving these blank changes nothing about how your enquiry is handled.
| Stored as | Field | Why it is processed | Basis | Kept for |
|---|---|---|---|---|
| contact_phone | Telephone number | Only used if you would rather be called. Leaving it blank changes nothing. | Art. 6(1)(f) | 24 months |
| estimated_budget | Budget range | Your own planning range, so we can say early whether scope and range are compatible. | Art. 6(1)(f) | 24 months |
| compliance_requirements | Regulatory context | Obligations that change how the work must be done. | Art. 6(1)(f) | 24 months |
2.3 Contact form — required fields
Lawful basis: Article 6(1)(b) where you are asking about an engagement, and Article 6(1)(f) — our legitimate interest in answering enquiries addressed to us — for anything else.
| Stored as | Field | Why it is processed | Basis | Kept for |
|---|---|---|---|---|
| sender_name | Your name | So the reply is addressed to a person. | Art. 6(1)(b) / (f) | 24 months |
| sender_email | Email address | The channel used to answer you. | Art. 6(1)(b) / (f) | 24 months |
| subject | Subject | So the message reaches the right person here. | Art. 6(1)(b) / (f) | 24 months |
| message | Message | The content of your enquiry — what we read and answer. | Art. 6(1)(b) / (f) | 24 months |
2.4 Contact form — optional field
| Stored as | Field | Why it is processed | Basis | Kept for |
|---|---|---|---|---|
| phone | Telephone number | Only used if you would prefer a call. | Art. 6(1)(f) | 24 months |
2.5 Server logs
Every request writes a log line containing the time, the path, the response status and a truncated IP address — the last octet of an IPv4 address is set to zero, and an IPv6 address is cut to its first 48 bits. Message content is never written to a log. Basis: Article 6(1)(f), our legitimate interest in keeping the service available and defending it against abuse. Retention: 30 days, after which the file is deleted by the application itself rather than by a policy nobody enforces.
Submission rate limiting counts submissions against a keyed hash of the truncated address. The raw address is never written to disk and the hash cannot be reversed without the site key. Counters expire within 24 hours.
2.6 What we do not collect
- No cookies of any kind, first-party or third-party.
- No analytics, page-view counting, session recording or heat mapping.
- No advertising or conversion tag. The Consent Mode framework is in place and set to denied, but no tag exists.
- No newsletter, mailing list or marketing automation.
- No profiling and no automated decision-making with legal or similarly significant effects (Art. 22).
- No special-category data (Art. 9). Please do not put any into a form.
3. No consent is asked for or relied on
No form on this site asks you to tick a consent box. Answering a business enquiry does not rest on consent, and consent demanded as the price of submitting a form would not be freely given under Art. 7(4).
This matters practically: you will not find a tick-box on any form here, and there is no consent field in the API. If you have seen a site demand agreement to its privacy policy before it will accept an enquiry, that is not how Article 6 works, and the resulting record rests on a basis the site has misdescribed.
4. How long we keep things
- Project audit enquiries: 24 months from submission.
- Contact messages: 24 months from submission.
- Server logs: 30 days.
- Rate-limit counters: under 24 hours.
- Your cookie choice: stored on your own device until you clear it; nothing is stored on our side.
Where an enquiry becomes an engagement, the record moves into the contract file and is kept for as long as Estonian accounting and limitation law requires.
5. Who else sees your data
Nobody, other than the provider that hosts this website and its database. Your submission is not disclosed to third parties for their own purposes. We say it that way rather than claiming “no transfers to third parties”, because a hosting provider is a processor and using one is itself a transfer — an absolute promise there would be untrue the moment it was written.
Deliberately not used on this site: content delivery networks, web fonts, analytics, tag managers, advertising networks, chat widgets, embedded video, maps, CRM systems and third-party email marketing.
Your enquiry is stored in our own database. Outbound notification mail is switched off on this service, so we read submissions in the application itself — writing directly to the mailbox below reaches us the same day.
6. Where the data is processed
This website and its database run on a virtual private server provided by Namecheap, Inc. in the United States, on the US west coast. The United States is outside the European Economic Area and is not the subject of a European Commission adequacy decision that covers this transfer, so the transfer relies on the Standard Contractual Clauses in the provider's Data Processing Addendum. The location was established by measuring network round-trip time from inside the machine, not by trusting an IP-address database.
| Provider | Namecheap, Inc. (AS22612) |
|---|---|
| Country | United States — outside the European Economic Area |
| Location | Los Angeles area, US west coast |
| Transfer safeguard | Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two, controller to processor), incorporated by Namecheap's published Data Processing Addendum. |
| Established on | 2026-08-26, by measurement from inside the server |
What that means in practice. Personal data you submit through a form on this site is stored on that server, in the United States. There is no European Commission adequacy decision covering this transfer, so it relies on the Standard Contractual Clauses under Article 46(2)(c) GDPR, incorporated by the hosting provider’s own data processing addendum. US law can, in defined circumstances, compel a US provider to disclose data it holds; the Clauses require the provider to challenge such a request where it is lawful to do so and to tell us about it where it is permitted to.
How the location was established. Not from an IP-address database — two of those disagreed about this very address, and one of them is demonstrably wrong. Round-trip network time measured from inside the machine is 22 ms to Los Angeles, 68 ms to New York and 136–155 ms to Amsterdam, London and Frankfurt, which places the server on the US west coast and rules out the European locations entirely. The date of that measurement is in the table above.
We say all of this plainly because the alternative — a comfortable sentence about European hosting — would be false, and it would be false in the one document where being wrong matters most. Until this server existed, this section said that hosting had not been provisioned and made no claim at all.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable form (Art. 20);
- object to processing based on our legitimate interests (Art. 21) — which is every optional field on this site, and the server logs.
Write to support@2beconsultou.com and we will answer within one month, as Art. 12(3) requires. There is no charge, and we will not ask you to justify the request.
If you are not satisfied, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) — Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, +372 627 4135. You may also complain to the supervisory authority in your own country of residence.
8. Security
- The site is served over HTTPS, and the API accepts requests only from its own origin.
- Database access uses parameterised statements exclusively; no value from a form is ever concatenated into SQL.
- Application logs are scrubbed of email addresses, names and message content before they are written.
- Submissions are rate-limited per truncated address, and forms carry an invisible field that only automated scripts fill in.
- No production credential is stored in the application repository.
No system is perfectly secure, and this policy does not promise that one is. If you find a security problem with this site, write to support@2beconsultou.com and we will respond.
9. Children
This is a business-to-business site. It is not directed at children and we do not knowingly collect data from anyone under 16.
10. Changes
When this policy changes materially, the review date at the top changes with it. The site publishes a build identifier in the footer linked to /version.json, so you can always tell which version of this page you are reading — useful if a cached copy disagrees with the live one.
11. Related pages
Cookie and storage policy · Terms of service · Legal identity and register data