Infrafly Privacy Policy
Last updated 06.10.2026
1. Who does this notice apply to?
This notice explains how InfraFLY OÜ (registry code 14368442, Valukoja tn 7, 11415 Tallinn, Estonia; Infrafly or we) uses personal data. The notice is intended for users of our websites, including www.infrafly.com, public demos, contact forms, materials and other public digital environments, as well as for people who communicate with us or represent a customer or prospective customer.
For data protection questions and requests, contact us at privacy@infrafly.ee. Visiting the website or reading this notice does not constitute giving consent.
2. Who is responsible for your data?
Infrafly is the controller for data relating to its web channels, enquiries, sales and customer communication, invoicing, and the data needed to keep these secure. To protect the general security of the app.infrafly.com service, we use, under our own responsibility, only the technical data necessary for that purpose.
For customer work data, user accounts, timesheets, location and integration data, we act as a processor on behalf of the customer. The purposes and retention of this data are determined by your employer, the ordering party or other relevant customer in its own privacy notice. Our obligations to the customer are set out in the data processing agreement (DPA); this notice does not replace the customer's notice or legal basis.
3. What data do we use, why and for how long?
| Data and purpose | Legal basis | Retention |
|---|---|---|
| Data and purposeEnquiries and demo requests: name, work contact details, company, role and content of communication; responding and presenting a suitable service. | Legal basisLegitimate interest in responding to and communicating with a company representative (GDPR Art. 6(1)(f)). | RetentionEnquiries up to 24 months from the last communication; sales contacts that do not result in a customer relationship up to 12 months from the last contact. |
| Data and purposeCustomer representative data, contractual communication, invoices and payments; managing the customer relationship and invoicing. | Legal basisLegitimate interest in managing the customer relationship; legal obligation for accounting documents (Art. 6(1)(f), (c)). | RetentionNecessary accounting and contract documents for 7 years from the end of the relevant financial year; documents on long-term rights or obligations for 7 years from the end of their validity. |
| Data and purposeGeneral support communication: contact details, content of the request and resolution data; organising support. The content of customer work data is governed by the DPA. | Legal basisLegitimate interest in providing and documenting support (Art. 6(1)(f)). | RetentionUp to 3 years from the resolution of the request. |
| Data and purposeTechnical security data: IP address, browser, device, request time and error logs; ensuring operation and preventing abuse. | Legal basisLegitimate interest in ensuring a secure and functioning environment (Art. 6(1)(f)). | RetentionGenerally up to 90 days; evidence needed for a specific incident until it is resolved. |
| Data and purposeNewsletter and marketing contact: name, work email, subscription and preferences; presenting our services. | Legal basisConsent (Art. 6(1)(a)); for business-directed offers permitted by law, legitimate interest (Art. 6(1)(f)). | RetentionUntil consent is withdrawn or an objection is made; without a customer relationship, sales contact for up to 12 months. The minimal record needed to honour an opt-out is kept for as long as it is needed. |
We obtain data from you, from the environment you use, from a company representing you or connected to you, and, for work contacts, from public business sources or sales partners. We will inform you of the source and use of data obtained elsewhere within one month at the latest, at the first communication or at the first disclosure, whichever occurs first.
Providing data is generally voluntary, but without contact details we cannot respond to an enquiry. Concluding a contract and invoicing depend on the necessary representative and billing data. We do not ask for unnecessary data. The retention period is a maximum, not an obligation to keep all data until the end of the period; evidence needed for a specific dispute may be kept until it is resolved.
4. Marketing and automated decisions
We send our newsletter with consent; to company contacts, we send offers related to their work to the extent permitted by law. You can opt out free of charge in every message, or by writing to privacy@infrafly.ee. Using a natural person's electronic contact details for marketing requires consent or an exception permitted by law.
Where we rely on legitimate interest, we weigh the necessity of the processing and its impact on your rights. No decisions based solely on automated processing that have legal or similarly significant effects are made on the basis of this notice.
5. Who do we share data with?
To the extent necessary, data is received by providers of hosting, IT maintenance, notification, customer communication, signing, accounting and advisory services. We agree data protection obligations with processors acting on our behalf and restrict access. We disclose data to a competent authority where required by law or to defend a legal claim.
Processing carried out by an external website or social media service itself is governed by that provider's privacy information. The allocation of roles in any joint controllership involving Infrafly is published with the relevant channel. External web components are covered in section 9.
6. Transfers of data outside the EEA
Processing or remote access by a service provider may take place outside the European Economic Area (EEA). In that case, we rely on a European Commission adequacy decision applicable to the recipient concerned or on appropriate safeguards, such as standard contractual clauses together with any necessary supplementary measures. Information and a copy of the safeguards are available from privacy@infrafly.ee.
Recipients outside the EEA, countries of processing and the transfer mechanism used can be found in the Data Processing Agreement.
7. Your rights
Under the conditions set out by law, you may access your data and obtain a copy, request rectification, erasure or restriction of processing, and exercise the right to data portability. You may object, on grounds relating to your particular situation, to processing based on legitimate interest; you may object to direct marketing at any time. You may withdraw your consent at any time; this does not affect the lawfulness of earlier processing.
Write to privacy@infrafly.ee. We respond without undue delay and within one month at the latest. For complex or numerous requests, we may extend this deadline by up to two months, informing you of the reason within the first month. Requests are generally free of charge; where necessary, we verify your identity proportionately. We forward requests concerning data processed on behalf of a customer to that customer and assist them.
You may lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee, info@aki.ee) or with the competent supervisory authority of your habitual residence, place of work or place of the alleged infringement. You retain the right to go to court.
8. Data protection
We apply measures appropriate to the risk, including encrypted data transmission, access restrictions, security management, backups, and confidentiality obligations for employees and service providers.
9. Cookies and external components
We use strictly necessary cookies and similar technologies for operation, security and the functionality you have requested. Other analytics and marketing technologies are activated only with prior consent. You can refuse and withdraw consent just as easily via “Cookie settings”. Normal use does not require accepting optional cookies.
Infrafly uses cookies and similar technologies for website operation, analytics and marketing purposes.
More detailed information on the use of cookies can be found in our Cookie Policy. We keep proof of consent for up to 3 years after it ends. An optional external map, video or avatar may transmit your IP address and request data and is loaded only with consent. A Gravatar email hash is not anonymous.
10. Changes to this notice
We publish the current notice on the website together with its effective date. We will inform you of any material change or new purpose before it is applied. Changing this notice does not replace any required consent or change the customer's DPA.