Privacy Policy

Who is responsible

The data controller is Intercom Group OÜ, trading as Spa Prof (registry code 10113432; VAT EE100342105). Our address is Lubiliiva tn 12/1, Nõmme, 11216 Tallinn, Harju maakond, Estonia. For privacy questions or requests, contact info@spaprof.com or +372 5565 5317.

Information we collect

A quote request contains your name, email address, shipping country, and the products, models and quantities you select. You may also add a phone number and message. A general contact message contains your name, email address and message. We record the request and its delivery status so we can respond and avoid duplicate messages.

When you use the site, technical records may include your IP address, browser, device, pages requested and approximate location derived from the IP address. We also store a quote list and analytics choice in your browser. Staff administration involves account and sign-in records; ordinary visitors do not need an account.

Why we use it and our legal bases

We use inquiry details to answer your question, prepare a quote and take steps you request before a possible contract (GDPR Article 6(1)(b)). For general messages and inquiries sent on behalf of an organisation, we rely on our legitimate interest in responding (Article 6(1)(f)). Providing the required form fields is necessary for us to respond; the phone number and extra message on a quote are optional.

We use limited technical and administration records to operate, secure and troubleshoot the site, prevent abuse and manage authorised staff access, based on our legitimate interests (Article 6(1)(f)). Where law requires us to keep records, we rely on Article 6(1)(c). Optional analytics uses your consent (Article 6(1)(a)); you can decline it and still use the site. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Browser storage and cookies

The globe menu saves your chosen language in the eos-language cookie for up to one year. It takes priority over your browser language when opening the homepage. You can change it in the menu or clear the cookie in your browser.

If there is no saved choice or supported browser language, we use the approximate IP-based country supplied by our hosting provider to choose a homepage language, with English as the final fallback. This language selection does not save your IP address or country.

The site saves the selected product and model IDs, quantities and your analytics choice in your browser so the quote list and preference work across visits. You can remove products in the quote drawer or clear site data in your browser. Essential browser storage supports these requested functions and does not require analytics consent.

For a direct price request, we also save the name, email address, shipping country and phone number you enter in this browser tab's session storage, separately for each product. If you reopen the request for the same product, those fields are restored. The additional message is not saved in the draft, and contact details are not stored in the quote list. The draft lasts only for this tab/session and can be cleared by closing the tab or clearing site data.

If you consent and the services are configured, Google Analytics may set measurement cookies such as _ga and _ga_<measurement-id>. PostHog is configured for selected events with memory-based persistence, without session replay or automatic collection of form contents. You can change your analytics choice below at any time; withdrawing consent stops future optional tracking.

Google Analytics and PostHog

With your permission, Google Analytics and PostHog help us understand site visits, device and browser patterns, page performance and selected catalogue or quote interactions. The site is designed to load these optional services only after you accept analytics. We do not intentionally send names, email addresses, phone numbers or message text in analytics events. Analytics may still receive technical identifiers, including an IP address, as part of a network request.

Service providers and external sites

The live site uses or is prepared to use Vercel for hosting, Supabase for the catalogue, inquiry records and staff authentication, and Resend for inquiry email delivery. Adobe Fonts and Google Fonts supply typefaces and may receive technical information when your browser requests font files. Google Analytics and PostHog receive data only under the analytics choice described above. We share only the data each provider needs for its function and use contractual safeguards where appropriate.

Some providers may process data outside the European Economic Area. Where required, we rely on an applicable adequacy decision or contractual transfer safeguards; you can ask us for details. Links to WhatsApp and other external websites take you to services with their own privacy terms.

How long we keep data

We keep inquiries while we handle the request and any resulting business relationship, and longer only where a legal duty or a possible claim requires it. Staff account and audit records are kept while needed to manage access, security and accountability. Technical logs are kept only for the period needed to protect and troubleshoot the service. Analytics data follows the configured provider retention settings; browser storage remains until you remove it, a site action clears it, or the browser does. These needs determine when records should be deleted or anonymised.

Your rights

You may ask to access, correct or erase your personal data, restrict its use, object to processing based on legitimate interests, or receive portable data where the law applies. You can withdraw analytics consent at any time without affecting earlier lawful processing. Write to info@spaprof.com; we may need to verify your identity before acting on a request.

You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the supervisory authority where you live or work in the EEA. We would welcome the chance to address your concern first.

Changes to this policy

We may update this policy when site features, providers or legal requirements change. We will publish the revised text and date here. Please contact us if you would like more information about a provider, transfer safeguard or retention decision.

Your analytics choice

Optional Google Analytics and PostHog tracking is off until you accept. Changing your choice here takes effect for future tracking.