Privacy Policy

FS Estonia OÜ respects your privacy and processes personal data lawfully, fairly and transparently. This policy explains what data we process, how we use it and your rights.

1. Controller and scope

The controller of personal data is FS Estonia OÜ, registration number 14102796.

This policy applies to visitors to fsestonia.ee, people sending enquiries, client and partner contact persons, job applicants and users of the working hours portal.

The website presents our company and services and allows you to contact us. It is not an online shop.

2. What data do we process?

The data we process depends on your interactions with us. It may include:

• Contact details: name, email address, phone number, company and job title.
• Enquiry and cooperation data: correspondence, enquiry content, project descriptions and documents you send us.
• Application data: CV, work experience, education, skills and other information submitted when applying.
• Working hours portal data: account details, name, projects, tasks, work dates, start and finish times, breaks, notes, approvals and entry change history.
• Technical data: IP address, request time, browser and device information and logs relating to website operation and login.

We mainly obtain data directly from you. Authorised administrators may also add or correct portal account details and entries. We may use company and representative information from public business registers when evaluating cooperation.

Please provide only information needed for your enquiry or application. Do not unnecessarily include health data or other sensitive information in free-text fields.

3. Purposes and legal bases

• Responding to enquiries and preparing quotations: taking steps at your request before entering into a contract, or our legitimate interest in conducting business communications.
• Managing contracts and cooperation: performing a contract, or our legitimate interest in communicating with business representatives and coordinating projects.
• Recruitment: taking steps at your request before entering into an employment relationship. We retain applicant data for future recruitment only with separate consent.
• Working hours records: performing an employment or other contract, meeting legal duties relating to time records and our legitimate interest in checking accuracy and resolving disputes.
• Accounting: complying with legal obligations.
• Website and account security: our legitimate interest in preventing misuse, protecting data and ensuring reliable services.
• Analytics or marketing requiring consent: your prior consent, where these services are used.

The legal bases are Article 6(1)(a), (b), (c) and (f) of the General Data Protection Regulation. When relying on legitimate interests, we also consider your rights and interests.

Sending data or visiting the website does not automatically give consent to marketing. Contact details are needed to answer enquiries, and relevant application data is needed to assess applications.

4. Data retention

We retain personal data only for as long as needed for its purpose or required by law. Different types of data have different retention periods.

• Enquiries that do not lead to cooperation: generally up to 12 months after communication ends.
• Application data: generally up to 6 months after the recruitment process ends. With consent for future opportunities, up to 12 months or until consent is withdrawn.
• Contractual correspondence and project documents: throughout cooperation and afterwards for as long as needed to fulfil obligations and resolve potential claims.
• Accounting source documents: generally 7 years from the end of the financial year in which the document was recorded.
• Working hours and employment data: according to requirements for time records, pay, accounting and handling claims. Data forming part of an accounting source document follows that document's retention period.
• Technical and security logs: for a limited period according to their purpose and system settings. Security incident data may be retained longer to resolve the incident.

We may retain relevant data longer in the event of a dispute, legal obligation or other justified need. When retention is no longer necessary, data is deleted or anonymised.

5. Data recipients

Where necessary, authorised employees and service providers supporting our operations may access data, including hosting, email, IT maintenance, accounting and legal service providers.

We may share necessary contact or work coordination data with clients and project partners. We disclose data to authorities where there is a legal basis or obligation.

Data is shared only to the extent necessary. Providers processing personal data on our behalf must apply appropriate data protection measures.

6. Cookies and external services

The website and working hours portal may use essential cookies for login, sessions and security. These cookies are necessary to provide a service requested by the user.

If we use analytics or marketing cookies requiring consent, we ask for consent before using them. You must be able to refuse them and withdraw consent. Details of services, cookies and retention periods are provided in the cookie consent interface.

The website uses Google Fonts. When fonts are loaded from Google's servers, your browser sends the provider your IP address and technical request information, among other data.

External services may process data outside the European Economic Area. Use of these services must meet applicable data protection requirements and, where necessary, appropriate transfer safeguards. Please contact us for details of a particular service and its safeguards.

7. Data security

We apply technical and organisational safeguards appropriate to the risks of processing. These aim to prevent unauthorised access and protect data against loss, misuse, alteration and unauthorised disclosure.

Working hours portal users must keep their credentials confidential and notify us of suspected account misuse.

8. Your rights

Subject to applicable conditions, you have the right to:

• Receive information about the processing of your personal data and obtain a copy.
• Request correction or completion of inaccurate data.
• Request deletion or restriction of processing.
• Object to processing based on legitimate interests, on grounds relating to your particular situation.
• Receive data you have provided in a portable format where automated processing is based on consent or a contract.
• Withdraw consent at any time. Withdrawal does not affect the lawfulness of earlier processing.
• Object to the use of your data for direct marketing.

These rights are not absolute. For example, we cannot delete data that must be retained by law. We may need to verify your identity to fulfil a request.

We generally respond within one month. For complex or extensive requests, this may be extended by up to two further months. We will notify you of the extension and its reasons within the first month.

If you believe your rights have been infringed, you may lodge a complaint with the Estonian Data Protection Inspectorate or seek a judicial remedy.

10. Changes to this policy

We may update this policy when our processing activities or applicable requirements change. The new version will be published on this page. Where necessary, we will also notify you separately of significant changes.

Last updated: 9 October 2026