In short
- We collect only what you type into one of the two forms, plus ordinary server logs.
- We rely on Article 6(1)(b) and 6(1)(f) — not consent — so there is no consent to withdraw and no “I agree” box to tick.
- Nothing is sold, and nothing is passed to a third party for that third party’s own purposes.
- Your data is stored on a server in Manchester, England, United Kingdom — outside the EEA, lawful under the Commission's UK adequacy decision. Section 3 explains it.
- No analytics or advertising tag runs on this site today, and none would run before you chose to allow it.
- Outbound e-mail is switched off: submissions are stored in our own database and read there.
Version 2026-08-19. Applies to 2gosystems.net.
1. Who is responsible
The controller is 2GO Systems OÜ, an Estonian private limited company, registry code 14961466, EU VAT number EE102261886, registered at Narva mnt 5, 10117 Tallinn, Kesklinna linnaosa, Harju maakond, Estonia. Telephone +49 15735133263. General e-mail info@2gosystems.net; data-protection matters privacy@2gosystems.net.
We have not appointed a Data Protection Officer. Article 37 GDPR does not require one for processing of this nature and scale, and we would rather say that plainly than imply a role that does not exist. The mailbox above reaches the people who actually handle these requests.
2. What we collect, why, and on what legal basis
Two forms on this site collect personal data. Nothing else on the site does — there is no newsletter, no account, no chat widget and no tracking pixel.
| Where | Data | Purpose | Lawful basis (Art. 6 GDPR) | Retention |
|---|---|---|---|---|
| Project enquiry (/request-quote) | Required: organisation, your name, business e-mail, project type, timeline, budget band, requirement description. | Assessing the requirement, replying, preparing a statement of work. | 6(1)(b) — steps taken at your request before entering a contract. | 24 months from the last contact about the enquiry |
| Project enquiry (/request-quote) | Optional: telephone, country, technology context, estimator selections. | Reaching you faster where you prefer it, and making a later written estimate traceable to what you told us. | 6(1)(f) — legitimate interest. Optional fields cannot be “necessary” for a contract, so they cannot ride on 6(1)(b). You may object and we will delete them. | 24 months from the last contact about the enquiry |
| Contact form (/contact) | Required: name, e-mail, subject, message. | Reading and answering your message. | 6(1)(b) where the message concerns a possible engagement, otherwise 6(1)(f) — our interest in answering correspondence addressed to us. | 12 months from the last message in the thread |
| Contact form (/contact) | Optional: telephone. | Calling you back when that is faster than writing. | 6(1)(f) — legitimate interest, objectable at any time. | 12 months from the last message in the thread |
| Web server | IP address, timestamp, requested URL, status code, user agent, referrer. | Delivering the site, diagnosing faults, and detecting abuse of the forms. | 6(1)(f) — legitimate interest in a functioning, non-abused service. | 30 days (web-server access logs) |
We do not rely on consent for the forms
There is deliberately no consent checkbox on either form. Consent under Article 6(1)(a) must be freely given, and a box you cannot decline while still submitting is not freely given — so it would not be valid consent, and ticking it would misdescribe the basis we actually rely on. Instead, an Article 13 notice appears directly above each submit button, and our API has no consent field to store. It follows that there is no consent to withdraw; your rights under section 6 apply regardless.
Consent is used for one thing only: optional cookies and similar storage. That is covered in the Cookie Policy and can be changed or withdrawn at any time.
3. Who else sees it
We do not sell personal data, and we do not disclose it to third parties for their own purposes. Note that “no transfer to anyone” would be an inaccurate promise the moment any service provider is engaged, so this section names them instead.
- Hosting. Hostinger International Limited operates the virtual private server on which this site and its database run. The server is physically located in Manchester, England, United Kingdom — we checked the server's own IP address on 2026-08-19 rather than relying on the provider's hostname. The United Kingdom is outside the European Economic Area, so this is a transfer to a third country; the mechanism is stated below.
- E-mail. Outbound notification e-mail is switched off. No e-mail provider processes the contents of these forms; submissions are written to our database and read there.
- Analytics and advertising. None is configured. No analytics or advertising script is loaded by this site, with or without your consent, at the time of writing.
- Professional advisers and authorities. Where we are legally obliged to disclose, or need advice on a dispute, under Article 6(1)(c) or 6(1)(f) as applicable.
Transfers outside the EEA
Yes — personal data submitted through this site is processed outside the European Economic Area. It is stored on a server in Manchester, England, United Kingdom, operated by Hostinger International Limited. We say this plainly because it is the kind of fact a privacy policy is most often quietly wrong about, and because you are entitled to know it under Article 13(1)(f) GDPR before you decide whether to write to us.
The transfer is lawful under Article 45 GDPR, on the basis of the European Commission adequacy decision for the United Kingdom, renewed on 19 December 2025 and applicable until 27 December 2031. An adequacy decision means the European Commission has found that the United Kingdom provides a level of protection essentially equivalent to that guaranteed inside the EU, so no additional safeguard or authorisation is required and your rights travel with your data.
In practice this means: your enquiry is written to a database on that server and read there; it is not copied to any other country; the provider acts only as a processor under its own data-processing agreement and has no right to use the content for its own purposes. If the adequacy decision were to lapse or be withdrawn, we would either move the service into the EEA or put standard contractual clauses in place before continuing, and this section would be updated to say which.
4. Security
The site is served over HTTPS. Form submissions are validated on the server, rate-limited per address, and protected by a hidden field that ordinary visitors never see. Access to stored enquiries is restricted to the people who need it. Our engineering work is modelled on the control families in ISO/IEC 27001 Annex A; 2GO Systems OÜ is not certified to that standard or any other, and claims no certification.
5. Automated decision-making and profiling
None. The estimator on this site computes a planning shape from the options you select and produces no decision about you. Nobody is accepted, rejected, scored or ranked by an automated process, and Article 22 GDPR is not engaged.
6. Your rights
Under the GDPR you may request access to your personal data, rectification of it, erasure, restriction of processing, and portability, and you may object to processing based on our legitimate interests — including the optional fields described above. Write to privacy@2gosystems.net and we will respond within one month of receiving your request, as required by Article 12(3). If we need to verify your identity we will ask for the minimum necessary to do so.
You also have the right to lodge a complaint with a supervisory authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia — aki.ee. You may also complain to the authority in your own EU country of residence.
7. Children
This site addresses businesses and public-sector organisations. It is not directed at children and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, write to privacy@2gosystems.net and we will delete it.
8. Changes to this policy
We update this policy when what the site does changes — not on a schedule. The version identifier at the top changes with it, and a change to the cookie categories re-asks for your choice rather than silently inheriting the old one.