Legal
Privacy Policy
Last updated: 17 October 2026
1. Who is responsible for your data
The controller of your personal data is:
- Riverto Group OÜ, a private limited company (osaühing) registered in the Estonian Commercial Register (Äriregister)
- Registry code: 17626784
- Registered address: Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Harju maakond, Estonia
- Email: [email protected]
We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Estonian Personal Data Protection Act (isikuandmete kaitse seadus). We have not appointed a data protection officer, as the law does not require one for our activities; please send any privacy question to the email address above.
Each of our divisions (such as Riverto Digital and TeachForge) operates its own website and publishes its own privacy notice for its services.
2. What data we collect
When you contact us
If you use our contact form or email us, we process your name, email address, the subject and content of your message, and any other information you choose to share.
When you visit the website
Our servers and network provider automatically process technical data needed to deliver and protect the website: IP address, date and time of the request, requested page, browser and device information, and referring page. Your country, derived from your IP address by our network provider, is used once to open the website in Estonian or English; it is not stored. When you submit the contact form we also process your IP address, to limit repeated submissions and detect spam and abuse.
We do not use analytics or advertising trackers on this website.
Is providing data required?
You are not required by law or contract to give us any personal data. Name, email address and message are needed for us to reply to you; without them we cannot answer your enquiry. Technical data is necessary to deliver the website to your device.
3. Why we use it and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering your enquiry and any follow-up correspondence | Art. 6(1)(b) — steps prior to entering a contract, or Art. 6(1)(f) — our legitimate interest in responding to enquiries |
| Operating, securing and preventing abuse of the website (logs, rate limiting, spam detection) | Art. 6(1)(f) — legitimate interest in a secure, working website |
| Showing the website in your likely language | Art. 6(1)(f) — legitimate interest in serving visitors in a language they understand |
| Meeting accounting, tax or other legal obligations | Art. 6(1)(c) — legal obligation |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) — legitimate interest |
We do not use your data for automated decision-making or profiling, and we do not sell personal data.
4. Who we share it with
We share personal data only with service providers that help us run this website, under data processing terms:
- hosting and infrastructure providers that run our servers and our own email server;
- Cloudflare, Inc., which provides our network, content delivery and security services;
- Amazon Web Services EMEA SARL (Amazon SES, EU Stockholm region), which delivers our outgoing email.
We may also pass your enquiry to the division it concerns, and share data with professional advisers, or with authorities where the law requires it.
5. International transfers
Some of our providers may process data outside the European Economic Area. Where this happens, we rely on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework for certified companies) or on the European Commission's Standard Contractual Clauses, together with additional measures where needed. You can ask us for a copy of the relevant safeguards.
6. How long we keep it
- Contact form messages and correspondence: up to 24 months after our last exchange, unless a longer period is needed for a contract or legal claim.
- Server and security logs: up to 90 days.
- Accounting records: as long as the Estonian Accounting Act requires (generally 7 years).
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, or its processing restricted;
- receive your data in a portable format;
- withdraw consent at any time, where processing is based on consent.
Right to object. Where we process your data on the basis of our legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop the processing unless we have compelling legitimate grounds or need the data for legal claims.
To exercise these rights, contact us using the details above. We will respond within one month. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or with the supervisory authority in the EU country where you live or work.
8. Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls and regular updates of our systems.
9. Children
This website is not directed at children under 13, and we do not knowingly collect their personal data.
10. Cookies
See our Cookie Policy for information on cookies and similar technologies.
11. Changes and language versions
We may update this policy from time to time. The current version is always published on this page with its date of last update. This policy is available in Estonian and English; if the versions differ, the Estonian version prevails.