Legal
Privacy Policy
Last updated: 1 October 2026
1. Who is responsible for your data
The controller of your personal data is:
- Riverto Group OÜ, a private limited company (osaühing) registered in Estonia
- Email: contact [at] rivertogroup.com
We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Estonian Personal Data Protection Act (isikuandmete kaitse seadus). Each of our divisions (such as Riverto Digital and TeachForge) operates its own website and publishes its own privacy notice for its services.
2. What data we collect
When you contact us
If you use our contact form or email us, we process your name, email address, the subject and content of your message, and any other information you choose to share.
When you visit the website
Our servers and network provider automatically process technical data needed to deliver and protect the website: IP address, date and time of the request, requested page, browser and device information, and referring page. When you submit the contact form we also record your IP address and the approximate location (country and city) derived from it, to detect spam and abuse.
We do not use analytics or advertising trackers on this website.
3. Why we use it and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering your enquiry and any follow-up correspondence | Art. 6(1)(b) — steps prior to entering a contract, or Art. 6(1)(f) — our legitimate interest in responding to enquiries |
| Operating, securing and preventing abuse of the website (logs, rate limiting, spam detection) | Art. 6(1)(f) — legitimate interest in a secure, working website |
| Meeting accounting, tax or other legal obligations | Art. 6(1)(c) — legal obligation |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) — legitimate interest |
We do not use your data for automated decision-making or profiling, and we do not sell personal data.
4. Who we share it with
We share personal data only with service providers that help us run this website, under data processing agreements:
- hosting and infrastructure providers that run our servers and email systems;
- Cloudflare, which provides our network, content delivery and security services;
- IP geolocation services, which receive the IP address of contact form submissions to return an approximate location;
- Telegram, which we use for internal notifications of new contact form messages.
We may also pass your enquiry to the division it concerns, and share data with professional advisers, or with authorities where the law requires it.
5. International transfers
Some of our providers may process data outside the European Economic Area. Where this happens, we rely on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework for certified companies) or on the European Commission's Standard Contractual Clauses, together with additional measures where needed.
6. How long we keep it
- Contact form messages and correspondence: up to 24 months after our last exchange, unless a longer period is needed for a contract or legal claim.
- Server and security logs: up to 90 days.
- Accounting records: as long as Estonian accounting law requires (generally 7 years).
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, or its processing restricted;
- receive your data in a portable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, where processing is based on consent.
To exercise these rights, contact us using the details above. We will respond within one month. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or with the supervisory authority in the EU country where you live or work.
8. Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls and regular updates of our systems.
9. Children
This website is not directed at children under 13, and we do not knowingly collect their personal data.
10. Cookies
See our Cookie Policy for information on cookies and similar technologies.
11. Changes to this policy
We may update this policy from time to time. The current version is always published on this page with its date of last update.