Privacy Policy

Endel Capital OÜ (registry code 14094252), operating under the unregistered commercial name Ruu Kapital, is the controller of personal data processed through this website.

Registered address: F. R. Kreutzwaldi tn 24, 51006 Tartu, Estonia. Privacy enquiries: rasmus@ruukapital.ee.

When you use the contact form, we collect your name, email address and message. We use this information to respond, assess whether our services may be relevant, take requested steps before entering into a contract, and manage related business correspondence.

The request is first saved in the website database. A notification containing the submitted details is then sent to rasmus@ruukapital.ee, with your email address set as Reply-To. If notification delivery fails, the database record remains available and delivery may be retried.

Depending on the context, processing is based on taking steps at your request before entering into a contract or our legitimate interest in receiving, responding to and keeping an appropriate record of business correspondence. Our legitimate-interest assessment considers the limited data requested, your reasonable expectations, restricted access, retention controls and your right to object.

Booking links open a separate Calendly page operated by Calendly, LLC. Calendly processes the appointment date, time and time zone, your name and email address, and any information you choose to provide in booking questions enabled for the event. Calendly applies its own privacy and cookie information on that page.

Calendly processes invitee data in the United States. Its data processing terms provide for international-transfer safeguards, including Standard Contractual Clauses where applicable.

We use Google Analytics 4 to understand aggregate website usage. Analytics is disabled by default and Google Analytics is not loaded until you select Accept in the cookie notice. We do not send contact-form names, email addresses or message contents to analytics.

If you consent, page views and non-personal events such as booking-button clicks and confirmed contact-form submissions may be recorded. Google and its subprocessors may process analytics data outside the European Economic Area under the safeguards described in Google's applicable data-processing terms.

You may withdraw or change your choice at any time through Cookie settings. Withdrawing consent stops future analytics collection on this website and removes available Google Analytics cookies from your browser. Withdrawal does not affect processing that occurred before it.

We use Lovable Cloud for website hosting, the contact database and managed notification delivery. The contact database is currently hosted in the United Kingdom. Lovable and its documented subprocessors may process data in the United Kingdom, European Economic Area and other documented locations under applicable contractual transfer safeguards.

The notification recipient's mailbox is provided by Purelymail, operated by Add Rabbit LLC in the United States. Purelymail's public information does not identify the storage locations of mailbox content and backups; those locations remain unverified.

We use Calendly, LLC for appointment booking and Google for consent-based analytics. Provider access is limited to what is needed to supply each service. International transfers are governed by the provider terms and safeguards applicable to the relevant processing.

Contact-form records are targeted for retention for 12 months after the last relevant interaction, unless a client relationship begins or a contractual, accounting, regulatory or other legal retention obligation requires longer retention.

Records are not deleted automatically. Before a record can be considered for deletion, an authorised reviewer must reliably confirm its last-interaction date. The record becomes review-eligible only after 12 months and only when it is not protected by an active-client hold or legal-retention hold. An authorised person then reviews the context before any deliberate deletion or anonymisation.

If the last interaction cannot be established reliably, the record is not eligible for deletion. Active client correspondence is not deleted under the contact-request schedule. Email correspondence is generally retained for three years after the last relevant interaction unless a longer legal duty applies. Notification diagnostic logs are targeted for 30 days where the provider permits configuration; provider-controlled retention may differ.

Access to contact requests is restricted to authorised persons and service providers that need access to operate the website, database, email notification, mailbox, booking or analytics services. We apply reasonable organisational and technical measures appropriate to the nature of the information.

We may disclose information where required by law or where necessary to establish, exercise or defend legal claims.

Subject to applicable law, you may request access to, correction or deletion of your personal data, restriction of processing, data portability where applicable, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent at any time.

To exercise your rights, contact rasmus@ruukapital.ee. You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or another competent supervisory authority.

We may update this policy when our practices or legal obligations change. The effective date above identifies the current version.