Legal
Privacy Policy
Last updated: 9 October 2026 · ezyClients OÜ, Narva mnt 7-652, 10117 Tallinn, Estonia
1. Who we are
Ardoca, a service operated by ezyClients OÜ (“ezyClients”, “we”, “us”), provides a platform for immigration, relocation, legal and HR firms to collect, check and manage documents and form data from their own clients.
ezyClients OÜ is an Estonian private limited company, Narva mnt 7-652, Kesklinna linnaosa, 10117 Tallinn, Harju maakond, Estonia.
- Privacy and data protection: [email protected]
- Support: [email protected]
- Phone: +31 6 16 19 33 23
This Privacy Policy explains how we handle personal data in two distinct contexts:
- when we act as a controller, deciding the purposes and means of processing (sections 2 to 11); and
- when we act as a processor, processing data on behalf of our Customers (section 12).
2. Data we collect as controller and where it comes from
| Category | Whose data | What we collect | Source |
|---|---|---|---|
| Website | Visitors of ardoca.com | Technical data needed to deliver the website (such as IP address and browser type in server and network logs) | You, your browser |
| Accounts | Authorised Users of our Customers | Name, e-mail address, role, organisation, login and security logs (such as sign-in times and two-factor settings) | You, or the Customer that invites you |
| Billing and contract | Customer contacts | Name, business contact details, company details, subscription, invoices and payment records | You or your company |
| Support | Anyone who contacts us | Your e-mail address, name and the content of your messages and attachments | You |
| Product analytics | Authorised Users and End Clients using the application, only after consent | Usage events, errors and fully masked session replays recorded in your browser in the application | Your browser, only after you consent via the cookie banner |
| Server logs and error reports | Authorised Users and End Clients using the application | Technical logs and error reports from our servers, carrying identifiers only (such as user, organisation and request identifiers), never names, contact details, form answers or file contents | Our servers, when you use the application |
| B2B prospecting | Business professionals | Names, job titles, company affiliations and professional contact details | Publicly available sources such as LinkedIn, company websites or public business directories |
2.1 B2B prospecting
From time to time, we may collect and process publicly available personal data (such as names, job titles, company affiliations, and professional contact details) from sources such as LinkedIn, company websites, or public business directories. This processing is done for the purpose of reaching out with relevant information about our services, building professional relationships, or exploring potential business opportunities.
If we contact you using such information, we do so in a manner that respects your privacy rights. You always have the right to object, at any time, to the processing of your personal data for direct marketing purposes. You can do this by replying to the message you received from us or by contacting us at [email protected].
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Delivering and securing the website | Art. 6(1)(f): our legitimate interest in operating a secure website |
| Creating and running accounts, signing in, providing the service | Art. 6(1)(b): performance of the contract with the Customer; for Authorised Users who are not the contracting party, Art. 6(1)(f): our legitimate interest in providing the service the Customer ordered |
| Security logging, preventing abuse and fraud | Art. 6(1)(f): our legitimate interest in keeping the service and our Customers’ data secure |
| Billing, invoicing and accounting | Art. 6(1)(b): performance of the contract; Art. 6(1)(c): legal obligations under Estonian accounting and tax law |
| Answering support requests | Art. 6(1)(b) where related to the contract; otherwise Art. 6(1)(f): our legitimate interest in answering your questions |
| Product analytics, error tracking and masked session replay in your browser in the application | Art. 6(1)(a): your consent, given via the cookie banner |
| Server-side error and log telemetry (identifiers only), used to detect, diagnose and fix faults | Art. 6(1)(f): our legitimate interest in running a reliable and secure service; it does not depend on cookie consent |
| B2B prospecting and direct marketing | Art. 6(1)(f): our legitimate interest in promoting and growing our business through business-to-business (B2B) outreach, provided it does not override your fundamental rights and freedoms |
| Establishing, exercising or defending legal claims | Art. 6(1)(f): our legitimate interest in protecting our rights |
Where processing is based on consent, you can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
4. Recipients
We share personal data only with service providers that help us run Ardoca and process it on our instructions, with authorities where the law requires it, and with professional advisers where needed. Our service providers include:
- Hetzner Online GmbH (Germany): servers and database hosting;
- Cloudflare, Inc.: file storage and backups, DNS, TLS proxy and network protection;
- Amazon Web Services EMEA SARL (Amazon SES, Frankfurt): transactional e-mail;
- PostHog Inc. (EU Cloud, Frankfurt): in the application, product analytics, error tracking and masked session replay in your browser, only after consent; and server-side error and log telemetry carrying identifiers only, on the basis of our legitimate interest;
- Google LLC / Google Ireland (Google Workspace): our company e-mail used for support.
The full list of sub-processors for Customer data is published at /legal/subprocessors.
We do not sell personal data.
5. International transfers
Our servers, database, file storage and backups are located in the EU (Germany). Some processing may involve transfers outside the European Economic Area:
- Cloudflare: network traffic passes Cloudflare’s global edge network; this is covered by Cloudflare’s data processing agreement and the EU Standard Contractual Clauses.
- Google Workspace: support e-mails may be processed in the EU and the US under Google’s data processing agreement and the EU Standard Contractual Clauses.
You can request a copy of the relevant safeguards by writing to [email protected].
6. Retention
| Category | Retention period |
|---|---|
| Account data of Authorised Users | For the term of the Customer’s contract; after it ends, kept for 30 days so that the Customer can export its data, then deleted within a further 30 days |
| Sign-in records and the audit log | Up to 12 months |
| Billing and contract records | As required by Estonian accounting law (7 years) |
| Support e-mails | Up to 3 years |
| B2B prospecting data | Until you object, or 2 years without contact, whichever comes first |
| Backups | Deleted after 30 days |
We may keep data longer only where the law requires it or where it is needed to establish, exercise or defend legal claims.
7. Your rights
Under the GDPR you have the right to:
- access your personal data;
- rectify inaccurate data;
- erase your data;
- restrict processing;
- data portability;
- object to processing based on legitimate interests, and at any time to processing for direct marketing;
- withdraw consent at any time.
To exercise these rights, e-mail [email protected]. We will respond within one month, as required by the GDPR.
If you are a client of a firm that uses Ardoca, please contact that firm directly (see section 12).
8. Complaints
You have the right to lodge a complaint with a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), https://www.aki.ee. You may also complain to the authority in the EU country where you live or work.
9. Security
We implement appropriate technical and organisational measures to secure personal data against unauthorised access, loss, or misuse. These include:
- all servers, database, file storage and backups in the EU (Germany);
- HTTPS only (TLS 1.2 and 1.3) and encryption of files and backups at rest (AES-256);
- private storage with short-lived signed links, and no public buckets;
- strict isolation of each Customer’s data;
- passwords hashed with bcrypt, optional two-factor authentication, and sessions that expire after 1 hour;
- role-based access control, restricted operator access and logging without personal data;
- regular backups and continuous monitoring.
Our security controls are reviewed regularly.
10. Cookies
Information about the storage and cookies used on ardoca.com and in the application is in our Cookie Policy. ardoca.com sets no tracking or analytics cookies.
11. Automated decision-making
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
12. Data we process for our customers
When firms use Ardoca to collect and manage documents and data from their own clients (“End Clients”), we act as a processor on behalf of that firm (the “Customer”). The Customer is the controller. This data may include names, contact details, passports, employment information, criminal record disclosures, documents uploaded by End Clients and communication with the firm.
In this role:
- we process the data only on the Customer’s documented instructions, under our Data Processing Agreement;
- we do not use it for our own purposes and never use it to train AI models;
- optional AI document checks are used only if the Customer switches them on.
If you are an End Client (a client of a firm using Ardoca), your data is controlled by that firm. Please direct any questions or rights requests to the firm.
13. Changes to this policy
We may update this Privacy Policy from time to time. Changes are published on this page with a new “updated” date. Material changes are announced to Customers by e-mail at least 30 days before they take effect, except changes required by law.
14. Contact
For all questions or requests related to privacy:
ezyClients OÜ, Narva mnt 7-652, Kesklinna linnaosa, 10117 Tallinn, Harju maakond, Estonia