Privacy and Cookie Policy

This Privacy Policy is adopted by 1oT OÜ (registry code 14611026, address Järvevana tee 7b, 10112 Tallinn, Estonia, email hello@1oT.com  (1oT, we, us and our). 1oT is the owner and operator of 1oT website https://1oT.com, its subdomains (collectively: the Website) and the services introduced through Website.

Unless defined in this Privacy Policy, the terms used in Privacy Policy are used in the meaning given to them in Article 4 of the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

This Privacy Policy sets out the principles of processing your personal data by 1oT when you use our services and our Website. If you have any questions about how we process your personal data or if you wish to submit an application for exercising your rights related to processing your personal data, please contact us through the contact information provided in the section "Contacts" below.

1.  DEFINITIONS

"Personal data"	Any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular on the basis of such a record as the name, personal identification code, place of location information or network identifier, or on the basis of one or more physical, physiological, genetic, mental, economic, cultural or social identities.
“Data subject”	Natural person whose personal data is processed by 1oT.
“Processing”	Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Data controller”	Natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
“Data processor”	Natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
“Services” or “Service”	Services provided by 1oT pursuant to our Terms of Service as available on the Website.

2. WHY WE PROCESS PERSONAL DATA AND WHAT PERSONAL DATA DO WE PROCESS?

2.1. When you have opted to use our Services, we need to process your personal data to enable the Services to you.

2.2. We process personal data that is submitted to us directly by you in the course of using our Services or that we obtain in the course of your use of the Services.

2.3. We may also process personal data that is submitted to us directly by you also if you contact us with a query or question via Website or via any other channel (by sending an e-mail, for example). In such a case we process your personal data included in the inquiry to the extent that is necessary to respond to you.

2.4. Personal data we process about you in the course of using our Services may include the following data about you:

 2.4.1. general personal information: first name and last name that you disclose to us when you purchase our Services;

 2.4.2. contact details: email address, phone number, delivery address that you disclose to us when you purchase our Services;

 2.4.3. payment data: if your use of the Services is subject to a fee, then the payment data related to the Services purchased by  you;

 2.4.4. usage data: we also collect information about how you use the Website and our Services, to amend and better adapt the  Services to you.

3. WHAT IS THE LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA?

3.1. We process your personal data to provide Services to you (please read 1oT Terms of Service as available on our Website). Legal basis for such data processing is GDPR Article 6-1-(b), i.e. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

3.2. In certain specific situations we might also process your personal data where this is necessary for the purpose of our legitimate interests pursued by us. Legal basis for such data processing is GDPR Article 6-1-(f). In such a case we shall ensure that processing is proportionate and that we have carried out legitimate interest impact assessment. For example, for the purpose of our legitimate interest we analyse how our Services and Website are used by our customers so we can provide better service.

3.3. In certain specific situations we may also process your personal data based on your consent. Legal basis for such data processing is GDPR Article 6-1-(a). In those situations, we process your personal data on the terms provided in the consent that you have granted to us.

3.4. Additionally, we might process your personal data when processing is necessary for compliance with a legal obligation to which we are subject, for example for accounting purposes under applicable accounting legislation. Legal basis for such data processing is GDPR Article 6-1-(c).

3.5. More specifically, we rely on following legal bases when processing your personal data:

Purpose of processing	Types of personal data	How have we obtained personal data	Legal basis for processing	Retention period
Enabling the creation of user account.	First name, last name, e-mail address, phone number, delivery information (if applicable).	Directly from each data subject.	Performance of the contract under the Terms of Service with the data subject – GDPR art. 6 (1) (b). After the termination of the contractual relationship with the data subject (under the Terms of Service) - legitimate interest of 1oT– GDPR art. 6 (1) (f).	During the term of the contract with the data subject under the Terms of Service. After the termination of the contract under the Terms of Service - three years based on our legitimate interest until the end of the limitation periods under applicable law.
Enabling the use of the Services.	Information about the usage statistics of clients’ SIM cards (how many MBs consumed and when, what country/network, and how many SMS sent and when, what country/network).	Automatically in the course of your use of the Service.	Performance of the contract under Terms of Service with the data subject – GDPR art. 6 (1) (b). After the termination of the contractual relationship with the data subject (under the Terms of Service) - legitimate interest of 1oT– GDPR art. 6 (1) (f).	During the term of the contract with the data subject under the Terms of Service. After the termination of the contract under the Terms of Service - three years based on our legitimate interest until the end of the limitation periods under applicable law.
Payment for the Service.	Information concerning the amounts paid or unpaid by you to us for the use of the Service.	Automatically in the course of your use of the Service.	Performance of the contract under the Terms of Service with the data subject – GDPR art. 6 (1) (b). After the termination of the contractual relationship with the data subject (under the Terms of Service) - legitimate interest of 1oT– GDPR art. 6 (1) (f).	During the term of the contract with the data subject under the Terms of Service. After the termination of the contract under the Terms of Service – three years based on our legitimate interest until the end of the limitation periods under applicable law.
Answering the inquires of the data subject.	Name, e-mail and other personal data that is submitted to us directly by you also if you contact us with a query or question via Website or via any other channel (by sending an e-mail, for example).	Directly from each data subject.	To answer to the request of the data subject and our legitimate interest – GDPR art. 6 (1) (b) and GDPR art. 6 (1) (f).	Until the end of the limitation period of the claim related to which the inquiry is submitted. Generally, such term is three years.
Provision of marketing content.	First name, last name, e-mail address; statistics concerning your use of the Services and the Website.	Directly from each data subject; statistics concerning your use of the Services and the Platform is collected by 1oT.	Consent by data subject - GDPR art. 6 (1) (a).	Until the withdrawal of the consent.

4. WHEN DO WE SHARE YOUR PERSONAL DATA?

4.1. To the extent this is necessary for the provision of our Services, we may share your personal data with certain third parties.

4.2. We may also share your personal data with third party suppliers providing services to us, e.g. IT suppliers or other service providers. At the moment of adopting this Privacy Policy, we use the following service providers:

  4.2.1. Braintree, a payment service by PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal L-2449, Luxembourg to   enable you to make payments for Services; privacy terms for Braintree are available here:   https://www.braintreepayments.com/ee/legal/braintree-privacy-policy;

  4.2.2. Hotjar, Ltd, for data analytics to acquire knowledge on how our Services are used. Privacy terms for Hotjar, Ltd., are   available at https://www.hotjar.com/legal/policies/privacy;

  4.2.3. Mailchimp service by Rocket Science Group LLC d/b/a Mailchimp, to send newsletters and marketing; privacy terms for  Mailchimp are available here: https://mailchimp.com/legal/;

  4.2.4. Freshdesk service by Freshdesk, Inc for customer support ticketing; privacy terms for Freshdesk are available here:   https://www.freshworks.com/privacy/.

4.3. We may also transfer your personal data to third countries, i.e. countries outside the EU/EEA area, for the purposes explained in this Privacy Policy. When transferring your personal data to third countries, we will ensure that the transfer is subject to appropriate safeguards under GDPR and that your rights are protected, such as the Commission’s model contracts for the transfer of personal data to third countries (i.e., the standard contractual clauses), pursuant to Decision 2004/915/EC and/or 2010/87/EU. You may request a copy of the safeguards we have put in place with respect to the transfer of personal data by contacting us via contact details below.

5. HOW LONG IS YOUR PERSONAL DATA RETAINED?

5.1. 1oT does not retain personal data longer than it is necessary for the purposes of processing personal data or pursuant to applicable law.

5.2. Personal data related to contracts can be retained during the term of the contract and based on our legitimate interest pursuant to Article 6 (1) (f) of the GDPR until the end of the statutory limitation periods under applicable law. Accordingly, as a general rule, 1oT retains your personal data as long as it is necessary for the provision of the Services during the term of the contract concluded between you and 1oT and for three years after the term of the contract. In this regard, as a general rule, if you have not used our Services for three years, your profile and all personal data therein will be deleted, unless we have a legal basis for retaining your personal data for a longer time period.

5.3. Pursuant to the Accounting Act, we may retain accounting documents for seven years.

5.4. More specific terms concerning the retention periods of your personal data are outlined in the table in Section 3 above.

6. HOW DO WE PROTECT YOUR PERSONAL DATA?

To protect your personal data from unauthorised access, unlawful processing or disclosure, accidental loss, modification or destruction, we use appropriate technical and organisational measures that comply with applicable laws. These measures include but are not limited to the implementation of appropriate computer security systems, protection of paper and electronic format files by technical and logical means, controlling and limiting access to documents and buildings.

7. COOKIES

7.1. Our Website uses cookies. This section incorporates our cookie policy (the Cookie Policy) that applies when you use Website.

7.2. Cookies are small data files stored on your hard drive by a website. Cookies help us monitor and improve the functionality and usage of our Website and your experience when using our Services. We can use cookies to see which areas and features are popular and to count visits to our Website to recognise you as a returning visitor and to tailor your experience of the Website according to your preferences. We may also use cookies for targeting or advertising purposes.

7.3. We use following type of cookies on our Website:

  7.3.1. Strictly necessary cookies, that are essential in order to enable you to move around and navigate on Platform and use the features of Website.

  7.3.2. Statistics cookies, that record information about the way our Website is used, to acquire knowledge on how often our Website is visited, where on our Website our visitors spend the most time, how often they interact with a page or part of a page, this allows us to make the structure, navigation, and content of our Website as user-friendly as possible.

We also categorise the cookies as follows:

  7.3.3. Functional cookies, that allow Website to remember the user's site preferences and choices they make on the site including username, region, and language.

  7.3.4. Performance cookies, that monitor Website performance and collect anonymous data on how visitors use a website. These cookies provide information to help improve how a Website works. Functionality cookies are used to remember user preferences so that the Website can be customised for them.

  7.3.5. Analytics cookies, that are used to track Website visitors and their user behaviour. This data is then used to improve the way the Website works and in turn, used to improve user experience. Google Analytics (GA) cookies are one of the most common analytics cookies set by websites.

  7.3.6. Advertisement and targeting cookies, that are specifically designed to gather information from you on your device to display advertisements to you based on relevant topics that interest you. Please read more about analytic and targeting tools used by us in clause 7.4.

7.4. Analytic tools and targeted advertising

On our Website we use Google Analytics, a web analytics service by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (in the following: “Google”) for the purpose of creating a Website experience tailored to users’ needs and continuing optimisation of our website. Google Analytics tracking and targeting measures are used out on the basis of GDPR art. 6 (1) (f).

The information on the usage of our Website generated by the cookie (e.g. IP-address of the accessing computer, time of access, referrer-URL as well as information on the browser and operation system used) will be send to and processed by the server of Google in the USA. Using Google Analytics is based on your consent in accordance with GDPR art. 6 (1) (a) if you consent to using of this types of cookies when visiting our Website. You may revoke your consent at any time and you are not required to grant consent. If you do not consent with use of all cookies, cookies related to Google Analytics will not be placed on your device.

Google processes the information on our instructions for analysing the website-usage, for reporting on website-activities and for providing us with further services in connection with website- and internet-usage and need-based layout and design of this website. We have concluded a data processing agreement with Google for the use of Google Analytics. Through this contract, Google assures that they process the data in accordance with the General Data Protection Regulation and guarantee the protection of the rights of the data subject. We only use Google Analytics with IP-anonymisation active. You can find information on the use of data by Google in their privacy policy (https://policies.google.com/privacy?hl=en).

Cookies used for targeted advertising enable us to offer you the best possible user experience and to show you advertising that meets your particular interests. Targeting cookies placed on our Website include cookies provided by LinkedIn (LinkedIn LLC, 1000 West Maude Avenue Sunnyvale, CA 94085 USA (in the following: “LinkedIn”)) and Facebook (Meta Platforms Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin, Ireland (in the following “Facebook”). Again, use of targeted advertising is based on your consent in accordance with GDPR art. 6 (1) (a) if you consent to using of targeting advertising related cookies when visiting our Website. You may revoke your consent at any time and you are not required to grant consent. If you do not consent with use of all cookies, cookies related to targeted advertising will not be placed on your device. You can find information on the use of data by LinkedIn in their privacy policy (https://www.linkedin.com/legal/privacy-policy) and information on the use of data by Facebook on their privacy policy (https://www.facebook.com/privacy/policy).

7.5. The specific cookies that the Website uses are the following:

Cookie	Description	Duration	Provider	Type
site_lang	This cookie is set by Voog and is used to store the language preferences of a user.	2 years	Voog service (Edicy OÜ), more information: https://www.voog.com/privacy	Functional
_gcl_au	This cookie is used by Google Analytics to understand user interaction with the website.	2 months	Google LLC, more information https://policies.google.com/privacy?hl=en	Analytics
__ewsa	This cookie is set by Voog and used for analytics of the web page.	2 years	Voog service (Edicy OÜ), more information: https://www.voog.com/privacy	Analytics
__ewsb	This cookie is set by Voog and used for analytics of the web page	30 minutes	Voog service (Edicy OÜ), more information: https://www.voog.com/privacy	Analytics
_ga	This cookie is installed by Google Analytics. The cookie is used to calculate visitor, session, campaign data and keep track of site usage for the site's analytics report. The cookies store information anonymously and assign a randomly generated number to identify unique visitors.	2 years	Google LLC, more information https://policies.google.com/privacy?hl=en	Analytics
_gid	This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a Website and helps in creating an analytics report of how the website is doing. The data collected including the number of visitors, the source where they have come from, and the pages visited in an anonymous form.	1 day	Google LLC, more information https://policies.google.com/privacy?hl=en	Analytics
_gat_UA-84286321-1	This is a pattern type cookie set by Google Analytics, where the pattern element on the name contains the unique identity number of the account or Website it relates to. It appears to be a variation of the _gat cookie which is used to limit the amount of data recorded by Google on high traffic volume websites.	1 minute	Google LLC, more information https://policies.google.com/privacy?hl=en	Performance
li_sugr	This cookie is set by LinkedIn and is used to track visitors on multiple websites, in order to present relevant advertisement based on the visitor's preferences.	2 months	LinkedIn LLC, more information https://www.linkedin.com/legal/privacy-policy	Advertisement
lang	This cookie is used to store the language preferences of a user to serve up content in that stored language the next time a user visits the website.		LinkedIn LLC, more information https://www.linkedin.com/legal/privacy-policy	Functional
lidc	This cookie is set by LinkedIn and used for routing.	1 day	LinkedIn LLC, more information https://www.linkedin.com/legal/privacy-policy	Functional
_fbp	This cookie is set by Facebook to deliver advertisements when they are on Facebook or a digital Website powered by Facebook advertising after visiting this website.	2 months	Meta Platforms Ltd, more information https://www.facebook.com/privacy/policy	Advertisement
fr	The cookie is set by Facebook to show relevant advertisements to the users and measure and improve the advertisements. The cookie also tracks the behaviour of the user across the web on sites that have Facebook pixel or Facebook social plugin.	2 months	Meta Platforms Ltd, more information https://www.facebook.com/privacy/policy	Advertisement
UserMatchHistory	Linkedin - Used to track visitors on multiple websites, in order to present relevant advertisements based on the visitor's preferences.	4 weeks	LinkedIn LLC, more information https://www.linkedin.com/legal/privacy-policy	Advertisement
bcookie	This cookie is set by LinkedIn. The purpose of the cookie is to enable LinkedIn functionalities on the page.	2 years	LinkedIn LLC, more information https://www.linkedin.com/legal/privacy-policy	Functional
bscookie	This cookie is a browser ID cookie set by Linked share Buttons and ad tags.	2 years	LinkedIn LLC, more information https://www.linkedin.com/legal/privacy-policy	Advertisement
lissc	This cookie is provided by LinkedIn. This cookie is used for tracking embedded service.	1 year	LinkedIn LLC, more information https://www.linkedin.com/legal/privacy-policy	Analytics

7.6. You can delete or block cookies on Website through your browser settings at any time. However, some cookies might be necessary for the functionality of Website. Therefore, you understand that when blocking or deleting the cookies some features of Website might not function correctly.

7.7. For more general information about cookies including the difference between session and persistent cookies please see www.allaboutcookies.org.

7.8. In case you have any question concerning Cookie Policy, you may contact us via contact details provided below.

8. YOUR RIGHTS

8.1. 1oT is dedicated to ensuring that all data subject rights arising under applicable law are always guaranteed to you. In particular, any data subject has:

  8.1.1. the right to access the personal data that 1oT processes about you;

  8.1.2. the right to request that 1oT rectifies any inaccurate personal data about you;

  8.1.3. the right to request 1oT to erases your personal data and/or restricts of processing of your personal data if we do not have valid legal basis for processing;

  8.1.4. the right to receive your processed personal data in a structured, commonly used and machine-readable format and have the right to transmit your personal data to another controller;

  8.1.5. the right to object to the processing of your personal data.

8.2. If you believe that your rights have been infringed, you may contact and lodge a complaint to the supervisory authority applicable for your jurisdiction (Data Protection Inspectorate in Estonia address Tatari 39, Tallinn 10134, info@aki.ee or other competent authority in your jurisdiction; contact details of data protection supervisory authorities in EU can be find here https://www.eudpr.com/supervisory-authorities).

9. GOVERNING LAW AND JURISDICTION

This Privacy Policy shall be governed by the laws of the Republic of Estonia. Any disputes arising from these Privacy Policy shall be settled in the Harju County Court in the Republic of Estonia, unless you have a right to turn to the court of your residence pursuant to statutory law.

10. CONTACTS

If you have any questions about this Privacy Policy or Cookie Policy or if you have any concerns about how we use your personal or if you want to exercise your rights as described above, you may contact us via e-mail or in writing using the following contact information:

1oT OÜ
e-mail: hello@1oT.com
address: Järvevana tee 7b, 10112 Tallinn, Estonia