Legal
Privacy Policy
Last updated: July 2026
1. Who we are
This website is operated by Padakonn Pharma OÜ, an Estonian company registered at A. Puškini tn 9-9, 20309 Narva linn, Ida-Viru maakond (registry code 14909524). We are the data controller for personal data processed through padakonn.com.
This policy explains what personal data we collect, why we use it, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR) and applicable Estonian law.
2. Scope
This policy applies to visitors of our public website. We do not offer user accounts or login on the public site. Scientific articles are published from a headless content system and are available for reading only — we do not collect personal data from article visitors beyond what is described below (analytics, technical logs, and cookie consent).
3. Personal data we collect
The personal data we may process depends on how you use the site:
3.1 Inquiry form
Our homepage includes an inquiry form at /#inquiry. If you choose to use it, you may provide:
- Full name — to address you in our reply.
- Email address — to respond to your inquiry.
- Organization (optional) — to understand your context (e.g. fund, company, university).
- Topic — to route your message to the right team.
- Message — the content of your request.
- Helpful next step (optional) — your preferred follow-up (e.g. call, materials, concise reply).
How the form works: submitting the form does not send data to our servers automatically. Your browser assembles an email draft from the fields you entered and copies it to your clipboard. You then paste that draft into your own email application and send it to info@padakonn.com when you are ready. We only receive your personal data when you voluntarily send that email (or contact us by other means). No newsletter subscription is created from the form.
3.2 Analytics
With your consent, we use Google Analytics 4 (GA4) to understand how visitors use our pages (e.g. pages viewed, approximate location, device and browser type). Analytics cookies are not activated until you accept non-essential cookies on our banner. See our Cookie Policy for details.
3.3 Cookie consent preference
We store your cookie consent choice (padakonn-cookie-consent)
in your browser’s local storage so we do not show the consent banner on every visit. This is not used
for profiling or marketing.
3.4 Technical and server logs
Like most websites, our hosting infrastructure (web server / reverse proxy) may automatically record technical data when you request a page, such as your IP address, date and time of access, requested URL, HTTP status code, referrer, and browser user-agent string. These logs are used for security, abuse prevention, and troubleshooting.
4. Purposes and legal bases
Under the GDPR, we process personal data only where we have a lawful basis:
| Processing | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Inquiry emails you send us | Respond to your request; evaluate partnership, investment, scientific, or media inquiries. | Legitimate interests (Art. 6(1)(f)) and/or steps prior to entering a contract (Art. 6(1)(b)), where applicable. |
| Google Analytics 4 | Measure site traffic and improve our public content. | Consent (Art. 6(1)(a)) — only after you choose “Accept all”. |
| Cookie consent storage | Record and honour your cookie choice. | Legitimate interests (Art. 6(1)(f)) in complying with ePrivacy / consent requirements. |
| Server / technical logs | Operate, secure, and maintain the website. | Legitimate interests (Art. 6(1)(f)) in security and reliable hosting. |
Where we rely on legitimate interests, you have the right to object (see Section 9). We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
5. How long we keep data
- Inquiry correspondence: we retain emails and related information for as long as needed to handle your request and any follow-up, and typically up to three years after our last meaningful contact unless a longer period is required for legal, regulatory, or contractual reasons.
- Analytics: Google Analytics retention is configured in line with Google’s settings; aggregated reports may be kept for internal analysis. You can withdraw consent at any time (see Section 9).
- Cookie consent: stored in your browser until you clear site data or change your choice.
- Server logs: generally retained for a limited period (typically up to 90 days) unless needed longer for security investigations.
6. Recipients and third parties
We do not sell your personal data. We may share data with:
- Google Ireland Limited — Google Analytics 4, when you have consented to analytics cookies.
- Hosting and infrastructure providers — who process technical data on our behalf to deliver and protect the website (processors under GDPR Article 28 where applicable).
- Professional advisers or authorities — only when required by law or to protect our legal rights.
The inquiry form itself does not transmit data to third parties; only the email you send from your own mailbox is received by us (and your email provider processes it according to their terms).
7. International transfers
Google may process analytics data on servers outside the European Economic Area, including the United States. Where personal data is transferred to countries without an adequacy decision, Google relies on appropriate safeguards such as the EU Standard Contractual Clauses and supplementary measures as described in Google’s documentation. Google’s privacy information is available at policies.google.com/privacy.
8. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. No method of transmission over the internet is completely secure; when you email us, your email provider’s security also applies.
9. Your rights
If you are in the EEA, you have the following rights regarding your personal data, subject to applicable law and exceptions:
- Access — request a copy of personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data in certain circumstances.
- Restriction — ask us to limit processing in certain cases.
- Data portability — receive data you provided in a structured, machine-readable format where applicable.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent (e.g. analytics), you may withdraw consent at any time without affecting prior lawful processing. Clear site data or use browser settings to reset cookie consent; see our Cookie Policy.
- Complaint — lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at aki.ee or your local supervisory authority.
To exercise your rights, contact us using the details in Section 12. We may need to verify your identity before responding.
10. Children
Our website and services are directed at business, scientific, and professional audiences. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be noted on the website. We encourage you to review this page periodically.
For company identification, disclaimers, and applicable law, see our Legal Notice.
12. Contact
For privacy-related questions or to exercise your rights, contact Padakonn Pharma OÜ:
- Use the inquiry form on our homepage (include “Privacy request” in your message), or
- Email info@padakonn.com from your own mailbox, or
- Write to us at A. Puškini tn 9-9, 20309 Narva linn, Ida-Viru maakond, Estonia.