A clear approach to your information.

Last updated: October 14, 2026.

1. Data controller and contact details

MadRankMedia OÜ is the controller of personal data processed for the purposes described in this notice. MadRankMedia is its consultancy brand. The company is registered in Estonia under registration number 17509920, with its registered address at Rebase tn 5-9, 50104 Tartu, Estonia.

Website: https://madrankmedia.com. For privacy questions or to exercise your rights, email privacy@madrankmedia.com or write to the registered address above.

2. Personal data we collect

We collect information you provide directly and technical information associated with use of the website and its contact services:

• Consultation and contact information: your name, business email address, industry, message and, if provided, website URL. This also includes your acknowledgment of the privacy notice and subsequent correspondence about your request.
• Business relationship information: relevant contact details, proposals, agreements, invoicing information and other records if an inquiry develops into a business relationship.
• Technical and security information: IP addresses, request times, requested URLs, browser or device information and information used to identify errors, spam or abuse. The exact records retained by our hosting and form providers depend on their services and configuration.

Please provide only information relevant to your inquiry. Do not submit passwords, payment card information or special-category personal data, such as health information. The optional website field can be left blank. Required contact fields help us understand and respond to your request; without sufficient information, we may be unable to do so.

3. Purposes and legal bases under Article 6 GDPR

The applicable legal basis depends on the purpose and your relationship with MadRankMedia OÜ. We do not treat all contact processing as consent-based.

• Steps before a contract and contract performance — Article 6(1)(b): responding to a consultation request and discussing services where you are a prospective contracting party asking us to take steps before entering a contract; and providing agreed services where you are a party to the contract.
• Business correspondence — Article 6(1)(f): answering general inquiries and communicating with representatives of businesses where those individuals are not personally parties to the contract. Our legitimate interests are handling relevant requests, assessing potential business relationships and managing business communications. We consider necessity, reasonable expectations and the impact on the individuals concerned.
• Website security and legal claims — Article 6(1)(f):operating and protecting the website, preventing spam and abuse, investigating technical problems, and establishing, exercising or defending legal claims. These legitimate interests are assessed against your rights and freedoms.
• Legal obligations — Article 6(1)(c): keeping accounting and other records required by applicable Estonian law, including the Accounting Act, and responding to legally binding requests from competent authorities.
• Consent, where separately applicable — Article 6(1)(a):if we introduce an optional activity that requires consent, we will explain it separately and obtain an appropriate choice before that processing begins. You can withdraw such consent without affecting the lawfulness of processing before withdrawal.

The contact form checkbox records that you have read this notice. It is an acknowledgment, not consent to all processing and not a marketing opt-in. Submitting a consultation request does not subscribe you to a newsletter.

4. Formspree and contact form processing

We use Formspree as the contact form processor. When a connected form is submitted, its contents are transmitted directly from your browser to Formspree, which processes the submission and routes it according to our account settings. Formspree may also process technical information associated with submission and abuse prevention. If the form is not connected, submissions are disabled.

The form includes validation and a spam-prevention field. The acknowledgment does not change the legal bases described above. Formspree processing, storage, notifications and deletion depend on the services and settings enabled. Its own activities, such as service security, may also be covered by its provider notice. See Formspree’s privacy policy.

5. Cloudflare and website hosting

Cloudflare hosts this static website and provides content delivery and related security services. Requests pass through Cloudflare, which may process IP addresses, request metadata and security or diagnostic information to deliver and protect the site.

Processing and logging depend on the Cloudflare products and features configured for this website. A hosting request and a consultation submission are different activities: the contact form sends its contents to Formspree. Details of Cloudflare’s own processing are available in Cloudflare’s privacy policy.

6. Cookies and similar technologies

The website implementation does not add analytics, advertising cookies or tracking scripts. We do not use the consultation form to build advertising profiles.

Hosting or form security features may use cookies or similar technologies, depending on the features enabled. This includes possible Cloudflare security or bot-protection features and any additional form protection selected. Cookie names, purposes and lifetimes depend on the features actually in use.

Cookies strictly necessary for a requested service may qualify for an exemption from prior consent under applicable rules. Any future nonessential cookies or tracking would require appropriate information and consent before activation. You can manage cookies through your browser, although blocking necessary security functionality may affect access or submissions.

7. How long we retain personal data

Our retention policy limits storage to what is needed for the relevant purpose or required by law:

• Unsuccessful consultation inquiries: up to 12 months after the last meaningful interaction. Records may be deleted earlier when they are no longer needed.
• Accounting and qualifying business records: seven years, with the starting point and calculation determined in accordance with the applicable Estonian legal requirements for the record type and relevant financial year. This does not mean every consultation message is retained for seven years.
• Legal claims: longer only where retaining relevant records is necessary and legally justified to establish, exercise or defend a claim or comply with an applicable obligation. Such records are limited to the relevant purpose.
• Technical logs: for periods determined by applicable security and operational needs and verified provider policies. There is no single fixed period stated here for all Formspree and Cloudflare logs.

This schedule covers records under our control, including form dashboards, email copies and exports. Provider security records and backups may have distinct retention or deletion cycles under the applicable service terms and settings for the services in use.

8. Service providers and other recipients

Relevant personal data may be accessible to Formspree, Cloudflare and their authorized subprocessors as needed to deliver their services. Email and business communication providers may receive correspondence where needed to respond to you. Relevant records may also be shared with professional advisers or competent authorities where necessary for legal obligations or the establishment, exercise or defense of legal claims.

Where a provider acts as our processor, we require an appropriate data processing arrangement under Article 28 GDPR. Access is limited to the information needed for the relevant purpose. Providers may separately act as controllers for some of their own activities, as described in their notices and applicable terms.

9. International data transfers

Formspree and Cloudflare provide services internationally. Depending on the service arrangements and features used, personal data may be processed outside Estonia and the European Economic Area, including in the United States.

For transfers subject to Chapter V GDPR, we require an applicable mechanism, such as an adequacy decision covering the recipient or European Commission-approved Standard Contractual Clauses, with transfer assessments and supplementary measures where necessary. The mechanism must cover the actual recipient, service and transfer; the availability of a provider’s general transfer terms alone does not establish this.

Contact privacy@madrankmedia.com for information about applicable destinations and safeguards, or a copy of relevant safeguards, subject to necessary redactions protecting confidential information or other individuals.

10. Your individual rights

Subject to the conditions and exceptions in the GDPR, you may:

• Request access to your personal data and a copy of it.
• Ask us to correct inaccurate or incomplete data.
• Request erasure where the applicable conditions are met.
• Request restriction of processing in the circumstances provided by law.
• Receive data you provided in a structured, commonly used and machine-readable format, and request its transmission where data portability applies to automated processing based on consent or a contract.
• Object to processing based on legitimate interests for reasons relating to your particular situation. We must stop unless we can demonstrate overriding compelling legitimate grounds or the processing is needed for legal claims.
• Withdraw consent if a particular activity is based on consent. This does not apply to processing supported by another legal basis.
• Lodge a complaint with a competent supervisory authority.

Send requests to privacy@madrankmedia.com. We may request proportionate information to verify your identity. We normally respond within one month of receipt. Where permitted because of complexity or the number of requests, that period may be extended by up to two further months; we will explain the extension within the initial month. Rights are not absolute, and records required for legal obligations or claims may need to be retained.

In Estonia, the supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): www.aki.ee/en. You may also complain to the authority in the EEA country of your habitual residence, place of work or an alleged infringement. You do not have to contact us before making a complaint.

11. Security

We apply measures appropriate to the nature of the data and the risks involved. The website and configured form endpoint use HTTPS, and the form includes validation and spam protection. Access to stored submissions and correspondence is restricted to authorized purposes. No internet transmission or storage system can be guaranteed completely secure. Please limit the personal information you include in a request.

12. Automated decision-making

We do not use website inquiries for solely automated decisions that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. Automated security and spam filters may screen or block suspected abusive traffic and submissions. If you believe a legitimate message was blocked, contact us at the privacy email address above.

13. Changes to this notice and further information

We may update this notice when our services, providers or data handling change. The date above identifies the latest revision. Where a change requires additional notice or a separate choice, we will provide it as appropriate.

For any question about this notice, contact MadRankMedia OÜ at privacy@madrankmedia.com or Rebase tn 5-9, 50104 Tartu, Estonia.