1. Controller and scope
The controller of personal data processed through the biis. studio and marketing website is Trippbo OÜ, Estonian private limited company (osaühing), registration number 17187333, VAT number EE102924068, Järvevana tee 9, 11314 Tallinn, Estonia. Contact: [email protected].
This Policy covers the biis. marketing site, portfolio, project enquiries, Clinic and Salon demonstration requests, administrative access, website security and applicable aggregate website measurements. It does not replace any separate privacy notice or data-processing agreement for a deployed Clinic or Salon software product. This marketing website does not operate as a patient-record system.
2. Information we receive through forms
When you contact us or request a demo, we process the name, email address, optional organisation, selected project or demo topic, and message if provided. We also process submission and response details, enquiry status, administrative follow-up dates and notes when needed to handle a request.
The project enquiry requires a message; product demo forms can be submitted without one. Please do not provide patient data, diagnoses, treatment notes, medical documents, passwords, payment-card data or other unnecessary sensitive information.
3. Technical, security and administrative data
The website may process IP addresses, request timestamps, browser or device information, server and proxy logs, abuse-prevention records and technical errors to operate and secure the service. Rate-limiting records use hashed keys rather than storing the underlying IP address in that database table; infrastructure logs may nevertheless contain IP addresses.
Only authorised administrators have accounts in the website's content-management system. For those accounts, we process administrator email addresses, protected password-verification data, hashed session tokens, session expiration, authentication events and metadata about administrative actions. Public visitors cannot register for CMS accounts.
Authorised administrators may upload project images, illustrations and other media, together with alt text, editorial metadata and associated publication details. These materials may contain personal data where identifiable persons appear.
4. Purposes and legal bases
We process enquiries to respond to the business request, evaluate a potential engagement, organise follow-up and communicate about a requested demonstration. Our legal basis is generally our legitimate interests in responding to requested business enquiries under Article 6(1)(f) GDPR, subject to a balancing assessment. Where particular steps are objectively necessary at your request before entering into a contract with you, Article 6(1)(b) may apply.
We process administrator information to control CMS access, protect the website and record administrative actions, relying on legitimate interests under Article 6(1)(f), or another relevant legal basis where applicable.
We process security and abuse-prevention information to maintain integrity, availability and protection against attacks on the basis of legitimate interests under Article 6(1)(f), subject to appropriate safeguards.
Where records must be kept under tax, accounting or other law, Article 6(1)(c) applies. We may also process relevant records to establish, exercise or defend legal claims under an applicable lawful basis.
Optional analytics, marketing or device-access technologies are assessed separately. Where consent is legally required, we obtain it before activating those technologies. Sending an enquiry does not constitute marketing consent.
5. Required and optional information
Name, email and inquiry type are necessary for the form to function and for us to respond. The organisation is optional. The message is required for custom-project enquiries and optional for product-demo enquiries. Without required details we may be unable to process your form.
6. How enquiries are handled
Enquiries are stored in the site's configured PostgreSQL database before any optional email notification is attempted. Authorised staff can review, categorise, reply to and make limited follow-up notes about enquiries. A failed notification does not reverse a saved enquiry.
We use this information to respond to the particular request and to manage reasonable related communications. We do not treat an enquiry as consent for unrelated advertising. We do not ask visitors to submit health information into the studio's inquiry system.
7. Service providers and recipients
Where configured, Resend delivers email notifications about new enquiries. Such notifications can include the submitted contact details and message content. Resend's use is dependent on live configuration.
Where enabled, Cloudflare Turnstile is used to help detect automated or abusive form submissions. When loaded and used, Cloudflare may receive technical information and a challenge token to verify the request. The applicable Cloudflare privacy information and contractual role should be considered alongside this Policy.
Our hosting and database infrastructure providers and authorised administrators may access information as necessary for hosting, operations, security, support and backup. Professional advisers, courts or competent authorities may receive information where necessary and lawful. Processors must be subject to appropriate Article 28 GDPR arrangements where required.
We do not disclose general inquiry details to visitors or use this website to share patient records.
8. Product demonstrations
Clinic and Salon product pages and previews on this website use fictional or illustrative interfaces. Requesting a demo does not create an operational clinic or salon account, submit patient data to a clinical system, or book a real appointment. Any processing of staff, salon-customer or patient data in separate operational software requires its own contractual and privacy documentation.
9. Optional aggregate site analytics
The website contains an optional first-party aggregate measurement feature. When enabled, it records counts by UTC date, broad public page group and event type, such as a page view, a contact-page click, form start, successful enquiry save or a product-selection click. The aggregate analytics database table does not store a visitor or session identifier, cookies, email address, enquiry text, IP address, user-agent string, referring URL or individual navigation history.
These counts are not reliable unique-visitor numbers and cannot identify which visitor completed a particular sequence. Network requests may still appear in separate server or proxy logs, subject to their own legal bases and retention periods.
This feature is disabled by default in the repository's example production configuration. Its availability in a deployed environment depends on the operator's actual configuration, lawful-basis assessment and retention settings. See the Cookie Policy for distinctions between device storage and server-side aggregate counts.
10. Cookies and browser storage
The public website does not implement a general visitor-login session. Administrators use a necessary authentication cookie for access to the restricted CMS. Optional third-party technologies may be loaded if the corresponding integrations are configured. Our Cookie Policy explains the currently identified browser technologies, consent requirements and available choices.
11. International processing
We are established in Estonia, in the EEA. Certain hosting, email or security providers may process data outside the EEA depending on their deployment and agreements. Where a transfer is subject to GDPR Chapter V, we use a lawful transfer mechanism, such as an adequacy decision, appropriate contractual safeguards with supplementary measures where required, or a legally available derogation.
Information about relevant transfers and safeguards can be requested at [email protected]. The applicable arrangements depend on the actual recipient and configuration.
12. Retention
We keep enquiry records for the period necessary to respond, manage appropriate follow-up and handle disputes or legal obligations. Information no longer required for those purposes should be deleted or anonymised. Internal follow-up notes and inquiries are not kept indefinitely merely because the CMS permits storage.
Administrator sessions are configured to expire after seven days unless revoked sooner. Security logs and account audit records are retained for periods justified by security and accountability needs and applicable law. Publicly published website content and associated media are retained while needed for publication and legitimate editorial records. Soft-deleted media is subject to an operator-configured cleanup process; deletion from all systems is not guaranteed to be immediate.
If optional aggregate analytics is activated, daily counts require a defined retention and deletion policy. Merely hiding older counts from the dashboard does not delete them.
Actual production retention schedules, log durations, backup retention and deletion workflows must follow an approved retention policy. You can request further information about the criteria applying to your information at [email protected].
13. Security
We use measures appropriate to the nature and risks of our processing, including access restrictions and technical security processes. The codebase contains administrator-only CMS routes, protected sessions, security controls for inquiry submission and media-access restrictions. These development measures are not a claim that every production safeguard, hosting configuration or recovery procedure has been independently verified.
No online system is entirely risk-free. Please notify us promptly if you suspect that your information has been exposed or misused.
14. Your rights
Subject to GDPR's conditions and exceptions, you may request access to your personal data (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability where applicable (Article 20), and object to processing based on legitimate interests (Article 21). You may object to direct marketing at any time.
Where processing depends on your consent, you may withdraw it at any time without affecting earlier lawful processing. If processing involves qualifying solely automated decisions with legal or similarly significant effects, applicable Article 22 rights apply. This marketing website does not represent that it makes such decisions about public visitors.
To exercise your rights, email [email protected]. We may request reasonable identity verification where necessary. We respond without undue delay, generally within one month; where GDPR permits an extension, we will notify you within the initial period. Requests are ordinarily free of charge, subject to GDPR exceptions.
15. Complaints and breaches
You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), https://www.aki.ee/, or with another competent EU/EEA supervisory authority as permitted by law. Contacting us first is not a requirement.
If a personal-data breach occurs, we assess and make notifications to supervisory authorities and affected individuals where Articles 33 and 34 GDPR require them.
16. Children and sensitive information
This website is directed to business contacts, not children. Do not provide information about patients or other individuals' health or treatment through the public forms. If we receive sensitive information unexpectedly, we will assess its lawful handling and appropriate deletion or further action.
17. Changes and contact
We may update this Policy to reflect changes to the website or processing. Material changes will be communicated where legally required. The effective date of the current approved version appears above.
Controller: Trippbo OÜ, registration no. 17187333, VAT no. EE102924068, Järvevana tee 9, 11314 Tallinn, Estonia. Email: [email protected].