Privacy Policy

1. Controller

The controller of your personal data is SugarArt OÜ (registry code 16743720, Tartu maakond, Kastre vald, Roiu alevik, Kesktänav 4-2, 62122, Estonia). For any privacy question, write to info@varba.ee.

2. If you are a candidate

If you apply for a job through Värba, the controller of your data is the company you applied to. Värba processes your data on that company’s behalf and on its instructions (as a processor). A link to the company’s privacy notice is shown next to the consent on the application form.

The company decides how long your data is kept. If you want to access, correct or delete your data, contact the company. If you write to us, we will forward your request to the company without delay.

3. What data we process

• Account data: name, email address, password in hashed form (we never see the password itself), interface language, email verification status, and the time and version of your acceptance of the terms.
• Organisation data: the organisations you belong to, your role, and invitations sent and accepted.
• Security data: login sessions with IP address and browser details. For rate limiting we briefly keep IP addresses or a hash of them.
• Billing data: company name, registry code, VAT number, address, billing email, plan, periods of use of open positions, and invoices. We may fill in company details from the open data of the Estonian e-Business Register.
• Correspondence: your emails and support requests.
• Activity log: when Värba employees acted in a customer’s account and what they did (for example, while resolving a support issue).
• Visitor statistics: anonymous statistics about page visits. No cookies are used for this, and the statistics cannot be used to identify a visitor.

4. Why we process data

• To provide the Service and perform the contract (GDPR Article 6(1)(b)): the account, signing in, managing organisations, notification emails, password resets and notices of changes to the terms.
• For invoicing and accounting (GDPR Article 6(1)(c)): preparing invoices and keeping them as the law requires.
• To keep the Service secure and prevent abuse (GDPR Article 6(1)(f), legitimate interest): session security data, rate limits and our employees’ activity log.
• To improve the Service (GDPR Article 6(1)(f), legitimate interest): anonymous visit and usage statistics.

We do not send marketing emails without your consent.

5. Who we share data with

We use trusted service providers (sub-processors) who process data on our instructions. They are listed below.

We may also share data with our accountant or auditor and with public authorities where the law requires it. We do not sell data.

Some service providers are located outside the European Economic Area. In that case we transfer data only where the safeguards required by the General Data Protection Regulation are in place — for example, a European Commission adequacy decision (including the EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses.

6. How long we keep data

• Account data: until the account is deleted.
• Login sessions: until the session expires (up to 7 days).
• Rate-limiting counters: until the limit expires — a couple of days at most.
• Invoices and billing data: 7 years, as accounting law requires.
• Employee activity log: while the contract is in force and for up to 3 years after it ends, so that we can respond to any claims.
• Backups: 30 days. Deleted data disappears from backups within that time.

7. Cookies

We use only the cookies the Service needs to work: the login cookie keeps you signed in and the language cookie remembers the interface language you chose. We do not use advertising or tracking cookies.

8. Your rights

You have the right to:

• access your data and receive a copy of it;
• have inaccurate data corrected;
• have your data erased where we no longer have a basis for processing it;
• restrict processing;
• object to processing based on legitimate interest;
• receive the data you provided in a machine-readable format (data portability).

To exercise your rights, write to info@varba.ee. We reply within one month.

If you believe we have infringed your rights, you may lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee).

9. How we protect data

All connections are encrypted, passwords are stored as hashes, files are kept in private storage, and access to data is limited by organisation and role. A more detailed description is in Annex 2 to the data processing agreement (varba.ee/en/data-processing#security-measures).

10. Changes

If this privacy policy changes materially, we will let you know by email or in the Service.