1. Who is responsible for your data
The controller of your personal data is:
Trotsenko Research Labs and Consulting OÜRegistry code 17547760
Kaupmehe tn 7-120, 10114 Tallinn, Estonia
Email: hello@trlabs.ai
We are not required to appoint a Data Protection Officer. For any privacy question or request, write to the email address above with the subject “Privacy”.
2. Scope
This policy covers personal data we process as a controller: about website visitors, people who contact us, prospective clients, and the business contacts at our clients, suppliers and partners.
It does not cover personal data that we process on behalf of our clients when we build or run AI services for them (for example, data passing through a voice agent, chat or sales-intelligence service). In those cases the client is the controller and we act as its processor under a data processing agreement in line with Article 28 GDPR. Please read the client’s own privacy notice and contact the client to exercise your rights.
3. What data we process, why and on what legal basis
| Purpose | Personal data | Legal basis |
|---|---|---|
| Understanding and improving the website (optional analytics) | Pseudonymous browser and session identifiers, visited pages, referring website, browser/device information, approximate location derived from IP address, interaction events, performance measurements and sampled masked session recordings | Your consent — Art. 6(1)(a). Analytics starts only after you allow it and can be disabled in Cookie settings. |
| Operating and securing this website | IP address, date and time of request, requested page, referrer, browser and device information (server logs) | Legitimate interests in running a secure, reliable website — Art. 6(1)(f) GDPR |
| Answering enquiries and demo requests | Name, work email, company, role, the content of your message and the area you want to start with | Steps taken at your request before entering into a contract — Art. 6(1)(b); otherwise legitimate interests in replying to business enquiries — Art. 6(1)(f) |
| Preparing and performing client contracts | Business contact details of client representatives, contract and project correspondence, billing details | Performance of a contract — Art. 6(1)(b); legitimate interests where the contract is with your employer — Art. 6(1)(f) |
| Accounting, tax and other legal obligations | Invoices, payment records and the contact data on them | Legal obligation — Art. 6(1)(c), including the Estonian Accounting Act |
| Business updates to existing clients and contacts | Name, work email, company and your communication preferences | Legitimate interests in B2B marketing — Art. 6(1)(f), or your consent where the law requires it — Art. 6(1)(a). You can opt out at any time. |
| Establishing, exercising or defending legal claims | Data relevant to the claim | Legitimate interests — Art. 6(1)(f) |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for more information about this balancing test.
We do not use your personal data for decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you (Article 22 GDPR). We do not sell personal data, and we do not use personal data you send us to train general-purpose AI models.
4. Where the data comes from
We get most personal data directly from you. We may also receive business contact details from your employer or a colleague when they involve you in a project with us, and from public professional sources such as company registers and company websites.
Giving us personal data is voluntary. Without contact details we cannot reply to an enquiry, and without the data required for a contract and invoicing we cannot provide our services.
5. Who we share data with
If you allow Analytics, website usage data is sent to PostHog’s EU cloud service. We do not send booking names, email addresses, company names or message contents to PostHog, and we do not associate analytics with a named user profile. See the cookie notice below for the controls and recording safeguards.
Website demo requests are forwarded to a private TR Labs team channel on Telegram. This includes your name, work email, company and team size. You can contact us by email instead if you prefer not to use this form.
We share personal data only when it is needed for the purposes above, with:
- Service providers acting as our processors — website hosting and content delivery, email and office software, cloud infrastructure, and accounting software. They may use the data only on our instructions and under a contract that meets Article 28 GDPR.
- Professional advisers — accountants, auditors and lawyers, who are bound by confidentiality.
- Public authorities — such as the Estonian Tax and Customs Board, courts or law enforcement, when the law requires it.
- A buyer or successor in the event of a merger, acquisition or transfer of our business, subject to this policy.
6. Transfers outside the European Economic Area
We prefer providers that store data in the EU/EEA. If personal data is transferred to a country outside the EEA, we make sure it is protected by an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework for certified recipients) or by the European Commission’s Standard Contractual Clauses, with additional safeguards where needed (Articles 45–46 GDPR). You can ask us for a copy of the relevant safeguards.
7. How long we keep data
| Data | Retention period |
|---|---|
| Masked analytics session recordings | 30 days |
| Server logs | Up to 30 days, longer only when needed to investigate a specific security incident |
| Enquiries and demo requests that do not lead to a contract | Up to 12 months after our last exchange |
| Client contract and project correspondence | For the term of the contract and up to 3 years afterwards (general limitation period under the Estonian General Part of the Civil Code Act) |
| Accounting source documents and invoices | 7 years from the end of the financial year, as required by the Estonian Accounting Act |
| Marketing preferences and opt-outs | Until you opt out; the opt-out itself is kept so we can respect it |
When a retention period ends, we delete or anonymise the data, unless we need it to establish, exercise or defend a legal claim.
8. How we protect data
We use appropriate technical and organisational measures to protect personal data, such as encrypted connections (HTTPS), access restricted to people who need it, and careful selection of service providers. No method of transmission or storage is completely secure. If a personal data breach is likely to put your rights and freedoms at risk, we will notify the supervisory authority and, where required, you.
9. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict how we process it (Art. 18);
- receive data you gave us in a portable format, or have it sent to another controller (data portability, Art. 20);
- object at any time to processing based on legitimate interests, and in particular to direct marketing (Art. 21);
- withdraw consent at any time where we rely on consent, without affecting the lawfulness of earlier processing (Art. 7(3)).
To exercise these rights, email hello@trlabs.ai. We will reply within one month. In complex cases this can be extended by two further months, and we will tell you if it is. We may ask you to confirm your identity. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.
10. Right to lodge a complaint
Please contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State where you live, work, or where the alleged infringement took place. In Estonia this is:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)Tatari 39, 10134 Tallinn, Estonia
Email: info@aki.ee · Website: www.aki.ee
12. Children
Our services are intended for businesses. This website is not directed at children, and we do not knowingly collect personal data from anyone under 16.
13. Links to other websites
This website may link to websites run by others. We are not responsible for their privacy practices. Please read their privacy policies.
14. Changes to this policy
We may update this policy when our services, providers or legal requirements change. The current version is always published on this page, with the date of the last update shown at the top. If a change materially affects how we use data you have already given us, we will tell you directly where we can.