Privacy policy
In plain words
Summary only. The full policy below applies.
- This policy covers the personal data we hold about website visitors, people who contact us, customers' staff and suppliers.
- It doesn't cover the data on your servers. That's yours: you run the operating system, and we process it only under our Data Processing Agreement.
- We collect what you send us (the form, email, support messages) and a little technical data from your visit.
- We use it to answer you, quote, sign and run contracts, bill, support you and keep the site secure.
- Before we sign, and every year after, we check your company's owners and directors against EU and US sanctions lists. EU sanctions law requires it, and US export rules apply to the hardware.
- Our website sets analytics cookies (Google Analytics) only if you accept them in the cookie banner. No advertising or chat cookies.
- We don't sell your data.
- You can ask to see, correct or delete your data at privacy@3nv.io.
Version 2, 26 October 2026. Version 2 adds Google Analytics, loaded only with your consent.
1 Who we are
The controller is 3NV OÜ, registry code 17032725, Tornimäe tn 5, 10145 Tallinn, Estonia. Contact for privacy questions: privacy@3nv.io. A named person at 3NV answers every message.
2 What this policy covers
It covers personal data that we decide how to use (as controller):
- people who visit 3nv.io;
- people who contact us or send the "Plan a GPU deployment" form;
- named contacts at customers, prospects, partners and suppliers;
- people who report abuse to abuse@3nv.io or security issues to security@3nv.io.
It doesn't cover data that customers store or process on their servers. For that data the customer is the controller and we are the processor under the Data Processing Agreement.
3 What we collect, why, and on what legal basis
| What | Examples | Why | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Enquiry data | Name, work email, company, role, what you plan to run, your message | To answer you and prepare a quote | Steps before a contract (6(1)(b)), or our legitimate interest in answering business enquiries (6(1)(f)) |
| Contract and account data | Names and contacts of signatories, technical and billing contacts | To sign and run the contract and give access | Contract (6(1)(b)) |
| Billing data | Invoices, payment records, VAT number | To bill and keep accounts | Legal obligation under Estonian accounting law (6(1)(c)) |
| Support and access records | Support messages and emails, records of who logged in to a server's console or management controller, and when | To support you, investigate faults and keep an audit trail | Contract (6(1)(b)); legitimate interest in security (6(1)(f)) |
| Website and security data | IP address, browser, pages requested, timestamps | To deliver the site and protect it from attacks | Legitimate interest (6(1)(f)) |
| Sanctions and customer checks | Names, roles and nationality of your directors, owners and the end users you name, and the result of each check | To check that the law lets us serve you: before we sign, every year, and when your owners change. We check the EU sanctions lists and the US SDN and Entity lists | Legal obligation under EU sanctions law and the Estonian International Sanctions Act (6(1)(c)); our legitimate interest in following export rules for US-origin hardware (6(1)(f)) |
| Abuse and security reports | Reporter's name and email, report content | To act on reports, including under the EU Digital Services Act | Legal obligation (6(1)(c)); legitimate interest (6(1)(f)) |
| Visitor access to the data centre | Name, ID check, visit time | To let your engineers into the facility safely | Contract (6(1)(b)); legitimate interest in physical security (6(1)(f)) |
We don't ask for special categories of data. Please don't send them to us.
We don't send marketing email today. If we start, we'll ask for consent where the law requires it and update this policy first.
4 Where the data comes from
Mostly from you. Sometimes from a colleague who names you as a contact, or from public company registers. For sanctions checks we also use public company registers and sanctions lists.
5 Do you have to give us data?
You don't have to give us anything to read our website. To sign a contract we need the names and contacts of the people who sign, pay and run the service, and the details for sanctions checks. Without them we can't sign. We don't make decisions about you by automated means alone.
6 Who we share it with
Our service providers, under contracts that limit their use of the data:
| Provider | What they do for us | Personal data |
|---|---|---|
| Cloudflare | Delivers and protects our website (DNS, security) | Visitor IP addresses, request metadata |
| Google Analytics (Google Ireland Limited) | Website analytics, loaded through Google Tag Manager only after you accept cookies | Pseudonymous visitor ID, pages viewed, device and browser details, truncated IP address |
| Resend | Sends the emails from our website form and our service notices | Recipient email addresses, message content |
| Google Workspace | Email (including sales@ and support@), calendar, documents | Contact details, correspondence, contract documents |
| HubSpot | Customer relationship management: enquiries, contacts, sales history | Contact details, company, enquiry content |
| Merit Aktiva | Accounting and invoicing | Billing contacts, invoices, payment records |
| Slack, Microsoft Teams | Shared support channels with our customers | Names, work emails and messages of people in the channel |
| Tailscale | Encrypted network our engineers use to reach the servers' management controllers | Names and emails of our staff who log in, device details, connection logs |
| Greenergy Data Centers | Runs the data centre; needs visitor names for access control | Names, ID check, visit time |
Our accountants, auditors, lawyers and insurers, when needed.
Authorities, when the law requires it. We check each request and share only what the law requires. If a request concerns you, we tell you, unless the law forbids it.
We don't sell personal data, and we don't share it for advertising.
Analytics loads only after you accept cookies (section 9). If we add a chat tool, we'll ask for your consent first and update this policy before we turn it on.
7 Transfers outside the EEA
Some of our providers process data outside the European Economic Area, mostly in the United States. For each of them we rely on the EU standard contractual clauses, and the EU–US Data Privacy Framework where the provider is certified. Ask privacy@3nv.io for details or a copy.
8 How long we keep it
| Data | How long |
|---|---|
| Enquiries that don't lead to a contract | 2 years after last contact |
| Contract and account data | The contract term plus 7 years |
| Accounting records | 7 years from the end of the financial year, as Estonian accounting law requires |
| Sanctions check records | The contract term plus 7 years |
| Console and management-controller login records | The contract term plus 1 year |
| Website security logs | 90 days |
| Analytics data | Up to 14 months in Google Analytics, then only as aggregated statistics |
| Abuse and security reports | 3 years |
If a claim or dispute is open, we keep what we need until it ends.
9 Cookies
Strictly necessary. Cloudflare, which delivers and protects the site, may set cookies that tell real visitors from automated traffic. They don't track you across sites and don't need your consent. Our own cookie_consent cookie remembers your choice in the cookie banner for one year.
Analytics, only with your consent. If you accept cookies in the banner, we load Google Analytics through Google Tag Manager. It sets the _ga and _ga_* cookies (up to 2 years) to tell visits apart and shows us which pages are read and how visitors arrive. Google processes this data for us under the terms in section 6, with transfers to the United States covered as in section 7. Legal basis: your consent (GDPR 6(1)(a)). Until you accept, nothing from Google loads.
Changing your mind. "Cookie settings" in the footer reopens the banner. Rejecting stops analytics from loading; to remove cookies already set, delete them in your browser.
We don't use advertising or chat cookies. If that changes, we'll ask for your consent first and update this section.
10 Your rights
You can ask us to:
- show you the data we hold about you and give you a copy;
- correct it;
- delete it;
- restrict how we use it;
- give it to you in a portable format;
- stop using it where we rely on legitimate interest;
- withdraw consent you gave earlier.
Write to privacy@3nv.io. We reply within one month. If a request is complex, we may need up to two more months; we'll tell you within the first month. We may ask you to confirm who you are.
You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee. You can also complain in the EU country where you live or work.
11 Security
We protect personal data with access controls, multi-factor login on our business systems, and logging of access to customer hardware.
12 Changes
We'll post changes here with a new version number and date. If a change matters to customers, we'll also tell them by email.
Questions about this policy?
privacy@3nv.io