Privacy policy

This policy explains what personal data halored.com collects, what we use it for, who we share it with and how long we keep it. Last updated 23 October 2026.

Controller

Halored OÜ (registry code 12163538, VAT EE101480147), Lepatriinu tee 4-7, Jälgimäe, 76404 Saku Parish, Harju County, Estonia. Data protection questions: info@halored.com, +372 656 1646.

What we collect

• Forms — product enquiry, “Contact us”, showroom visit booking and technical support request: name, e-mail address and, optionally, phone, company or project and your message. The enquiry also includes the selected products and quantities, the visit booking the requested day, time and number of people, and the support request your role on site, the site name, a description of the situation and invoicing details (company, registry code, VAT number — checked against the Estonian Business Register and the EU VIES service).
• Added when a form is sent — approximate location (city and country derived from your IP address; the IP address itself is not stored) and how you reached the site (e.g. search engine, referring page, campaign tag).
• Site visit log — we keep our own cookie-free visit log: page visited, time, language, device type, approximate location, referring page and campaign tags. To tell visitors apart we use a hash that changes daily and cannot be turned back into an IP address, and a random session identifier in the browser’s session storage.
• E-mail buttons — team e-mail addresses are revealed after a bot check; none of your data is stored in the process.
• Server logs — the web server records IP address, time, requested page and browser identifier for security and reliability.
• Ad measurement (Google Ads) — only with your consent. If you allow marketing in the cookie banner, the Google tag is loaded and links a Google ad click to an enquiry form sent afterwards. Without consent the Google tag is not loaded and no data is sent to Google. If you withdraw consent, the advertising cookies are deleted as well.

Purposes and legal basis

• Replying to enquiries, quotes, visit requests and support requests — steps prior to a contract or performance of a contract (GDPR Art. 6(1)(b)), otherwise our legitimate interest in answering your question (Art. 6(1)(f)).
• Understanding and improving how the site is used (cookie-free visit log) — legitimate interest; the data is aggregated and does not directly identify you.
• Preventing bots, spam and abuse and keeping the site secure — legitimate interest.
• Measuring the effectiveness of Google ads (which ads lead to enquiries) — your consent (Art. 6(1)(a)); you can withdraw it at any time via “Cookie settings” in the footer.

Who receives the data

• Zone Media OÜ (Estonia) — hosting of the website and database.
• Microsoft Ireland Operations Ltd — Halored’s mailbox (Microsoft 365) that receives form messages.
• Resend, Inc. (USA) — delivery of form notification and confirmation e-mails.
• Cloudflare, Inc. (USA) — Turnstile bot check on forms and e-mail buttons; processes IP address and technical browser data.
• HaloHub — Halored’s own support ticket system (technical support form only).
• Google Ireland Ltd (Ireland) and Google LLC (USA) — Google Ads measurement (Google tag); with cookies only after marketing consent.
• Location is determined on our server using the DB-IP database; your IP address is not sent to a third party.
• If a YouTube video is embedded on a page, it is loaded via youtube-nocookie.com; loading the video sends your IP address to Google.

Where data is transferred outside the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

• Enquiries, messages, visit requests and support requests sent via forms: 24 months, then deleted automatically unless the law or a contract requires longer retention.
• Cookie-free visit log and consent records: 13 months.
• Google Ads cookies: up to 90 days (see below); data collected by Google is kept under Google’s terms.
• Server logs: according to the hosting provider’s configuration.

Cookies and browser storage

• NEXT_LOCALE (cookie) — language preference; necessary for the site to work.
• hl_nousolek (cookie) — your cookie choice; necessary, kept for 12 months.
• _gcl_au, _gcl_aw (cookies, Google Ads) — linking an ad click and an enquiry to the ad; only with marketing consent; up to 90 days.
• hl_paring (browser localStorage) — the products in your enquiry list; stays in your browser until you clear the list. It reaches us only when you send the form.
• hl_seanss (browser sessionStorage) — random session identifier for the visit log; deleted when the browser window is closed.
• Content management users receive a login cookie (administrators only).

Statistics and marketing cookies are set only with your consent (cookie banner). You can change your choice at any time via “Cookie settings” in the footer. We do not currently use Google Analytics; if we add it, we will update this policy.

Your rights

You have the right to access, rectify or erase your data, to restrict processing, to object to processing based on legitimate interest and to data portability. Write to info@halored.com — we reply within one month. You can lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee).

Changes

We update this policy when the way the site works changes. The current version is always on this page.