PRIVACY POLICY

 

 

1. DATA CONTROLLER INFORMATION

 

 

We are registered in Estonia and operate under Estonian and European Union data protection laws. For all privacy-related inquiries, data subject rights requests, or concerns, please contact us at info@paragonagency.com.

2. GDPR COMPLIANCE

 

Paragon is committed to full compliance with the General Data Protection Regulation (EU) 2016/679. This Privacy Policy is designed to inform you transparently about:

 

• What personal data we collect
• Why we collect it (purposes of processing)
• The lawful basis for processing your data
• How long we retain your data
• Who has access to your data
• Your rights regarding your personal data
• How we protect your data
• International data transfers

 

2A. LAWFUL BASIS FOR PROCESSING

 

We process personal data only when we have a lawful basis under Article 6 of the GDPR. The lawful bases for our processing activities are:

 

Chatbot Interactions

• Lawful Basis: Consent (Article 6(1)(a))
• Legal Basis for Storage: Your explicit consent to interact with the AI-powered Chatbot
• Note: By using the Chatbot, you consent to data processing as described in this Privacy Policy. You can withdraw consent at any time by ceasing to use the Chatbot or requesting deletion of your data.

 

Meeting Scheduling

• Lawful Basis: Legitimate Interests (Article 6(1)(f)) AND Contractual Performance (Article 6(1)(b))
• Legal Basis: Scheduling meetings is necessary to perform the requested service and respond to your business inquiry
• Our Legitimate Interest: To facilitate business inquiries and provide our consulting services
• Balancing Test: Your interests in data protection are protected by our 30-day automatic deletion policy, which ensures data is not retained longer than necessary

 

Newsletter Subscription

• Lawful Basis: Consent (Article 6(1)(a))
• Legal Basis for Storage: Your explicit, informed consent to receive marketing communications
• Consent Mechanism: You provide consent by entering your email address in the newsletter signup form and clicking the confirmation link in the double opt-in email
• Withdrawal: You can withdraw consent at any time by clicking “unsubscribe” in any newsletter or contacting us

 

Website Analytics (Google Analytics)

• Lawful Basis: Consent (Article 6(1)(a))
• Our Legitimate Interest: To improve website functionality and user experience
• Legal Basis: Your interests are balanced by allowing you to control cookies through our cookie consent banner and browser settings
• Note: Analytics cookies are only deployed after you provide explicit consent through our cookie banner

 

 

3. TRANSPARENCY & INFORMATION REQUIREMENTS

 

What Information Will We Collect From You?

 

At the Point of Chatbot Interaction:

• Your questions and responses (mandatory for using the service)
• Business information about your company (mandatory for service assessment)
• Contact details (email, phone) (mandatory for scheduling follow-ups)
• Audio recordings if you use voice features (mandatory for voice interaction)
• Technical data: IP address, browser type, device information, session duration

 

Meeting Scheduling:

• Name and contact information
• Company name and business details
• Preferred meeting times and availability
• Meeting notes or specific inquiry details

 

Newsletter Subscription:

• Email address
• Name (optional)
• Subscription preferences

 

Website Analytics:

• Cookies and similar tracking technologies
• Usage data (pages visited, time spent, click patterns)
• Device and browser information
• IP address (anonymized)

 

Mandatory vs. Optional Data

 

 

Purposes of Processing

 

Your data is processed for the following specific purposes:

 

1. To provide Chatbot services: Answer your questions about Amazon marketing, e-commerce strategy, and our consulting services
2. To schedule meetings: Connect you with our team based on your availability and business needs
3. To improve services: Analyze usage patterns (anonymized where possible) to enhance the Chatbot and website experience
4. To comply with legal obligations: Maintain records as required by Estonian and EU law, including tax and accounting requirements
5. To send marketing communications: Newsletter only, with your explicit consent
6. To ensure security: Detect and prevent fraud, abuse, or security incidents

 

Automated Decision-Making & Profiling

 

 

The Chatbot uses artificial intelligence to:

• Classify your inquiries and determine the type of assistance you need
• Determine appropriate responses based on your questions
• Qualify your business for our services based on information provided
• Recommend next steps (e.g., schedule a meeting, visit a resource page)
• Route your inquiry to the appropriate team member

 

Your Rights: You have the right to human review of any automated decision that significantly affects you. Contact us at info@paragonagency.com to request manual review of any Chatbot assessment or recommendation.

 

Is Providing Data Mandatory or Optional?

• Chatbot use: Voluntary, but data provision is mandatory if you choose to use the service
• Newsletter: Voluntary; you may opt-in or opt-out at any time
• Google Analytics: You can refuse Analytics cookies through your browser settings or our cookie consent banner
• Meeting scheduling: Voluntary, but contact information is mandatory to schedule a meeting

 

 

4. COOKIES AND TRACKING TECHNOLOGIES

 

4.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our Website. They help us remember your preferences, analyze website traffic, and improve user experience.

 

4.2 Types of Cookies We Use

 

Essential Cookies (No Consent Required)

• Session cookies: Essential for Website functionality, navigation, and Chatbot interaction
• Security cookies: Used to authenticate users and prevent fraudulent use
• Cookie consent cookies: Remember your cookie preferences

 

Non-Essential Cookies (Consent Required)

• Google Analytics cookies: Track website usage, visitor behavior, and traffic sources
• Performance cookies: Measure website performance and identify areas for improvement

 

4.3 Third-Party Cookies

We use Google Analytics, which places cookies on your device. Google may use this data according to its own privacy policy. For more information, visit: Google Privacy Policy

 

4.4 Cookie Consent Mechanism

 

 

Essential Cookies:

• Session cookies are essential for Website functionality
• These are deployed without prior consent but are disclosed in this policy

 

Non-Essential Cookies:

• Analytics cookies (Google Analytics) require your explicit prior consent
• Marketing cookies require your explicit prior consent
• These cookies are only deployed after you give consent through the banner

 

Withdrawing Consent:

You can withdraw cookie consent at any time by:

1. Clicking the “Cookie Settings” link in the website footer
2. Using your browser settings to clear cookies
3. Contacting info@paragonagency.com

 

For detailed information about cookies, please see our separate Cookie Policy.

 

 

5. DATA SHARING AND INTERNATIONAL TRANSFERS

 

5.1 Third-Party Service Providers

We share your personal data with the following third-party service providers who process data on our behalf:

 

• Google Inc. (USA): Google Analytics, Google Calendar, Google Sheets – for analytics, meeting scheduling, and data management
• Mailchimp (USA): Newsletter service provider for sending marketing communications
• ElevenLabs (USA): Audio processing for Chatbot voice features

 

5.2 DATA TRANSFERS TO THE USA – SCHREMS II COMPLIANT

 

Legal Framework for International Transfers

Your data is transferred to the United States where our service providers (Google, Mailchimp, ElevenLabs) have servers. The USA is not recognized by the European Commission as providing an adequate level of data protection under GDPR Article 45. We rely on the following legal mechanisms to facilitate these transfers in compliance with GDPR Articles 44-49:

 

Lawful Transfer Mechanisms

 

1. Standard Contractual Clauses (SCCs)

• Our service providers (Google, Mailchimp, ElevenLabs) have executed Standard Contractual Clauses as approved by the European Commission
• These clauses incorporate safeguards for your fundamental rights and freedoms
• All providers maintain current SCC documentation and Data Processing Agreements

 

2. Supplementary Safeguards

In accordance with Schrems II requirements, we have implemented the following supplementary safeguards:

• Data Minimization: We collect only data necessary for the stated purposes
• Encryption: Data in transit is encrypted using industry-standard protocols (TLS 1.3)
• Limited Retention: Data is deleted within 30 days (except newsletter data which is retained until you unsubscribe)
• Limited Sharing: Data is not shared beyond what is necessary for service provision
• Transparency: This policy discloses all USA-based processing
• Contractual Obligations: All processors are contractually bound to GDPR compliance

 

3. Your Rights Regarding Transfers

You have the right to:

• Request information about the safeguards protecting your data during transfer
• Object to transfers to the USA
• Request your data remain on EU servers (subject to service limitations)

To exercise these rights, contact: info@paragonagency.com

 

US Government Access

 

Adequacy Assessment

The USA does not have an adequacy decision under GDPR Article 45. We rely on Standard Contractual Clauses and supplementary safeguards as the legal basis for transfers.

 

5.3 Data Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration, including:

 

• Encryption: TLS 1.3 encryption for data in transit; AES-256 encryption for data at rest
• Access Controls: Role-based access controls ensuring only authorized personnel can access personal data
• Authentication: Multi-factor authentication for all systems handling personal data
• Regular Security Audits: Quarterly security assessments and penetration testing
• Employee Training: Mandatory GDPR and data protection training for all staff
• Incident Response: Documented incident response procedures for data breaches
• Secure Development: Security-by-design principles in all systems development
• Data Minimization: Automatic deletion of unnecessary data

 

5.4 DATA PROCESSING AGREEMENTS

All third-party service providers who process personal data on our behalf have executed Data Processing Agreements (DPAs) that include:

 

• Standard contractual clauses
• Processor obligations under GDPR Article 28
• Data security requirements
• Data subject rights support mechanisms
• International transfer safeguards (where applicable)
• Sub-processor provisions and notification requirements

 

Copies of DPAs: You have the right to request copies of our DPAs with any specific processor. Contact info@paragonagency.com to request DPA documentation.

 

 

6. DATA RETENTION

 

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law.

 

Retention Periods:

 

Chatbot Interaction Data

• Retention Period: 30 days from the date of interaction
• Reason: To provide follow-up services and improve Chatbot performance
• Automatic Deletion: All Chatbot data (questions, responses, contact details, audio recordings) is automatically and permanently deleted after 30 days

 

Meeting Scheduling Data

• Retention Period: 30 days from the meeting date or scheduled meeting date
• Reason: To facilitate the meeting and provide requested services
• Automatic Deletion: Meeting details, contact information, and notes are automatically deleted after 30 days

 

Newsletter Data

• Retention Period: Until you unsubscribe or request deletion
• Reason: To send you marketing communications as consented
• Deletion: Immediately upon unsubscribe or deletion request

 

Google Analytics Data

• Retention Period: 26 months (as configured in Google Analytics)
• Reason: To analyze long-term website trends and performance
• Note: Analytics data is anonymized and does not identify individual users

 

Legal Compliance Data

• Retention Period: As required by Estonian and EU law (typically 7 years for accounting and tax purposes)
• Reason: To comply with legal obligations
• Applies to: Invoices, contracts, and business correspondence

 

 

7. YOUR GDPR RIGHTS

 

Under the GDPR, you have the following rights regarding your personal data:

 

7.1 Right of Access (Article 15)

You have the right to request confirmation of whether we process your personal data and to receive a copy of that data. You may also request information about:

• The purposes of processing
• The categories of data processed
• The recipients of your data
• The retention period
• Your other GDPR rights

 

7.2 Right to Rectification (Article 16)

You have the right to request correction of inaccurate or incomplete personal data.

 

7.2A RIGHT TO RECTIFICATION – IMPLEMENTATION NOTES

 

For Chatbot Data:

Since Chatbot data is deleted within 30 days of collection, any corrections must be submitted within this 30-day window. After 30 days, data is permanently deleted and cannot be corrected.

 

For Newsletter Data:

You can request correction of your email address or name at any time by contacting info@paragonagency.com

 

For Meeting Scheduling Data:

You can request correction of meeting information within 30 days. After 30 days, the data is deleted automatically.

 

Procedure for Correction:

1. Contact info@paragonagency.com with specific details to be corrected
2. We will verify your identity
3. Corrections will be made within 5 business days
4. We will confirm the correction in writing

 

7.3 Right to Erasure / “Right to be Forgotten” (Article 17)

You have the right to request deletion of your personal data when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent (where consent was the lawful basis)
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Deletion is required to comply with a legal obligation

 

Given our 30-day automatic deletion policy for Chatbot and meeting data, most of your data will be automatically deleted without requiring a request.

 

7.3A RIGHT TO ERASURE – EARLY DELETION

 

Immediate Deletion Available:

You may request immediate deletion of your data at any time, even before the automatic 30-day deletion period expires.

 

Process for Early Deletion:

1. Contact info@paragonagency.com with “Right to Erasure Request” in subject line
2. Specify which data category should be deleted (Chatbot data, meeting data, newsletter data, etc.)
3. We will verify your identity
4. Data will be deleted within 5 business days
5. We will confirm deletion in writing

 

Exceptions to Erasure:

In limited circumstances, we may retain data beyond your deletion request:

• To comply with legal obligations (e.g., tax law, accounting requirements)
• To establish, exercise, or defend legal claims
• In de-identified or aggregated form for analytics purposes
• With your specific consent for continued processing

We will inform you if deletion is not possible and provide our legal basis for retention.

 

7.4 Right to Restriction of Processing (Article 18)

You have the right to request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

 

7.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

 

7.6 Right to Object (Article 21)

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

 

7.7 Right Not to Be Subject to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you. You may request human review of Chatbot assessments.

 

7.8 Right to Withdraw Consent (Article 7(3))

Where processing is based on consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

 

7.9 EXERCISING YOUR RIGHTS – DETAILED PROCEDURES

 

How to Submit Requests

 

Email (Preferred):

• Send requests to: info@paragonagency.com
• Subject line: “GDPR Data Subject Request – [Type of Request]”
• Include: Full name, email address, specific data category in question

 

Mail:

Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145, Estonia

 

In-Person:

Available by appointment (contact: info@paragonagency.com)

 

Response Timelines

 

Standard Response Timeline: 30 calendar days

• This applies to all requests unless specified below

 

Extended Timeline: Up to 90 days

• Only if your request is complex or numerous
• We will notify you if an extension is necessary and explain the reasons

 

Expedited Response: Urgent requests may be prioritized

• Contact us to discuss urgency

 

Proof of Deletion

Given our 30-day automatic deletion policy for Chatbot and meeting data:

• You do NOT need to submit a separate deletion request for Chatbot data
• Deletion occurs automatically
• Proof of deletion (certificate) is available upon request within 10 business days of deletion

 

Data Portability Format

If you request data portability (right to receive your data in portable format):

• Data will be provided in CSV, Excel, JSON, or PDF format (your choice)
• Format will be machine-readable where technically feasible
• Delivery will occur within 30 days via secure email

Right to Lodge a Complaint

If you are not satisfied with our response to your data subject rights request, you have the right to lodge a complaint with the Estonian data protection authority:

 

 

You also have the right to lodge a complaint with the data protection authority of any EU Member State where you reside or work.

 

No Fees for Rights Exercise

In most cases, exercising your GDPR rights is free of charge. However, GDPR allows us to charge a reasonable fee in the following circumstances:

• Requests that are manifestly unfounded or excessive
• Repeated requests (if made within short intervals)
• Additional copies of data already provided

Any applicable fee will be communicated to you before processing your request, and you may choose to withdraw your request.

 

 

8. DATA BREACH NOTIFICATION

 

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the Estonian Data Protection Authority (Andmekaitse Inspektsioon) within 72 hours of becoming aware of the breach
• Notify affected individuals without undue delay if the breach poses a high risk to your rights and freedoms
• Provide clear information about the nature of the breach, likely consequences, and measures taken to address it
• Document all breaches in accordance with GDPR Article 33 requirements

 

We maintain comprehensive incident response procedures to detect, respond to, and mitigate data breaches.

 

 

9. DATA SHARING AND RECIPIENTS

 

9A DATA RECIPIENTS

 

Who Has Access to Your Data?

 

Internal Recipients (Employees of Paragon):

• Customer service team (for meeting scheduling and inquiry responses)
• Management team (for analytics and business purposes)
• Technical staff (for system maintenance and data security)
• All internal staff are bound by confidentiality obligations and have undergone GDPR training

 

External Recipients (Third-Party Service Providers):

• Google Inc. (USA): Google Analytics, Google Calendar, Google Sheets
• Mailchimp (Intuit Inc., USA): Newsletter service provider
• ElevenLabs (USA): Audio processing for Chatbot voice features
• All external processors have executed Data Processing Agreements with us

 

Legal Recipients:

• Law enforcement or government agencies (only if legally required)
• Courts or judicial bodies (only if legally required)
• Regulatory authorities in Estonia or the EU

 

No Marketing Sharing:

We do NOT sell or share your data with:

• Marketing companies
• Data brokers
• Advertising networks (except Google’s own services through Google Analytics with your consent)
• Other third parties for marketing purposes

 

Data Sharing Requires Consent:

Any data sharing beyond what is described above requires your explicit prior written consent.

 

 

10. CHILDREN’S PRIVACY

 

Our Website and services are not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at info@paragonagency.com, and we will delete such data within 5 business days.

 

 

11. DATA PROTECTION IMPACT ASSESSMENT (DPIA)

 

We have conducted a Data Protection Impact Assessment for our AI-powered Chatbot in accordance with GDPR Article 35. The DPIA assessed potential risks including:

• Automated decision-making risks
• Data security risks
• Privacy risks from AI processing
• International transfer risks

 

The DPIA concluded that with our implemented safeguards (30-day deletion, encryption, access controls, transparency measures), the residual risks are acceptable and proportionate to the benefits of the service.

 

A summary of the DPIA is available upon request by contacting info@paragonagency.com.

 

 

12. CHANGES TO THIS PRIVACY POLICY

 

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will:

• Update the “Last Updated” date at the top of this policy
• Notify you via email (if you have subscribed to our newsletter)
• Display a prominent notice on our Website
• For significant changes, request your renewed consent where required by law

 

We encourage you to review this Privacy Policy periodically. Your continued use of our Website and services after changes are posted constitutes your acceptance of the updated policy.

 

 

13. CONTACT INFORMATION

 

For any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

 

 

 

 

© 2025 Hyperboost Brands OÜ. All rights reserved.