Privacy Policy

Last updated: 02.03.2026
This Privacy Policy explains how Sedona OÜ (registry code: 14153121), an Estonian private limited company, registered address: Vabaduse pst 147a, Tallinn 10918, Estonia (“Website Launch Agency”, “we”, “us”, “our”) collects and uses personal data when you visit our website, contact us, purchase a package, or use our services.

Contact: support@websitelaunchagency.com

1) Who we are (Controller)

For the purposes of data protection law, Sedona OÜ is the data controller for personal data processed through our website and business operations.

2) What data we collect

Depending on how you interact with us, we may collect:

A. Website and device data

  • IP address, device type, browser type, pages viewed, timestamps, approximate location derived from IP, referral source
  • Cookie identifiers and similar online identifiers (where used)

B. Contact and enquiry data

  • Name, email address, phone number (if provided)
  • Message content and attachments

C. Order and customer data

  • Name, email, billing details, business name (if provided)
  • Purchase details (package selected, amount, payment status, invoice data)

D. Project delivery data (client intake)

  • Information you submit through our intake forms (e.g., business details, goals, brand assets, content links, login/access details you provide for hosting/domain/WordPress/Shopify)

E. Support communications

  • Support requests and our responses, project communications, and delivery notes

We do not intentionally collect special category data (e.g., health, religion). Please do not send such data to us.

3) Where we get your data

  • Directly from you (forms, email, checkout, intake)
  • Automatically from your device (cookies and similar technologies, where enabled)
  • From third parties involved in payment, analytics, hosting, and communications (see Section 6)

4) Why we process your data and our legal bases

We process personal data only where we have a lawful basis under GDPR Article 6 (contract, legal obligation, legitimate interests, or consent, depending on the context).

A. To provide our services and fulfill a contract

Purpose: deliver the website package you purchased, manage the project, communicate with you, and provide post-launch support.
Legal basis: performance of a contract or steps at your request before entering a contract (GDPR Art. 6(1)(b)).

B. To process payments and prevent fraud

Purpose: take payment, handle refunds (where applicable), prevent fraud/chargebacks.
Legal basis: contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)), depending on the activity.

C. To comply with legal obligations

Purpose: accounting, tax compliance, record-keeping.
Legal basis: legal obligation (Art. 6(1)(c)).

D. To respond to enquiries and provide support

Purpose: answer questions, provide assistance, keep records of communications.
Legal basis: legitimate interests (Art. 6(1)(f)) in operating our business and providing customer support; and/or contract where related to a purchase.

E. To improve our website and measure performance (analytics)

Purpose: understand how visitors use our site, improve content and user experience.
Legal basis: consent for non-essential analytics cookies/trackers where required; otherwise legitimate interests for strictly necessary, aggregated measurement (implementation-dependent). EU cookie rules generally require consent for analytics/marketing trackers unless they are strictly necessary.

F. Marketing communications

Purpose: send updates or marketing emails if you opt in (e.g., newsletter).
Legal basis: consent (Art. 6(1)(a)). You can withdraw consent at any time.

5) Cookies and similar technologies

We use cookies and similar technologies to operate our website and, if enabled, to measure performance and marketing effectiveness.

Under EU rules, consent is generally required for cookies/trackers that are not strictly necessary, and users must be given clear information about purpose.
See our Cookie Notice below for details and how to manage preferences.

6) Who we share data with (processors and recipients)

We share personal data only as needed for the purposes above, including with:

  • Hosting and infrastructure providers (to run the website)
  • Payment processors (to process card payments; e.g., Stripe)
  • Email and support tools (to send transactional emails and manage support)
  • Forms/intake tools (if you submit information via an external form provider)
  • Analytics providers (e.g., Google Analytics)
  • CRM tools (if you choose CRM/form integrations)
  • Third-party service providers (if we outsource any part of the service delivery in the scope of they need to be able to deliver on their contract)

Where a provider processes personal data on our behalf, we use contractual safeguards (e.g., data processing terms). Google’s data processing terms describe Google as a processor for relevant services when those terms apply.

7) International transfers

Some service providers may process data outside the EEA. Where we transfer personal data internationally, we rely on appropriate safeguards (such as Standard Contractual Clauses or other lawful transfer mechanisms, depending on the provider and configuration).

8) How long we keep your data

We retain personal data only for as long as necessary for the purposes described:

  • Enquiries: typically up to 12 months after last contact
  • Customers/projects: for the duration of the project + support window, then as needed for legal/accounting purposes
  • Accounting/tax records: retained for the period required by law
  • Analytics data: retained according to the settings of the analytics provider and your cookie consent choices

9) Your rights

Subject to conditions and exceptions under GDPR, you may have the right to:

  • access your data
  • correct inaccurate data
  • delete data
  • restrict processing
  • object to processing (especially where we rely on legitimate interests)
  • data portability (where applicable)
  • withdraw consent (where processing is based on consent)

To exercise your rights, contact: support@websitelaunchagency.com.

10) Security

We take reasonable technical and organisational measures to protect personal data. No system is perfectly secure; you share information at your own risk.

11) Children

Our services are not directed to children. We do not knowingly collect personal data from children.

12) Complaints

If you are in the EEA, you can lodge a complaint with your local supervisory authority. In Estonia, the supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

13) Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be published on our website with a revised “Last updated” date.