Privacy Notice
Company and scope
Enigma Labs OÜ is the controller for business enquiries and related processing on /eu. Address: Juhkentali tn 8, Kesklinna linnaosa, Tallinn, Harju maakond, 10132, Estonia. Registry code 17166408. Privacy: privacy@getenigmalabs.com. Support: support@getenigmalabs.com. General enquiries: hello@getenigmalabs.com.
Enigma Labs Technology Limited (DIFC) operates the shared website before a region is selected. Customer data processed on instructions during an engagement is described in the customer service data section below and is governed by the relevant engagement and processing agreement and the customer’s privacy information. Our public DPA applies when incorporated into that engagement. Our website and services are intended for businesses and are not directed to children.
Data protection officer contact: dpo@enigmalabs.ee. Please identify the company concerned.
Information, purposes and legal grounds
We collect the name, business contact details, company, country where supplied, service interests and correspondence you provide to respond, arrange services and provide support. Request/network information, verification tokens, rate-limit identifiers and privacy choices support delivery and security. Providing information is voluntary, but without the details needed to respond we may be unable to help. Do not send credentials or unnecessary sensitive information through general enquiries.
We use personal information on these grounds:
- Enquiries, services and support: our legitimate interests in communicating with business representatives, arranging services and resolving support requests, including through the AI assistance described below. Where you personally enter a contract with us or request steps towards one, we rely on contractual necessity for the processing needed for that purpose.
- Business-contact research and enrichment: our legitimate interests in identifying relevant business contacts and keeping professional contact information accurate.
- Website delivery and security: our legitimate interests in operating the site, preventing misuse and protecting information.
- Marketing and email measurement: consent where required, including the optional permissions collected through our forms; otherwise, our legitimate interests in promoting relevant business services and assessing campaign effectiveness, where applicable rules permit that processing.
- Compliance and disputes: applicable accounting, tax and data-protection obligations, and our legitimate interests in establishing, exercising or defending legal claims.
For prospecting and supplementing business contact records, we purchase leads and obtain enrichment information from third-party suppliers and collect information from public websites and professional profiles, including LinkedIn. These records may include names, job titles, employers, work email addresses, telephone numbers, locations and LinkedIn profiles.
We record telephone and VoIP calls to document customer instructions, troubleshoot issues, resolve disputes and record acceptance of orders. We tell you before recording begins and obtain consent where required. Otherwise, we rely on our legitimate interests in maintaining an accurate record for those purposes. If you do not want a recorded call, you can use email instead. We do not offer an unrecorded telephone service.
Customer service data
Customers may provide personal information or authorise access to it when we deliver, secure and support their IT and cybersecurity services. Depending on the engagement, this can include staff and other individuals’ identifiers and contact details, employment information, account and access records, security and system logs, communications and information held in customer systems. Authorised service work can also involve financial or payment-card information, health information, criminal-offence records or children’s information.
We process this information for the customer’s instructed service purposes, with the scope and safeguards required for the data concerned. The customer determines the relevant individuals, data and purposes. Customer service records follow its lawful retention, return and deletion instructions and applicable mandatory requirements. For requests concerning this data, contact the responsible customer or privacy@getenigmalabs.com; we assist the customer and comply with obligations that apply directly to us.
Marketing and email tracking
We use business contact details to promote our services, including details supplied directly to us, purchased from lead suppliers or collected from public professional sources. Purchasing a record or finding it publicly does not by itself establish permission to send marketing. Where applicable data-protection law permits it, the basis for relevant business outreach is our legitimate interest in promoting our services. Consent is required where the applicable channel rules require it; SMS exceptions depend on the recipient and sending arrangement. WhatsApp marketing requires prior opt-in for the company named in the permission.
Submitting an enquiry does not subscribe you to marketing. Our website forms offer optional, initially unticked choices for email, live telephone calls, SMS and WhatsApp/Signal messages, as available on the form. Choices apply to the named regional company and supplied contact details; they do not authorise automated or prerecorded marketing calls. An unchecked choice does not withdraw an earlier permission.
Depending on the campaign, marketing emails may measure opens and link clicks, including emails to contacts obtained from external sources. Where applicable law requires consent for this measurement, we obtain it before tracking your opens or clicks. You may withdraw tracking consent at any time by contacting privacy@getenigmalabs.com. The website form offers a separate optional choice for this measurement; selecting email marketing alone does not grant tracking permission. Browser-cookie choices do not subscribe you to marketing.
For choices made through our website forms, we record your choices, the company and contact details concerned, when and where the choices were made, and the privacy information presented.
You may withdraw consent or object to direct marketing at any time, through an unsubscribe link, by replying “STOP” where available, or by contacting privacy@getenigmalabs.com. This does not affect your enquiry or services.
An opt-out stops marketing from Enigma Labs OÜ, Enigma Labs Technology Limited and EnigmaCyber LLC across all channels, including email, SMS and WhatsApp. We apply opt-outs without undue delay and within 24 hours of receipt, or sooner where required by law. We maintain a do-not-contact list to prevent further marketing; the block remains effective if your details appear in a later purchased or imported list.
We do not sell or rent contact data or provide it to advertising platforms for targeted advertising.
AI-assisted replies
We use AI services to handle enquiries. For each enquiry the system receives the message you sent, your contact details and our earlier correspondence and records about you or your company. It may look up public professional sources about you or your company, such as your company website or LinkedIn profile. It uses this to classify and route the enquiry, draft a reply, update the helpdesk and customer record for your enquiry and schedule follow-up contact about it.
Replies about complaints, legal or privacy matters, active incidents or security reports are always reviewed by a member of staff before sending. Other replies, including indicative information about our services and pricing, may be sent automatically. The system can contact only you and our staff and can change only your record. Where you have chosen marketing contact, follow-up messages may also include information about our services; they follow the marketing choices and opt-out rules in the Marketing section and our do-not-contact list. No acceptance of a customer, binding price, contract or access to services is agreed by the system; these require a person and the engagement process described in our Website Terms.
The system runs under instructions set and controlled by our staff and operates only for the purposes above. Our AI providers are contractually barred from using your information to train their models. Prompts and outputs are logged and reviewable, and access to the tooling is limited to authorised staff using multi-factor authentication. Our deployment follows the OECD AI Principles, the NIST AI Risk Management Framework 1.0 and the Dubai AI Ethics Guidelines. AI replies can be inaccurate; email support@getenigmalabs.com to request handling by a person. You may object to this processing or ask for human handling at any time.
Recipients and shared services
Enigma Labs Technology Limited (DIFC) manages shared services and handles EU and US enquiries on behalf of the relevant regional company. We use providers of cloud hosting and security, customer-record management, email and message delivery, helpdesk/chat, AI-assisted support and privacy-preference management for these purposes. Enquiries are recorded in our customer-management and helpdesk systems.
Our companies in Estonia, the DIFC and the United States may provide shared processing services for the responsible regional company. We also use business-contact and enrichment suppliers, telephone/VoIP services and call-recording providers.
International processing
Our shared-service arrangements involve the DIFC company in the United Arab Emirates. Enquiry records are stored in Japan; email, helpdesk and consent records are stored in the United States. Call recordings and any transcripts are stored in the United States, EU countries and Japan. Authorised staff may access enquiries from EU countries, the United Kingdom, the United States, Canada and New Zealand. Automated and marketing emails may be sent through EU and US regions. Sending regions do not describe every storage or support location. AI processing may also take place in other countries where our providers and their subprocessors operate.
Japan, the United Kingdom, Canada (commercial organisations) and New Zealand are covered by European Commission adequacy decisions. The United Arab Emirates and the United States are not. For transfers to those countries we rely on the European Commission’s standard contractual clauses (GDPR Article 46(2)(c)) with the relevant Enigma companies and providers. You can obtain a copy of the applicable clauses, with commercial details removed, from privacy@getenigmalabs.com.
Retention and security
We limit retention to the purposes described in this notice and applicable legal requirements. The periods below apply to active records; residual backup copies follow the separate backup limit. An earlier applicable deletion requirement takes priority. Where particular records remain necessary for a legal obligation or a specific claim, they are kept for that purpose rather than for further marketing.
Customer service data follows the retention criteria in its section above. The table covers the other records described in this notice; it does not extend a customer’s deletion deadline.
| Information | Retention criteria |
|---|---|
| Enquiries and proposals | For enquiries that do not become engagements, up to 24 months after your last substantive contact with us, and less if the information is no longer needed or an earlier deletion duty applies. Necessary contract or legal-claim evidence is retained separately under the applicable requirement |
| Support and chat correspondence | Routine tickets and chat transcripts: up to 24 months after resolution, and less if the information is no longer needed or an earlier deletion duty applies. Necessary contract, incident or dispute evidence is retained separately for the relevant purpose and applicable period |
| Purchased, enriched and other marketing contacts | Inactive marketing profiles are deleted within 36 months of collection or your latest substantive marketing reply or request, whichever is later, sooner if no longer needed or an earlier deletion duty applies. Campaign sends and recorded opens or clicks do not restart this period. An objection or withdrawal ends the corresponding marketing use earlier; necessary do-not-contact records are kept separately |
| Call recordings | Routine recordings: up to 6 months after the call, and less if the information is no longer needed or an earlier deletion duty applies. Necessary evidence of an accepted order, incident or dispute is retained separately for that purpose and the applicable period |
| Email engagement events | Records linked to an identifiable recipient: up to 6 months after each open or click, followed by deletion or irreversible anonymisation, sooner if no longer needed or an earlier deletion duty applies |
| Minimal consent evidence | While we rely on the consent, then for up to 36 months after we last rely on it, shorter if no longer needed or an earlier deletion duty applies |
| Minimal privacy-request records | While handling the request, then for up to 36 months after closure, shorter if no longer needed or an earlier deletion duty applies |
| Do-not-contact records | While needed to honour the objection, including when contact details reappear in a later list |
| Accounting and tax records | For the statutory period applying to the record type and relevant company, calculated from the relevant financial or tax year-end, filing date or other starting event specified by law |
| Necessary legal-claim evidence | Only while needed to establish, exercise or defend a claim, considering when the claim arises or becomes known, the applicable limitation period and any extension, and any unresolved proceedings or enforcement. Only relevant information is retained |
| Website access, delivery and security logs | Routine logs: up to 6 months from collection, and less if no longer needed or an earlier deletion duty applies. Necessary incident or dispute evidence is retained separately for that purpose and the applicable period |
| Separate AI prompts, outputs and diagnostic logs | Up to 6 months from creation, deleted sooner if no longer needed or an earlier deletion duty applies. Messages retained as part of an enquiry or support conversation follow the corresponding retention period |
| Routine backup copies | Up to 12 months from each copy’s creation, shorter when no longer needed or an earlier legal or contractual deletion duty applies. Deleted records stay outside normal use until the backup copy expires |
Access to customer personal data is restricted by operational need and multi-factor authentication is required.
Applicable law and rights
The EU General Data Protection Regulation (GDPR), Estonian implementing law and applicable national ePrivacy rules govern within their scope. Restricted transfers remain subject to GDPR Chapter V.
You may request access to your personal information, correction, deletion or restriction, and portability where the legal conditions apply. You may object to processing based on legitimate interests and may object to direct marketing at any time. You may withdraw consent without affecting processing that was lawful before withdrawal.
Email privacy@getenigmalabs.com or write to the company address above, marked “Privacy”. Identify the company concerned. We may request proportionate information to verify your identity or a representative’s authority. We will respond within the applicable legal deadline and explain any refusal. Choosing a region does not remove mandatory rights.
You may complain to Andmekaitse Inspektsioon (AKI), or the competent supervisory authority where you live or work or where the alleged infringement occurred. Your rights concerning qualifying automated decisions and judicial remedies remain available.
Browser storage and choices
Intercom live chat is optional and loads only after functionality consent for this company and policy version. It processes technical browser/network information and the messages you submit through our US-hosted helpdesk. You can withdraw chat consent in privacy settings; email and contact forms remain available. Ending a browser chat session does not erase messages already submitted, which follow the enquiry or support retention periods above.
The regional URL identifies the company. A trusted hosting country signal may suggest a region on an unprefixed entry URL; visitors can choose another. We do not create a region-preference cookie or use browser time-zone or external IP-lookup signals for routing. Privacy choices are kept separately by company and policy version; use the privacy settings control to change them.
The Cookie and Browser Storage Policy describes browser storage and how to manage it. Browser settings and email-marketing choices are separate.
Changes and existing agreements
We publish revisions here and update the effective date. We notify you of material changes through a prominent website notice or direct communication, as required by law.
Existing agreements and historical responsibilities are not transferred by the domain migration. Historical documents are in the legal directory.