Privacy Policy
Last updated: 21 September 2026
1. Who we are
This Privacy Policy explains how BNHLabs OÜ, trading as BNH Labs (“we”, “us” or “our”), processes personal data relating to visitors to our website and individuals who contact us about our business.
For the processing described in this Privacy Policy, BNHLabs OÜ is the data controller.
Company name: BNHLabs OÜ
Registration number: 16325603
Registered address: Õismäe tee 106-39a, 13513 Tallinn, Estonia
Website: https://bnh-labs.com
Contact email: purchase@bnh-labs.com
You may contact us using the email or postal address above with any questions about this Privacy Policy or the processing of your personal data.
2. Scope and applicable legislation
We process personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and applicable Estonian legislation, including the Estonian Personal Data Protection Act.
This Privacy Policy covers personal data processed when you visit our website, send us an enquiry or communicate with us about potential or existing business relationships.
It does not replace any separate privacy notice provided for a particular product, service, recruitment process or other website.
3. Personal data we process
The personal data involved depends on how you interact with us.
Contact and business information. When you contact us, we process the information you provide, such as your name, email address, telephone number, company name and professional role.
Correspondence. We process the contents of your messages, attachments and related communications needed to understand and respond to your enquiry.
Technical information. When you access the website, its technical infrastructure processes information needed to deliver website content and maintain security. This can include your IP address, browser type, device information, requested pages, access times and error or security logs.
Cookie and usage information. Where cookies or similar technologies are used, the information processed depends on the technology and, where required, your consent. Further information is provided in Section 7.
We obtain personal data directly from you and through the technical operation of the website. In business correspondence, we may also receive your professional contact details from the organisation you represent or from a colleague who introduces you to us.
Please provide only information relevant to your enquiry. General business enquiries do not require sensitive personal information, such as medical details, political opinions or religious beliefs.
4. Purposes and legal bases
Enquiries and business communications. We process contact details and correspondence to answer questions, discuss cooperation and manage business relationships. This is based on our legitimate interest in communicating with prospective and existing business contacts under Article 6(1)(f) GDPR.
Contracts with individuals. Where you personally are a party to a contract with us, or request steps before entering into one, necessary processing is based on Article 6(1)(b) GDPR.
Website operation and security. We process technical information to deliver content, diagnose faults, prevent misuse and investigate security incidents. This is based on our legitimate interest in operating a functional and secure website under Article 6(1)(f) GDPR.
Legal obligations and claims. Processing required by applicable law is based on Article 6(1)(c) GDPR. Processing necessary to establish, exercise or defend legal claims is based on Article 6(1)(f) GDPR.
Optional analytics. Where optional analytics involves processing requiring consent, we rely on Article 6(1)(a) GDPR.
We rely on legitimate interests only after considering the necessity of the processing and its effect on your rights and interests.
Providing information in an enquiry is voluntary. However, without sufficient contact details and information about your request, we may be unable to respond or take the steps you request. Sending an enquiry does not, by itself, constitute consent to unrelated marketing.
5. Who receives personal data
Access to personal data within our organisation is limited to authorised people who need it for the purposes described in this Privacy Policy.
We use service providers supporting our website and business communications. Relevant recipient categories include website platform and hosting providers, content delivery services, email providers, and IT maintenance and security providers.
Where a provider processes personal data on our behalf, we require appropriate contractual arrangements governing its processing, confidentiality and security obligations.
Relevant information may also be disclosed to legal, accounting or other professional advisers where necessary to obtain advice or meet our obligations. We may disclose information to public authorities or courts where legally required, or where necessary and lawful to establish, exercise or defend legal claims.
Disclosure is limited to the information relevant to the purpose concerned.
6. International data transfers
Website and communication services can involve providers or infrastructure outside the European Economic Area (“EEA”).
Where personal data is transferred to a recipient outside the EEA, the transfer must comply with Chapter V GDPR. Depending on the recipient and destination, the applicable protection may be an adequacy decision of the European Commission or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, together with additional protective measures where necessary.
The location of a provider alone does not remove our responsibility to assess and protect the transfer.
You may contact purchase@bnh-labs.com for information about international transfers involving your personal data, the relevant destinations and safeguards, and how to obtain a copy of those safeguards. Any necessary redactions will be limited to protecting confidential information or the rights of others.
7. Cookies and similar technologies
Cookies are small files stored on your device. Similar technologies may store information on, or access information from, your device.
Technologies strictly necessary to transmit a communication or provide a service you expressly request do not require consent where the applicable legal exemption applies.
Optional analytics, advertising and other technologies requiring consent must not be activated before that consent is obtained. Where such technologies are offered, the accompanying consent information identifies their purposes, providers and duration.
You may refuse optional technologies and withdraw consent through the controls provided for those technologies. Consent withdrawal must be as easy as giving consent. Simply visiting the website, scrolling or continuing to browse does not constitute consent.
You can also manage or delete cookies through your browser settings. Blocking strictly necessary technologies may affect website functionality. Browser settings do not replace any consent controls required on the website.
For questions about cookies or assistance with your choices, contact purchase@bnh-labs.com.
8. How long we retain personal data
We retain personal data only for the period justified by the purpose of processing and any applicable legal requirements. The retention criteria differ according to the type of information.
Enquiries and correspondence. Information is retained while an enquiry is being handled and while any resulting discussions or requested follow-up remain active. Once these purposes end, information is deleted unless it is needed for an ongoing business relationship, a legal obligation or the establishment, exercise or defence of an identifiable legal claim.
Business relationship records. Relevant contact information and correspondence are retained for the duration of the relationship. After it ends, only records needed to meet applicable record-keeping obligations or address legal claims are retained, for the relevant statutory or limitation period.
Technical and security information. Retention is limited to the operational period needed to diagnose faults, maintain service availability and identify security incidents. Where a particular incident is identified, relevant evidence may be retained until the investigation and any related proceedings are concluded.
Consent and preference records. Where consent is used, we retain sufficient information to record your current choice and demonstrate how consent was obtained or withdrawn. Any longer retention is limited to what is necessary to meet accountability requirements or resolve a related dispute.
When no applicable retention purpose remains, we delete the personal data or irreversibly anonymise it.
9. Security
We apply technical and organisational measures appropriate to the nature of the personal data and the risks of processing.
These measures include limiting access, managing permissions, protecting communications and systems, and requiring appropriate safeguards from service providers processing data on our behalf.
No website, storage system or method of electronic communication can guarantee absolute security. Please avoid sending unnecessary confidential or sensitive information in general enquiries.
10. Your rights
Subject to the conditions and limitations of the GDPR, you may request access to your personal data, correction, deletion, restriction of processing and data portability.
You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time without providing a reason.
Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Send requests to purchase@bnh-labs.com or our registered address. Where reasonably necessary, we may request limited additional information to confirm your identity.
We respond without undue delay and normally within one month. Where an extension of up to two additional months is permitted because of the complexity or number of requests, we will notify you and explain the reason within the initial month.
Requests are normally free of charge. Any fee or refusal will be limited to circumstances permitted by the GDPR and explained to you.
11. Automated decision-making
The processing described in this Privacy Policy does not include decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
Before introducing such processing, we would provide the information and safeguards required by applicable data protection law.
12. Complaints
You have the right to lodge a complaint with a competent data protection supervisory authority, including in the country of your habitual residence, workplace or the alleged infringement.
The Estonian supervisory authority is:
Estonian Data Protection Inspectorate — Andmekaitse Inspektsioon
Address: Tatari 39, 10134 Tallinn, Estonia
Email: info@aki.ee
Website: https://www.aki.ee
You are welcome to contact us about a concern so that we can investigate it. This does not limit your right to contact a supervisory authority.
13. Changes to this Privacy Policy
We may update this Privacy Policy when our processing activities, services or applicable legal requirements change.
The current version will be published on this website with its update date. Where required, we will provide additional notice before a material change or a new use of personal data takes effect.
For questions about this Privacy Policy, contact purchase@bnh-labs.com.
1. Who we are
This Privacy Policy explains how BNHLabs OÜ, trading as BNH Labs (“we”, “us” or “our”), processes personal data relating to visitors to our website and individuals who contact us about our business.
For the processing described in this Privacy Policy, BNHLabs OÜ is the data controller.
Company name: BNHLabs OÜ
Registration number: 16325603
Registered address: Õismäe tee 106-39a, 13513 Tallinn, Estonia
Website: https://bnh-labs.com
Contact email: purchase@bnh-labs.com
You may contact us using the email or postal address above with any questions about this Privacy Policy or the processing of your personal data.
2. Scope and applicable legislation
We process personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and applicable Estonian legislation, including the Estonian Personal Data Protection Act.
This Privacy Policy covers personal data processed when you visit our website, send us an enquiry or communicate with us about potential or existing business relationships.
It does not replace any separate privacy notice provided for a particular product, service, recruitment process or other website.
3. Personal data we process
The personal data involved depends on how you interact with us.
Contact and business information. When you contact us, we process the information you provide, such as your name, email address, telephone number, company name and professional role.
Correspondence. We process the contents of your messages, attachments and related communications needed to understand and respond to your enquiry.
Technical information. When you access the website, its technical infrastructure processes information needed to deliver website content and maintain security. This can include your IP address, browser type, device information, requested pages, access times and error or security logs.
Cookie and usage information. Where cookies or similar technologies are used, the information processed depends on the technology and, where required, your consent. Further information is provided in Section 7.
We obtain personal data directly from you and through the technical operation of the website. In business correspondence, we may also receive your professional contact details from the organisation you represent or from a colleague who introduces you to us.
Please provide only information relevant to your enquiry. General business enquiries do not require sensitive personal information, such as medical details, political opinions or religious beliefs.
4. Purposes and legal bases
Enquiries and business communications. We process contact details and correspondence to answer questions, discuss cooperation and manage business relationships. This is based on our legitimate interest in communicating with prospective and existing business contacts under Article 6(1)(f) GDPR.
Contracts with individuals. Where you personally are a party to a contract with us, or request steps before entering into one, necessary processing is based on Article 6(1)(b) GDPR.
Website operation and security. We process technical information to deliver content, diagnose faults, prevent misuse and investigate security incidents. This is based on our legitimate interest in operating a functional and secure website under Article 6(1)(f) GDPR.
Legal obligations and claims. Processing required by applicable law is based on Article 6(1)(c) GDPR. Processing necessary to establish, exercise or defend legal claims is based on Article 6(1)(f) GDPR.
Optional analytics. Where optional analytics involves processing requiring consent, we rely on Article 6(1)(a) GDPR.
We rely on legitimate interests only after considering the necessity of the processing and its effect on your rights and interests.
Providing information in an enquiry is voluntary. However, without sufficient contact details and information about your request, we may be unable to respond or take the steps you request. Sending an enquiry does not, by itself, constitute consent to unrelated marketing.
5. Who receives personal data
Access to personal data within our organisation is limited to authorised people who need it for the purposes described in this Privacy Policy.
We use service providers supporting our website and business communications. Relevant recipient categories include website platform and hosting providers, content delivery services, email providers, and IT maintenance and security providers.
Where a provider processes personal data on our behalf, we require appropriate contractual arrangements governing its processing, confidentiality and security obligations.
Relevant information may also be disclosed to legal, accounting or other professional advisers where necessary to obtain advice or meet our obligations. We may disclose information to public authorities or courts where legally required, or where necessary and lawful to establish, exercise or defend legal claims.
Disclosure is limited to the information relevant to the purpose concerned.
6. International data transfers
Website and communication services can involve providers or infrastructure outside the European Economic Area (“EEA”).
Where personal data is transferred to a recipient outside the EEA, the transfer must comply with Chapter V GDPR. Depending on the recipient and destination, the applicable protection may be an adequacy decision of the European Commission or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, together with additional protective measures where necessary.
The location of a provider alone does not remove our responsibility to assess and protect the transfer.
You may contact purchase@bnh-labs.com for information about international transfers involving your personal data, the relevant destinations and safeguards, and how to obtain a copy of those safeguards. Any necessary redactions will be limited to protecting confidential information or the rights of others.
7. Cookies and similar technologies
Cookies are small files stored on your device. Similar technologies may store information on, or access information from, your device.
Technologies strictly necessary to transmit a communication or provide a service you expressly request do not require consent where the applicable legal exemption applies.
Optional analytics, advertising and other technologies requiring consent must not be activated before that consent is obtained. Where such technologies are offered, the accompanying consent information identifies their purposes, providers and duration.
You may refuse optional technologies and withdraw consent through the controls provided for those technologies. Consent withdrawal must be as easy as giving consent. Simply visiting the website, scrolling or continuing to browse does not constitute consent.
You can also manage or delete cookies through your browser settings. Blocking strictly necessary technologies may affect website functionality. Browser settings do not replace any consent controls required on the website.
For questions about cookies or assistance with your choices, contact purchase@bnh-labs.com.
8. How long we retain personal data
We retain personal data only for the period justified by the purpose of processing and any applicable legal requirements. The retention criteria differ according to the type of information.
Enquiries and correspondence. Information is retained while an enquiry is being handled and while any resulting discussions or requested follow-up remain active. Once these purposes end, information is deleted unless it is needed for an ongoing business relationship, a legal obligation or the establishment, exercise or defence of an identifiable legal claim.
Business relationship records. Relevant contact information and correspondence are retained for the duration of the relationship. After it ends, only records needed to meet applicable record-keeping obligations or address legal claims are retained, for the relevant statutory or limitation period.
Technical and security information. Retention is limited to the operational period needed to diagnose faults, maintain service availability and identify security incidents. Where a particular incident is identified, relevant evidence may be retained until the investigation and any related proceedings are concluded.
Consent and preference records. Where consent is used, we retain sufficient information to record your current choice and demonstrate how consent was obtained or withdrawn. Any longer retention is limited to what is necessary to meet accountability requirements or resolve a related dispute.
When no applicable retention purpose remains, we delete the personal data or irreversibly anonymise it.
9. Security
We apply technical and organisational measures appropriate to the nature of the personal data and the risks of processing.
These measures include limiting access, managing permissions, protecting communications and systems, and requiring appropriate safeguards from service providers processing data on our behalf.
No website, storage system or method of electronic communication can guarantee absolute security. Please avoid sending unnecessary confidential or sensitive information in general enquiries.
10. Your rights
Subject to the conditions and limitations of the GDPR, you may request access to your personal data, correction, deletion, restriction of processing and data portability.
You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time without providing a reason.
Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Send requests to purchase@bnh-labs.com or our registered address. Where reasonably necessary, we may request limited additional information to confirm your identity.
We respond without undue delay and normally within one month. Where an extension of up to two additional months is permitted because of the complexity or number of requests, we will notify you and explain the reason within the initial month.
Requests are normally free of charge. Any fee or refusal will be limited to circumstances permitted by the GDPR and explained to you.
11. Automated decision-making
The processing described in this Privacy Policy does not include decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
Before introducing such processing, we would provide the information and safeguards required by applicable data protection law.
12. Complaints
You have the right to lodge a complaint with a competent data protection supervisory authority, including in the country of your habitual residence, workplace or the alleged infringement.
The Estonian supervisory authority is:
Estonian Data Protection Inspectorate — Andmekaitse Inspektsioon
Address: Tatari 39, 10134 Tallinn, Estonia
Email: info@aki.ee
Website: https://www.aki.ee
You are welcome to contact us about a concern so that we can investigate it. This does not limit your right to contact a supervisory authority.
13. Changes to this Privacy Policy
We may update this Privacy Policy when our processing activities, services or applicable legal requirements change.
The current version will be published on this website with its update date. Where required, we will provide additional notice before a material change or a new use of personal data takes effect.
For questions about this Privacy Policy, contact purchase@bnh-labs.com.