Privacy Policy | INTERVEND

1. Data Controller

MAKSIMCORP OÜ
Sakala tn 7-2, 10141 Tallinn, Estonia
Registry code: 16990168
Email: privacy@intervend.online

MAKSIMCORP OÜ ("we," "us," or "INTERVEND") is the data controller for personal data collected through the INTERVEND website (intervend.online) and platform (app.intervend.online).

2. Scope

This Privacy Policy applies to:

Visitors to the INTERVEND website (intervend.online)
Users of the INTERVEND platform (app.intervend.online)
Contacts who submit inquiries through our contact forms
Employees and representatives of our business customers whose data is processed through the platform

When our business customers ("Customers") use INTERVEND to manage their sales teams, we process their employees' data as a data processor on behalf of the Customer (the data controller). This policy covers our role as both controller and processor.

3. Data We Collect

3.1 Account Data

When you or your employer creates an INTERVEND account, we collect: name, email address, phone number (optional), job title, company name, and role within the platform.

3.2 Usage Data

We automatically collect: IP address, browser type, device information, pages visited, features used, session duration, and timestamps.

3.3 Operational Data

Data generated through platform use: visit records (including GPS coordinates), order details, inventory updates, payment records, route plans, and task completion data.

3.4 Payment Data

Subscription billing is processed through Stripe. We do not store credit card numbers. Stripe processes payments as an independent data controller. See Stripe's Privacy Policy.

3.5 Marketing Data

Contact form submissions: name, email, company, phone (optional), job title (optional), company size (optional), and message content. This data is shared with HubSpot for CRM purposes.

3.6 Cookies and Tracking

We use cookies and similar technologies as described in our cookie consent banner (powered by Cookiebot). You can manage your cookie preferences at any time by clicking "Cookie Settings" in the page footer.

4. Legal Bases for Processing

We process personal data under the following legal bases (GDPR Article 6):

Contract performance (Art. 6(1)(b)): Processing necessary to provide the INTERVEND service to you or your employer.
Legitimate interests (Art. 6(1)(f)): Analytics, security, fraud prevention, and service improvement.
Consent (Art. 6(1)(a)): Marketing communications and non-essential cookies.
Legal obligations (Art. 6(1)(c)): Tax records, accounting requirements, and regulatory compliance.

5. Third-Party Processors

We share personal data with the following service providers who process data on our behalf:

Provider	Purpose	Data Location
Google Cloud / Firebase	Hosting, database, authentication, analytics	EU (europe-west)
Stripe	Payment processing	EU / US (EU-US DPF)
HubSpot	CRM, lead management, marketing	EU / US (EU-US DPF)
Sentry	Error tracking and application monitoring	EU (Frankfurt)
Cookiebot / Usercentrics	Cookie consent management	EU
B2B Baltics OÜ	Accounting services	Estonia
SimplBooks (via B2B Baltics)	Accounting software (sub-processor)	Estonia

6. International Data Transfers

Your data is primarily stored and processed within the European Economic Area (EEA). Where data is transferred outside the EEA (e.g., to Stripe or HubSpot in the US), we ensure adequate safeguards through:

EU-US Data Privacy Framework (DPF) certification of the recipient
Standard Contractual Clauses (SCCs) approved by the European Commission

7. Data Retention

Data Type	Retention Period	Basis
Account & operational data	Duration of service + 90 days	Contract performance
Financial records (invoices, payments)	7 years	Estonian Accounting Act (Raamatupidamise seadus)
Marketing/lead data	Until consent withdrawn or 2 years of inactivity	Consent / legitimate interest
Usage & analytics data	26 months (anonymized thereafter)	Legitimate interest
Cookie data	Per cookie (see Cookiebot declaration)	Consent

After account termination, operational data is retained for 90 days to allow data export, then permanently deleted. Anonymized and aggregated data may be retained indefinitely for analytics purposes.

8. Your Rights

Under GDPR, you have the following rights:

Access (Art. 15): Request a copy of your personal data.
Rectification (Art. 16): Correct inaccurate or incomplete data.
Erasure (Art. 17): Request deletion of your data ("right to be forgotten").
Restriction (Art. 18): Request limited processing of your data.
Data portability (Art. 20): Receive your data in a structured, machine-readable format.
Objection (Art. 21): Object to processing based on legitimate interests.
Withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting prior processing.

To exercise your rights, contact us at privacy@intervend.online. We will respond within 30 days.

9. Supervisory Authorities

You have the right to lodge a complaint with a supervisory authority:

Estonia: Andmekaitse Inspektsioon (Data Protection Inspectorate) — www.aki.ee
Spain: Agencia Española de Protección de Datos (AEPD) — www.aepd.es

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

Encryption in transit (TLS/HTTPS) and at rest
Role-based access controls
Regular security monitoring and error tracking
Automated daily backups with 30-day retention
Multi-tenant data isolation (company-scoped access)

11. Children's Data

INTERVEND is a B2B platform not intended for use by individuals under 16 years of age. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us immediately at privacy@intervend.online.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to account holders and/or a notice on our website. The "Last updated" date at the top reflects the most recent revision.

13. Contact

For privacy-related inquiries:

MAKSIMCORP OÜ
Sakala tn 7-2, 10141 Tallinn, Estonia
Email: privacy@intervend.online
Website: www.intervend.online