Trigon privacy notice

1. Introduction

Protecting the personal data of Trigon’s customers, website visitors and other business partners matters to Trigon OÜ. This privacy notice explains what personal data Trigon collects, why it uses it and what rights data subjects have.

Personal data is information about an identified or identifiable natural person, for example a name, email address, user account details or information about use of the Trigon website and service.

This notice applies to the Trigon website, software service, demos, trial periods, contact forms, customer support and other communication channels related to the Trigon service.

2. Whose data does Trigon process?

Trigon may process the personal data of customers’ representatives and contact persons, users of the Trigon service, website visitors, demo or trial-period applicants, people who contact customer support, representatives of business partners, and job applicants.

In addition, Trigon processes, on behalf of customers, data entered into the Trigon accounting software. In that case Trigon is generally a processor, and the controller is Trigon’s customer.

3. Trigon as controller

When Trigon itself determines the purposes and means of processing data, Trigon is the controller. This includes, for example, creating and managing an account, the contractual and billing relationship, organising a demo or trial period, providing customer support, analysing website use, service security, and marketing and partnership communication.

3.1 Purposes and legal bases of processing

Managing the service, account and contract. We process contact and user data to enter into a contract, create an account, provide the service, bill for it and communicate with customers. The legal basis is performance of a contract or taking steps prior to entering into a contract at your request.

Customer support and enquiries. If you contact Trigon by email, contact form, chat or another channel, we process your data to respond to your enquiry and provide support. The legal basis is performance of a contract or Trigon’s legitimate interest in providing effective customer support.

Service security and development. We may process usage, activity and security logs to keep the service secure, detect faults and misuse, and improve Trigon’s features. The legal basis is Trigon’s legitimate interest in providing a secure and functioning service.

Marketing. We send newsletters, offers and other marketing content with your consent, or, to the extent permitted by applicable law, on the basis of Trigon’s legitimate interest. You can unsubscribe from marketing messages at any time.

Compliance with legal obligations and defence of claims. We process data where necessary to comply with statutory obligations, or to bring, pursue or defend legal claims.

3.2 What data does Trigon process?

Depending on the interaction and the Trigon service used, we may process the following data:

• Name, job title, company name, email address, phone number and other contact details.
• User account and authentication data, such as username, sign-in method, account settings, and security and access logs.
• Data related to customer support, demo, trial period and other communication, such as the content of enquiries, feedback and files related to using the service.
• Website and service usage data, such as IP address, technical data about the device or browser, traffic data and activity logs.
• Data related to billing and contract management.

As a controller, Trigon does not generally process special categories of personal data, except where necessary and permitted by law.

3.3 Where does the data come from?

We generally obtain data directly from you or from the company you represent. Data may also be sent to us by Trigon customers who have designated you as their user, or by Trigon business partners.

Certain technical and usage data is collected automatically when the website and service are used. You can find more detail on cookies and similar technologies in Trigon’s cookie notice.

3.4 Who does Trigon disclose data to?

Trigon may disclose data, only to the extent necessary and on a lawful basis, to its service providers, for example providers of cloud and infrastructure services, email, payments, customer support, web analytics or IT security. The current list of sub-processors is published on Trigon’s security page.

We may disclose data to authorities, advisers or other persons where required by law or necessary to protect Trigon’s rights. In the event of a merger, acquisition or reorganisation of the company, data may be shared with the parties to the transaction and their advisers, in compliance with confidentiality and data protection requirements.

4. Trigon as processor

When a customer enters data about its employees, customers, suppliers or other persons into the Trigon service, Trigon generally processes that data on the customer’s behalf and in accordance with its instructions. In that case the customer is the controller and determines the purpose and legal basis of processing.

Trigon’s and the customer’s rights and obligations are described in the data processing agreement in the appendix to the terms of use. For questions relating to a data subject rights request, we recommend contacting the relevant Trigon customer first.

5. Data security

Trigon implements appropriate technical and organisational measures to protect personal data, having regard to the nature, scope and risks of processing. Access to data is restricted to authorised persons who need it for their work duties.

Trigon’s core data is stored in AWS’s Frankfurt region in Germany. A more detailed description of security, including Trigon’s actual safeguards, is set out on Trigon’s security page:

• Trigon’s security page

6. Data retention

We retain personal data only for as long as necessary to achieve the purposes described in this notice, to comply with statutory obligations, or to defend claims. Exact retention periods depend on the type of data and the purpose of processing.

For example, we retain contract and billing data for the statutory period. We retain customer support data for the duration of the customer relationship and 3 years after it ends (the general limitation period for claims), and then delete it. Retention and deletion of account data after the service contract ends follows the procedure described in the terms of use. Where data is no longer needed, we delete or anonymise it unless the law requires it to be retained.

7. Transfers of data outside the EEA

Trigon aims to process data within the European Economic Area. Where data nonetheless needs to be transferred outside the EEA, Trigon applies safeguards that meet the requirements of applicable law, such as the European Commission’s standard contractual clauses or another suitable transfer mechanism.

The specific service providers and what each does are listed on Trigon’s security page. For more on the safeguards applied, write to info@trigon.app.

Use of data for AI

Trigon’s AI-based features run in Trigon’s own systems, and no data is sent to external AI model providers for them. The only external party that comes into contact with the contents of a document is the document digitisation service CostPocket.

• External service provider: CostPocket (digitising purchase invoices, receipts and other documents).
• Data sent to the service provider: the document being digitised.
• Data retention at the service provider: only while the document is digitised and the result returned.
• Human access: no person ever sees the documents.

• CostPocket’s terms

8. Your rights

You have the right to ask whether Trigon processes your personal data and to request access to it. You may also request rectification of inaccurate data, and in certain cases erasure or restriction of processing.

You have the right to object to processing carried out on the basis of Trigon’s legitimate interest, and in certain cases the right to data portability. Where processing is based on consent, you can withdraw your consent at any time. This does not affect the lawfulness of processing carried out before the withdrawal.

If you wish to exercise your rights, contact Trigon using the details given under “Contact”. You have the right to lodge a complaint with the Data Protection Inspectorate (Andmekaitse Inspektsioon).

9. Marketing messages

If you do not wish to receive marketing messages from Trigon, you can unsubscribe using the link in the footer of each message, in your account settings, or by contacting Trigon. Opting out of marketing does not affect messages necessary for providing the service, such as account or security notices.

10. Changes

Trigon may update this privacy notice if Trigon’s services, the organisation of data processing, or legal requirements change. The updated version is published on Trigon’s website together with a new review date. We will give reasonable notice of material changes.

11. Contact

For questions, comments or requests relating to the processing of personal data, contact Trigon:

• Trigon OÜ
• Registry code: 14950857
• Address: Rüütli tn 7, 51007 Tartu, Estonia
• Email: info@trigon.app
• Website: trigon.app

Supervisory authority in Estonia: Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee.