1. Data Controller

The data controller responsible for your personal data is:

Ophelius OÜ
Registry code: 17292768
Registered address: Järve põik 3-5, Elva linn 61504, Estonia
Contact email: viiskolm@sauk.ee

This service is operated under the brand name Viis Kolm at sauk.ee.

2. Scope of This Notice

This notice describes how Ophelius OÜ collects, uses, stores, and deletes personal data in connection with the Viis Kolm data processing platform. It applies to all registered users and their team members.

Access to this platform is granted by invitation only. By accepting an invitation and creating an account, you acknowledge that you have read and understood this notice.

3. Personal Data We Collect and Why

We collect only the minimum data necessary to provide the service. The table below describes each category of data, the purpose for which it is processed, and the legal basis under GDPR Article 6.

Data	Purpose	Legal basis
Email address	Account identification, login, password reset, and service notifications (job completion, ticket expiry warnings).	Performance of a contract — Art. 6(1)(b)
Display name	Shown on logged-in pages to identify you to yourself and your team members within a shared workspace. Does not need to reflect your legal name.	Performance of a contract — Art. 6(1)(b)
Password (hashed)	Authentication. Passwords are stored as a one-way cryptographic hash (bcrypt). The original password is never stored or recoverable.	Performance of a contract — Art. 6(1)(b)
Last active timestamp	Records the date of your most recent activity (login, job submission, ticket redemption, password change). Used to apply the 7-year inactivity deletion policy.	Legitimate interests — Art. 6(1)(f) (managing inactive accounts, database hygiene)
Input files you upload	Processed by the selected tool to produce your result file. Stored only for the duration of the job's retention period.	Performance of a contract — Art. 6(1)(b)
Result files	Output of the tool, made available to you for download. Stored only for the duration of the job's retention period.	Performance of a contract — Art. 6(1)(b)
Job metadata (tool name, submission time, processing duration, dataset dimensions)	Operational records. Used to verify service delivery and diagnose issues. This metadata does not contain the content of your data.	Legitimate interests — Art. 6(1)(f) (service quality, dispute resolution)

We do not collect any special categories of personal data (Article 9 GDPR), and we do not use any automated decision-making or profiling.

4. How Your Data Is Processed

Processing location

All data is processed on a virtual server operated by Zone Media OÜ (zone.ee), located in data centres within the European Union. No personal data is transferred to countries outside the EU or EEA.

Third-party services

This website loads fonts from Google Fonts (Google LLC, USA). When your browser requests a font file, your IP address is transmitted to Google's servers. This is the only external service used. If you wish to avoid this transmission, you may use a browser extension that blocks Google Fonts requests.

Your uploaded files and result data are never shared with any third-party service. No AI or machine learning systems are used to read, analyse, or handle your data.

Access control

The platform is password-protected. Each user has access only to the workspaces (tickets) they own or have been explicitly added to by a ticket owner. Job inputs and results are accessible only within the workspace they were submitted under.

5. Cookies

We use a single session cookie to keep you logged in during your visit. This cookie is essential for the platform to function and is deleted when you sign out or close your browser.

We do not use any tracking, analytics, or advertising cookies. No cookie consent banner is displayed because no non-essential cookies are set.

6. Data Retention

We retain different categories of data for different durations:

Data category	Retention period	Deletion trigger
Input and result files	3 hours (Quick), 24 hours (Day Pass), 7 days (Week Pass), or up to 1 year (Year Pass) from job submission	Automatic at expiry, or immediately upon account deletion
Job metadata	Retained for as long as the associated ticket exists	Deleted with the ticket when it is removed
Account data (email, name, password hash)	Until account is deleted by the user, or after 7 years of inactivity	Immediate upon user-initiated deletion; automatic after inactivity threshold
Password reset tokens	1 hour from issuance, or until used	Automatic expiry; deleted immediately when used or when account is deleted

Automatic deletions are scheduled to run daily at 05:03 UTC. Manual deletion requests submitted by email are processed within 72 hours on business days.

When a ticket expires, all associated job data and files are removed. Team members are unlinked from the ticket and the ticket code cannot be reused.

When an account is deleted, all tickets owned by that user — including all associated jobs, input files, and result files — are permanently removed. Memberships in tickets owned by others are also removed.

7. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights. You may exercise any of them by contacting us at viiskolm@sauk.ee from the email address registered to your account. We will respond within one calendar month.

8. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes GDPR, you have the right to lodge a complaint with a supervisory authority. In Estonia, the competent authority is:

Andmekaitse Inspektsioon (Data Protection Inspectorate)
Website: www.aki.ee
Email: info@aki.ee
Address: Tatari 39, 10134 Tallinn, Estonia

You may also lodge a complaint with the supervisory authority of the EU member state where you reside or work.

9. Changes to This Notice

We may update this privacy notice from time to time. When we do, we will update the version number and effective date at the top of the page. If changes are material, we will notify registered users by email before the changes take effect.

Continued use of the platform after the effective date constitutes acceptance of the updated notice.