Last updated: 6 October 2026
1. Who we are
This website, www.besafe.ltd, is operated by Be Safe OÜ (“Be Safe”, “we”, “us”), a company registered in Estonia (registry code 14762392), with its registered address at Männimäe, Pudisoo küla, Kuusalu vald, 74626 Harju maakond, Estonia. Be Safe OÜ is the data controller for the personal data described in this policy.
For any privacy question or request, e-mail [email protected] or use our contact page.
2. Personal data we collect
- Identity and contact data – name, e-mail address, phone number, country, company and job title, when you register, enrol, book a consultation or fill in a form.
- Learning data – course enrolments, progress, quiz results, certificates issued and certificate IDs, when you take a course on Be Safe HUB.
- Order and payment data – products purchased, invoices and billing address. Card details are entered directly with our payment provider; we do not store full card numbers.
- Communications – messages you send us by form, e-mail, WhatsApp or support ticket, and reviews or course evaluations you submit.
- Technical and usage data – IP address, browser and device type, pages visited and time spent, collected through server logs and cookies (see section 8).
3. Why we use your data and our legal basis
- To provide our training and consultancy services – enrolment, course access, certificates and support. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
- To process payments, invoices and accounting records. Legal basis: contract and legal obligation (Art. 6(1)(b) and (c)), including the Estonian Accounting Act.
- To let employers and third parties verify a certificate you hold, through our public verification page (certificate ID, name, course and dates only). Legal basis: performance of a contract and our legitimate interest in preventing certificate fraud (Art. 6(1)(b) and (f)).
- To answer your enquiries and arrange consultations. Legal basis: steps prior to a contract and legitimate interest (Art. 6(1)(b) and (f)).
- To send newsletters and offers – only if you have opted in; you can unsubscribe at any time. Legal basis: consent (Art. 6(1)(a)).
- To publish reviews you submit, showing your name, rating and text. Legal basis: consent (Art. 6(1)(a)); you may ask us to remove your review at any time.
- To keep the website secure and improve it. Legal basis: legitimate interest (Art. 6(1)(f)); analytics cookies only with your consent.
4. Who we share data with
We do not sell personal data. We share it only with service providers that process it on our behalf under a data processing agreement, or where the law requires it:
- Website hosting and infrastructure – Amazon Web Services (server located in the United States) and Cloudflare (content delivery and security).
- Online shop and payments – SureCart and its payment processors.
- E-mail delivery – our transactional e-mail provider used to send account, order and certificate e-mails.
- Live sessions and communication – Zoom (online classes) and WhatsApp (if you choose to contact us there).
- Embedded content – YouTube and Vimeo videos, Google reviews.
- Website analytics – Google Analytics, loaded through Google Tag Manager, only after you consent to statistics cookies (Google Ireland Limited / Google LLC).
- Professional advisers, auditors and public authorities when required by law.
5. Transfers outside the European Economic Area
Some of the providers above are based in, or store data in, the United States. Where personal data is transferred outside the EEA, we rely on the EU-U.S. Data Privacy Framework where the recipient is certified, or on the European Commission’s Standard Contractual Clauses, together with appropriate supplementary safeguards.
6. How long we keep your data
- Account and learning records, including certificates: for as long as your account is active, and certificate records for as long as they may need to be verified, unless you ask us to delete them.
- Invoices and accounting records: 7 years, as required by the Estonian Accounting Act.
- Enquiries and support messages: up to 3 years after our last contact.
- Marketing consent: until you withdraw it.
- Server logs and security data: up to 12 months.
7. Your rights
Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting earlier processing. To exercise a right, e-mail [email protected]. We reply within one month.
You also have the right to lodge a complaint with the Estonian supervisory authority, the Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia – www.aki.ee – or with the authority in the EU country where you live or work.
8. Cookies
We use strictly necessary cookies to run the website (for example log-in, shopping cart and security). With your consent we also use preference, statistics and marketing cookies. You can accept, reject or change your choice at any time through the cookie banner and the “Manage consent” link on every page. Details of each cookie are listed in our Cookie Policy.
9. Security
We use encrypted connections (HTTPS), access controls, regular backups and reputable service providers to protect your data. No method of transmission over the internet is completely secure, but we work to protect your data and will notify you and the authority of a personal data breach where the law requires.
10. Children
Our services are intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. The latest version is always on this page with its “last updated” date; for significant changes we will also inform registered users by e-mail.
