Last updated: 18 October 2026
Who is responsible for your data?
HYPERPHARM OÜ is the controller of the personal data described in this policy: it decides why and how the data is used.
- Controller: HYPERPHARM OÜ, registry code 14669221
- Registered address: Narva mnt 7, Tallinn, Estonia
- Contact for personal data questions: sales@hyperpharm.eu
This policy covers the website hyperpharm.eu, the enquiry form and the website assistant on it, and the emails you send to us.
What personal data do we collect?
We collect what you send us and what your browser sends when you visit the site.
- Enquiry form: your name, company, email address, phone number if you give one, the country where you plan to sell, the format, pack and first quantity you choose, and your message. Each enquiry is stored in the website database and sent by email to our team.
- Website assistant: before the first question, your email address, the country where you plan to sell, your phone number if you give one, and whether you agreed to receive news by email. Then the conversation itself: your questions, the answers and the page where you opened the assistant. If you press "Send this to our team", also your name, company and note if you add them. Each conversation is stored in the website database together with a record of the consent text you saw.
- Emails: what you write to sales@hyperpharm.eu, with your email address, the details in your signature and any attachments.
- Customer records: if an enquiry leads to an order, the names and business contact details of the people we deal with, the correspondence about the order, and the details on quotes and invoices.
- Technical data: your IP address, browser and device type, the pages requested and the time of each request, recorded by the web server.
- Cookies for statistics and advertising: set only with your consent, as described under "Cookies and analytics" below.
The enquiry form is meant for business enquiries. Please do not send us health information about yourself or anyone else.
Giving us your details is voluntary. To reply to your enquiry we need an email address.
Why do we use your data, and on what legal basis?
| Data | Purpose | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Enquiry form and emails | To reply to your enquiry and prepare a quote | Article 6(1)(b): steps taken at your request before a contract. Where you write on behalf of a company, also Article 6(1)(f): our legitimate interest in answering business enquiries | While the correspondence continues, and up to 24 months after the last contact if no contract follows |
| Website assistant conversations | To answer your questions in the chat and, when you ask for it, to pass the conversation to our team for a reply | Article 6(1)(a): the consent you give in the assistant before the first question. Where you ask for a quote, also Article 6(1)(b): steps taken at your request before a contract | Up to 24 months after the last message, unless the conversation leads to an order |
| News by email from the assistant | To send occasional news and offers, only if you tick the separate box in the assistant | Article 6(1)(a): your consent | Until you unsubscribe or withdraw consent |
| Customer records | To carry out an order, invoice it and keep the accounts | Article 6(1)(b) for the contract; Article 6(1)(f) for dealing with the contact people of a client company; Article 6(1)(c) for the accounting records the law requires | As long as the Estonian Accounting Act requires accounting records to be kept |
| Server logs and checks on form submissions | To keep the site secure and the enquiry form free of automated spam | Article 6(1)(f): our legitimate interest in a secure site and a working enquiry form | Only as long as security and troubleshooting need them |
| Google Analytics cookies | Statistics on visits: pages read, how visitors arrive, device and browser type | Article 6(1)(a): your consent | For the retention period set in our Google Analytics account |
| Google Ads conversion cookie | To see whether a visit that began with a Google ad led to an enquiry | Article 6(1)(a): your consent | For the period Google sets for this cookie |
Where we rely on legitimate interests, we use only the data that purpose needs, and you can object at any time (see "What are your rights?" below). When a retention period ends, we delete the data or make it anonymous.
Cookies and analytics
Cookies are small files that a website stores in your browser.
The site uses Google Analytics 4 to count visits and see which pages are read. Its tag is placed by Google Site Kit, a WordPress plugin. Google Analytics records the pages viewed, how a visitor reached the site, the type of device and browser, and an approximate location derived from the IP address.
Google Tag Manager also runs our Google Ads conversion measurement: it records whether a visit that began with a Google ad ended in a sent enquiry.
These cookies are set only after you accept them in the cookie banner. If you refuse them, the site and the enquiry form work in the same way. You can change or withdraw your consent at any time through the "Cookie settings" link at the foot of every page, or by deleting the cookies in your browser. Until you make a choice, Google's tags run in Google Consent Mode with storage denied: they set no cookies, and Google may still receive limited signals about the visit that carry no cookie identifier.
| Cookie | Set by | Purpose | When it is set |
|---|---|---|---|
_ga, _ga_<ID> | Google Analytics | Tells visits apart for the statistics | After you consent |
_gcl_au | Google Ads | Links an enquiry to the ad that led to the visit | After you consent |
hp_consent | This site | Remembers your cookie choice for 180 days | When you make a choice |
How does the website assistant work?
The assistant in the corner of the page answers questions about our manufacturing, blister packing, minimum orders, lead times and certificates. Its answers are written by an AI model, Google Gemini, from the published pages of this website, and each answer links to the pages it is based on. Answers can contain mistakes: our team confirms prices, terms and anything specific to your project in its reply.
To write an answer, the text of your question and of the earlier messages in the same conversation is sent to Google through the Gemini API. Your email address, phone number and country stay in the website database and are not part of that text. Please do not type health information or other sensitive data into the chat.
The assistant opens only after you tick the consent box in it. The box for news by email is separate and left unticked; the assistant works the same way whether you tick it or not. When you press "Send this to our team", the conversation and your contact details are emailed to our team, who reply within 24 hours, Monday to Friday. You can ask us at any time to delete a conversation (see "What are your rights?" below).
Who receives your data?
We share personal data with the following recipients, and only as far as each of them needs it:
- Hostinger, our hosting provider, stores the website, the enquiry database and the server logs on servers in the EU, in a data centre in Lithuania. It acts as our processor.
- Titan, the email service behind our mailbox sales@hyperpharm.eu, provided through Hostinger, stores and delivers our email. It acts as our processor.
- Google: for Google Analytics, Google Ireland Limited acts as our processor under Google's data processing terms. For Google Ads conversion measurement, Google acts as a separate controller under its own terms. For the website assistant, Google processes the text of the conversation through the Gemini API to produce the answers, and acts as our processor.
- The provider that builds and maintains the website can reach the enquiry database while it carries out maintenance, and receives a daily summary of assistant conversations to keep the assistant working correctly. It acts as our processor.
- Public authorities, auditors and advisers, when the law requires it or when it is needed to establish or defend a legal claim.
Personal data is not sold and is not passed to anyone for their own marketing.
Is your data sent outside the European Economic Area?
The website, the enquiry database and the server logs are kept on servers in the EU. Google may process data in the United States and other countries outside the European Economic Area. Google LLC is certified under the EU-U.S. Data Privacy Framework, and Google's data processing terms include the standard contractual clauses adopted by the European Commission for transfers to countries without an adequacy decision.
Our email service, Titan, is operated by Titan Solution Ltd SEZC, a company registered in the Cayman Islands. Its privacy policy does not say in which country mail is stored, so email you send to us, and the enquiries the form sends to our mailbox, may be processed outside the European Economic Area. Titan states that when it transfers data of EU residents to a service provider outside the EU, it ensures that the provider has appropriate safeguards.
What are your rights?
Under the GDPR you can ask us to:
- give you access to the personal data we hold about you, with a copy of it (Article 15);
- correct data that is wrong or incomplete (Article 16);
- erase your data when there is no longer a reason to keep it (Article 17);
- restrict the use of your data while a question about it is being settled (Article 18);
- hand over the data you gave us in a structured, machine-readable format (Article 20);
- stop using your data where we rely on legitimate interests, unless we have compelling grounds or need it for a legal claim (Article 21).
Where the legal basis is your consent, you can withdraw it at any time. Withdrawing does not affect what was done with your consent before (Article 7(3)).
To use any of these rights, write to sales@hyperpharm.eu. We may ask you to confirm your identity before we act on the request. We answer within one month; if a request is complex, we may extend this by up to two further months and will tell you why within the first month (Article 12(3)). Requests are normally free of charge.
Decisions about you are not taken by automated means alone.
Complaints. If you think we have handled your data unlawfully, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data protection authority of the EU country where you live or work (Article 77). You are also welcome to raise the matter with us first at sales@hyperpharm.eu.
How do we protect your data?
The site is served over an encrypted connection (HTTPS). Access to enquiries and orders is limited to the people who handle them and to the providers who host and maintain the website and our email. Our processors may use the data only on our instructions and for the services they provide to us.
Changes to this policy
When the way we handle personal data changes, we update this page and the "Last updated" date at the top. The version published here is the one in force.
Legal references
- Regulation (EU) 2016/679, the General Data Protection Regulation: https://eur-lex.europa.eu/eli/reg/2016/679/oj
- Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): https://www.aki.ee/en
- Google, how Google uses information from sites or apps that use its services: https://policies.google.com/technologies/partner-sites
- Google Ads Data Processing Terms, which also apply to Google Analytics: https://business.safety.google/adsprocessorterms/
- Google Ads Controller-Controller Data Protection Terms: https://business.safety.google/adscontrollerterms/
- EU-U.S. Data Privacy Framework, list of participating organisations: https://www.dataprivacyframework.gov/