Revol Source
Start Project
Main page

Privacy Policy

Revol Source's privacy policy is based on user data respect and transparency principle and includes measures to comply with GDPR requirements

Last updated: 24 September 2026

This Privacy Policy explains how Revol Software OÜ (“Revol Source”, “we”, “us”) collects and uses personal data when you visit revolsource.com (the “website”), contact us, subscribe to our updates or apply for a job with us. We process personal data in accordance with the EU General Data Protection Regulation 2016/679 (“GDPR”) and applicable Estonian law.

1. Who is responsible for your data

The controller of your personal data is:

  • Revol Software OÜ, a private limited company registered in Estonia, registry code 16680563
  • Registered address: Pirita tee 26f-11, Kesklinna linnaosa, 12011 Tallinn, Estonia
  • Office: Sumska St, 1, Kyiv, Ukraine
  • Email: welcome@revolsource.com

We have not appointed a data protection officer. If you have any questions about this policy or about your personal data, email us at welcome@revolsource.com or use our contact form.

2. What personal data we collect

  • Enquiries. When you use our contact form, we receive your name, email address, phone number, the type of project, your message and any file you choose to attach. If you contact us by email or another channel, we receive your contact details and the content of your message.
  • Subscriptions. If you subscribe to our updates, we receive your email address.
  • Job applications. If you apply for a position, for example by writing to hr@revolsource.com, we receive your CV, contact details and any other information you send us.
  • Client and partner data. If you or your organisation become our client or partner, we process your name, business contact details, job title, our correspondence and, where relevant, billing information.
  • Technical and usage data. When you visit the website, our hosting and security providers process your IP address, browser and device information and the pages you request. If you consent, analytics and marketing tools also collect information about how you use the website, such as pages viewed, visit duration, referral source, approximate location derived from your IP address, and device and browser type. See our Cookies Policy for details.

We do not ask for special categories of personal data, such as data about health, racial or ethnic origin, religious or political beliefs, trade union membership or sexual orientation. Please do not include such data in your messages, attachments or CV.

Providing personal data is voluntary. However, we cannot reply to an enquiry without your contact details or consider a job application without your CV and contact details.

3. Why we use your data and on what legal basis

  • Responding to enquiries and preparing proposals: to take steps at your request before entering into a contract (Article 6(1)(b) GDPR) or, where you contact us on behalf of an organisation, our legitimate interest in communicating with prospective clients (Article 6(1)(f) GDPR).
  • Managing client and partner relationships, including in our CRM system (HubSpot): performance of a contract (Article 6(1)(b) GDPR) or our legitimate interest in managing our business relationships (Article 6(1)(f) GDPR).
  • Sending updates to subscribers: your consent (Article 6(1)(a) GDPR).
  • Sending existing clients occasional information about similar services: our legitimate interest in direct marketing (Article 6(1)(f) GDPR). You can object at any time, and every such email contains an unsubscribe link.
  • Recruitment: steps taken at your request before entering into an employment or service contract (Article 6(1)(b) GDPR). We keep your application for future vacancies only with your consent (Article 6(1)(a) GDPR).
  • Operating and protecting the website and its forms, including hosting and protection against spam, bots and attacks (Cloudflare, Google reCAPTCHA): our legitimate interest in a secure and available website (Article 6(1)(f) GDPR).
  • Analytics and marketing measurement (Google Analytics cookies, Meta Pixel, HubSpot tracking and chat): your consent given through the cookie banner (Article 6(1)(a) GDPR and the rules implementing Article 5(3) of the ePrivacy Directive 2002/58/EC). Until you give consent, Google Analytics runs in Consent Mode and receives only signals that do not read or store cookies on your device; for this basic measurement we rely on our legitimate interest in understanding how the website is used (Article 6(1)(f) GDPR).
  • Accounting, tax and other legal obligations: compliance with a legal obligation (Article 6(1)(c) GDPR).
  • Establishing, exercising or defending legal claims: our legitimate interest (Article 6(1)(f) GDPR).

Where we rely on our legitimate interests, you may object to the processing (see section 8). We do not use your data for automated decision-making, including profiling, that produces legal or similarly significant effects for you. We do not sell personal data.

4. Who receives your data

Only those of our staff and contractors who need your data for the purposes above have access to it, and they are bound by confidentiality. We share personal data with the following recipients:

  • Hosting: Hetzner Online GmbH (Germany), which hosts the website on a dedicated server in the EU.
  • Content delivery and security: Cloudflare, Inc.
  • CRM, email marketing and chat: HubSpot, Inc. and its affiliates.
  • Spam protection and analytics: Google (Google Ireland Limited and Google LLC), for reCAPTCHA and Google Analytics.
  • Advertising measurement: Meta Platforms Ireland Limited, for the Meta Pixel, only if you accept cookies. We and Meta are joint controllers for the collection of data through the Meta Pixel and its transmission to Meta; Meta alone is responsible for its further processing.
  • Email and office services: Google Workspace (Google Ireland Limited).
  • Others where necessary: professional advisers, auditors, courts and public authorities where required by law, and a buyer or successor in the event of a merger, acquisition or sale of our business.

Our service providers process personal data on our behalf under data processing agreements and only on our instructions, except where a provider acts as an independent controller or joint controller as described above.

5. Transfers outside the European Economic Area

Some recipients (Google, Meta, HubSpot and Cloudflare) are based in, or may access data from, the United States. Where a recipient is certified under the EU-U.S. Data Privacy Framework, we rely on the European Commission adequacy decision of 10 July 2023. Otherwise we rely on the Standard Contractual Clauses adopted by the European Commission (Article 46(2)(c) GDPR).

Members of our team in Ukraine may access personal data in order to handle enquiries and projects. Ukraine is not covered by an EU adequacy decision, so these transfers are protected by the Standard Contractual Clauses adopted by the European Commission.

You can request a copy of the relevant safeguards by writing to welcome@revolsource.com.

6. How long we keep your data

  • Enquiries that do not lead to a contract: up to 12 months after our last contact with you.
  • Client and partner data: for the duration of the relationship and up to 3 years after it ends, to deal with possible claims.
  • Accounting documents, such as contracts and invoices: 7 years, as required by the Estonian Accounting Act.
  • Subscriptions: until you unsubscribe or withdraw your consent.
  • Job applications: up to 6 months after the recruitment process ends, or longer only with your consent.
  • Server and security logs: up to 14 days.
  • Cookies: as set out in our Cookies Policy.

If we must keep data longer to comply with the law or to establish, exercise or defend legal claims, we keep it only for that purpose. After that, we delete or anonymise it.

7. How we protect your data

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include encrypted connections (HTTPS), access control, firewalls, regular software updates, backups, an internal information security policy, staff training, and confidentiality obligations for our staff and contractors. No transmission over the internet is completely secure, so we cannot guarantee absolute security.

8. Your rights

Under the GDPR, you have the right to:

  • access the personal data we hold about you and receive a copy;
  • rectification of inaccurate or incomplete data;
  • erasure of your data, where there is no longer a lawful reason for us to keep it;
  • restriction of processing in the cases provided by law;
  • data portability, meaning to receive data you gave us in a structured, machine-readable format, where processing is based on consent or a contract and carried out by automated means;
  • object at any time to processing based on our legitimate interests, and to direct marketing, in which case we will stop using your data for that purpose;
  • withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise these rights, email us at welcome@revolsource.com. We will reply within one month. For complex or numerous requests we may extend this period by two further months, in which case we will tell you why. We may ask you to confirm your identity. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

You can unsubscribe from our emails at any time by clicking the unsubscribe link in any email. Unsubscribing stops our emails; if you also want us to delete your data, please tell us.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State where you live or work or where the alleged infringement took place. Our supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, www.aki.ee. We would appreciate the chance to address your concern first.

9. Cookies

We use cookies and similar technologies. Analytics and marketing cookies are set only with your consent, which you can give or refuse in the cookie banner and change at any time using the “Cookie” button in the bottom-left corner of any page. Read more in our Cookies Policy.

10. Children

The website and our services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, please contact us and we will delete it.

11. Links to other websites

The website may contain links to third-party websites and social networks. Their operators are responsible for their own processing of personal data, and we recommend that you read their privacy policies.

12. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top shows when it was last changed. If we make material changes, we will announce them on the website and, where appropriate, notify you by email.

See also our Cookies Policy and Terms and Conditions.

Content