Privacy Policy

Last updated: May 2026

Thorian Security OU ("Thorian", "we", "us") is committed to protecting your personal data. This privacy policy explains how we collect, use, and share information when you interact with our website (thorian.io) and our services.

1. Data Controller

Thorian Security OU
Tallinn, Estonia
Email: hello@thorian.io

2. What Data We Collect

We collect personal data only when you voluntarily provide it to us:

• Contact form submissions — name, email address, company name, and message content when you reach out through our website.
• Newsletter signups — email address and consent status when you opt in to receive updates about EU AI Act developments.
• Communication data — email correspondence and meeting notes when you engage with us professionally.
• UTM parameters — referral source captured for campaign attribution purposes only.

3. How We Use Your Data

We use the data we collect for the following purposes:

• Responding to your inquiries and scheduling calls.
• Delivering compliance assessment services and related deliverables.
• Sending newsletter updates (only with your explicit consent).
• Complying with legal obligations under Estonian and EU law.

4. Legal Basis for Processing

Under the GDPR, we process your data on the following legal bases:

• Consent — when you subscribe to our newsletter or otherwise give explicit permission.
• Legitimate interest — when we respond to your contact form inquiry or communicate about services you've requested.
• Contract performance — when we deliver paid assessment services to you.
• Legal obligation — when required by Estonian or EU law (e.g., tax and corporate records).

5. Third-Party Services

We use the following third-party services:

• Cloudflare — web hosting and CDN. Standard access logs (IP address, request headers) are collected for security and performance. Cloudflare Privacy Policy.
• n8n — our workflow automation. Contact form submissions are sent securely to our n8n instance for processing. We do not share your data with other third parties.

6. Data Retention

We retain your personal data only as long as necessary:

• Contact inquiries — retained for 24 months after last interaction, or longer if a professional engagement follows.
• Newsletter subscribers — retained until you unsubscribe.
• Client records — retained for the duration of our professional relationship plus 7 years for legal and tax compliance.

7. Your Rights

Under the GDPR, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate data.
• Right to erasure — request deletion of your data ("right to be forgotten").
• Right to restrict processing — limit how we use your data.
• Right to data portability — receive your data in a machine-readable format.
• Right to object — object to processing based on legitimate interest or direct marketing.
• Right to withdraw consent — withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email us at hello@thorian.io. We will respond within 30 days.

8. Data Transfers

As an Estonian company, your data is stored within the European Economic Area (EEA). Where data is transferred outside the EEA (e.g., Google Fonts from the US), we rely on appropriate safeguards such as the EU-US Data Privacy Framework.

9. Client Data

When we deliver compliance assessment services, we may process information about your AI systems, technical infrastructure, and compliance posture. This data is processed under the terms of our engagement agreement and treated as confidential. We do not share client assessment data with third parties except as required by law or with your explicit consent.

10. Automated Decision-Making

We use AI-assisted tools as part of our compliance assessment process. However, all final assessments and deliverables are reviewed and signed off by a qualified human assessor. We do not make solely automated decisions that produce legal or similarly significant effects on individuals.

11. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay.

12. Security

We implement reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, or alteration. This includes encrypted connections (HTTPS), access controls, and regular security reviews.

13. Children's Data

Our services are not directed to persons under the age of 16. We do not knowingly collect personal data from children.

14. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. For significant changes, we will notify you via email or a notice on our website.

15. Contact

For any questions about this privacy policy or how we handle your data, contact us at hello@thorian.io.

You also have the right to lodge a complaint with a supervisory authority in your EU member state. In Estonia, the relevant authority is the Estonian Data Protection Inspectorate (Andmeskaitja Inspektsioon).