EPISTEMIS OÜ
Last updated: 14 October 2026
1. Data Controller
The controller responsible for processing personal data in connection with this website within the meaning of the General Data Protection Regulation (GDPR) is:
EPISTEMIS OÜNarva mnt 5, 10117 Tallinn, Estoniainfo@epistemis.comhttps://epistemis.comThis email address is also our central contact point for privacy enquiries and requests to exercise data protection rights.
2. Scope and General Principles
This Privacy Policy explains which personal data may be processed when you use the publicly accessible EPISTEMIS website, the purposes of that processing, and the rights available to individuals.
It applies to the English and German versions of the website at epistemis.com.
The website provides information about EPISTEMIS, its decision-state infrastructure, application areas and opportunities for cooperation.
No registration or user account is required to visit the website. The website does not maintain its own database for storing visitor profiles and does not provide a contact form or a public document-upload function.
Personal data may nevertheless be processed when the website is technically delivered or when you voluntarily contact us by email.
This Privacy Policy does not cover separately provided EPISTEMIS product systems, Enterprise Pilots or customer-specific applications. Such activities may be subject to separate contractual and data protection arrangements.
3. Hosting and Technical Delivery
3.1 Hosting Provider
The website is hosted and delivered through Lovable Publish. Lovable provides the technical delivery and hosting infrastructure, including the service providers engaged for these purposes.
Provider information:
3.2 Processing of Technical Access Data
When you access the website, technically necessary information is transmitted between your device and the infrastructure delivering the requested content.
Depending on the technical processing involved, this may include:
- The IP address of the accessing device;
- Date and time of access;
- Requested URL and files;
- Browser type, browser version and operating system;
- Referrer information, where transmitted;
- Technical response codes, error information and security-related data.
Such information is processed to deliver the website, maintain its functionality and availability, diagnose errors, and identify or prevent technical attacks and misuse.
The legal basis for processing carried out under EPISTEMIS's responsibility is Article 6(1)(f) GDPR. Our legitimate interest is to operate a secure, reliable and functional website.
Where Lovable processes personal data on behalf of EPISTEMIS, it does so under the applicable contractual data protection arrangements. For certain operational, service and security data, Lovable may also act as an independent controller under its own privacy terms.
3.3 Retention of Technical Log Data
Lovable applies purpose-based retention criteria to operational and security logs.
According to its published information, such data are retained for as long as necessary to operate and secure the services. Longer retention may be necessary when investigating specific security incidents. Applicable statutory retention obligations remain unaffected.
Lovable does not publish a single fixed retention period, expressed in days, for all such logs.
Further information about the applicable retention criteria is available in Lovable's Privacy Policy:
The twelve-month email retention rules adopted by EPISTEMIS do not apply to these technical hosting logs.
4. Cookies and browser storage
Cookies and browser storage are used on this website to support its technical delivery, security and navigation. We do not use cookies for analytics, advertising or cross-website tracking.
__dpl — set by our hosting provider, Lovable, as part of the website’s delivery infrastructure.
__cf_bm — set by Cloudflare for bot detection and website protection.
Session storage — used by the website’s navigation system to remember and restore scroll positions when you move between pages.
We do not use these technologies for advertising or to track you across websites. The website language is determined by the URL you visit, rather than by a language-preference cookie.
5. Contact by Email
5.1 Method of Contact
You may contact EPISTEMIS using the publicly displayed email address info@epistemis.com.
The website provides an email link (mailto:) that can open your own email application. Depending on the enquiry topic selected, a corresponding subject line may be prefilled.
The website itself does not collect message content, operate a contact form or send emails.
Only when you send a message through your email application will the information you provide be processed as part of the email communication.
5.2 Categories of Personal Data
The personal data processed may include:
- Name and email address;
- Organisation and professional contact information;
- Subject and content of the message;
- Information relating to a proposed pilot project, cooperation or other business relationship;
- Other information voluntarily provided;
- Technical email communication data.
Please do not send confidential business documents, case-specific personal data, particularly sensitive information or legally privileged material in an initial enquiry unless the transmission has been expressly agreed in advance.
5.3 Purposes and Legal Bases
We process incoming messages to respond to enquiries, communicate with interested parties and business partners, and, where applicable, prepare or carry out contractual cooperation.
Depending on the nature of the communication, processing is based on:
- Article 6(1)(b) GDPR, where processing is necessary to take pre-contractual steps at the request of the data subject or to perform a contract with that person;
- Article 6(1)(f) GDPR for other general or business communications. Our legitimate interest is to respond to enquiries and establish or maintain business relationships;
- Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation.
6. Email Hosting and Message Processing
EPISTEMIS uses domainfactory GmbH (DomainFactory) to operate the mailbox info@epistemis.com.
DomainFactory provides the technical infrastructure for receiving, storing and sending emails. This involves processing message content, addressing information and technical transmission data necessary for email communication.
According to DomainFactory's published information, the servers used for its Professional Email platform are located in Frankfurt am Main, Germany. The provider also states that service-related data may be processed outside Germany and Europe.
EPISTEMIS uses Microsoft Outlook as its email application. Local copies of messages may therefore be stored on devices used to manage the mailbox.
Provider information:
Processing by DomainFactory is governed by the applicable contractual data protection arrangements.
7. Email Retention and Deletion
EPISTEMIS does not retain personal data contained in email communications longer than necessary for the relevant purposes, unless statutory retention obligations or other legally justified grounds require continued retention.
The following rules apply:
7.1 General Enquiries
General enquiries that do not result in a business relationship will be deleted no later than twelve months after the correspondence has concluded.
7.2 Pilot, Cooperation and Investor Enquiries
Where no contractual cooperation results, the relevant messages will be deleted no later than twelve months after the discussions have concluded.
7.3 Business and Contractual Correspondence
Where a business relationship is established, necessary documents and messages are retained for their relevant purposes and in accordance with applicable statutory retention requirements.
This may include correspondence relevant to commercial, tax or contractual obligations.
Data will be deleted once the applicable retention grounds cease to apply, unless another lawful basis justifies continued retention.
7.4 Data Protection Requests
Requests to exercise data protection rights will initially be retained for the duration of their processing.
After completion, only information necessary to fulfil legal accountability obligations or to establish, exercise or defend legal claims will be retained.
The remaining information will be deleted when the relevant grounds for retention cease to apply.
7.5 Deletion Procedure
EPISTEMIS manually deletes the email records under its control.
This includes the mailbox, sent messages, archives and any locally stored Outlook copies.
Technical backups or recovery systems operated by the email provider are subject to the applicable contractual deletion procedures.
8. Recipients of Personal Data
Personal data are disclosed to third parties or made accessible to them only to the extent necessary for the relevant processing purposes or where disclosure is legally required.
Our service providers include:
- Lovable: Website hosting, technical delivery and security infrastructure, including subprocessors engaged for these purposes.
- domainfactory GmbH: Provision of the email mailbox and communication infrastructure, including any subprocessors engaged by the provider.
Personal data may also be disclosed, where necessary and legally justified, to competent public authorities or professional advisers subject to confidentiality obligations.
EPISTEMIS does not transmit personal visitor data to advertising platforms to create its own marketing or retargeting audiences.
9. International Data Transfers
The provision of website hosting and email services may involve the processing or transfer of personal data outside the European Economic Area (EEA).
Lovable expressly identifies processing in several countries, including the United States, in its privacy documentation.
Lovable describes appropriate data protection safeguards for transfers outside the EEA. In particular, its Data Processing Agreement provides for the use of the European Commission's Standard Contractual Clauses in the relevant processor arrangements.
DomainFactory also states that service-related processing for its Professional Email services may take place outside Germany and Europe.
Any transfer of personal data to a third country must comply with Articles 44 et seq. GDPR. Depending on the recipient and transfer mechanism, an applicable adequacy decision by the European Commission or appropriate safeguards under Article 46 GDPR may provide the relevant legal basis for the transfer.
The specific transfer arrangements and safeguards depend on the applicable contractual documents and subprocessors involved.
Further information and details of the applicable safeguards may be requested by contacting info@epistemis.com.
10. External Links
The website contains links to external websites, publications, institutional information sources and other online resources.
When you follow such a link, you may leave the EPISTEMIS website. Processing carried out independently by the external website operator is governed by that operator's privacy policy.
EPISTEMIS does not control the data protection practices of independently operated external websites.
11. Rights of Data Subjects
Subject to the applicable legal requirements, you have the following rights:
- Access to your personal data under Article 15 GDPR;
- Rectification of inaccurate or completion of incomplete data under Article 16 GDPR;
- Erasure of personal data under Article 17 GDPR;
- Restriction of processing under Article 18 GDPR;
- Data portability, where applicable, under Article 20 GDPR;
- Objection to processing based on legitimate interests under Article 21 GDPR.
Where processing is based on consent, you may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
To exercise your rights, please contact info@epistemis.com.
Where necessary to handle your request, we may ask for additional information to verify your identity.
12. Right to Lodge a Complaint
You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.
For EPISTEMIS OÜ, established in Estonia, the relevant authorities include:
Andmekaitse Inspektsioon – Estonian Data Protection Inspectorate
You may also contact another competent supervisory authority under the GDPR, including an authority in the EU Member State of your habitual residence, place of work or the location of the alleged infringement.
13. Provision of Personal Data
The transmission of technically necessary connection data is required to access and display the website.
Contacting EPISTEMIS by email is voluntary. Without the contact information necessary to respond, we may be unable to process your enquiry individually.
There is no further statutory or contractual obligation to provide personal data merely to browse the public website.
14. Automated Decision-Making and Profiling
EPISTEMIS does not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR in connection with the use of this public website.
Information about EPISTEMIS application cases and product concepts must be distinguished from any actual processing of personal data within separately provided product systems.
15. Changes to This Privacy Policy
We review this Privacy Policy when the website's technical functions, service providers, processing purposes or applicable legal requirements change.
The current version will be made available on this website.