Customer Data Processing
Roofit Solar Energy OÜ
Effective from: 24 August 2026
1. General
These principles explain how Roofit Solar Energy OÜ (trade name Roofit.Solar, hereinafter “Roofit.Solar” or “we”) collects and processes personal data when you visit our website, submit an inquiry to us, or have a customer or business relationship with us.
We process personal data in accordance with the European Union General Data Protection Regulation (EU) 2016/679 (GDPR) and the Estonian Personal Data Protection Act. If we provide services in another EU country, the data protection legislation of that country also applies.
Controller
Roofit Solar Energy OÜ
Registry code: 12978418
VAT number: EE101855934
Address: Härgmäe tn 21, Haabersti district, 13525 Tallinn, Harju County, Estonia
Email:
Phone: +372 550 0625
No Data Protection Officer has been appointed because there is no obligation to do so under Article 37 of the GDPR. For all data protection matters, you can contact us at the email address provided above.
2. What Data We Collect
2.1. Data You Provide Yourself
When you fill out the quotation request form on our website, we collect the following data.
Contact details:
- First and last name
- Email address
- Telephone number
Property details:
- Street and house number
- City, postal code and country
- Roof area (m²)
Project details:
- Project type (new construction or roof renovation)
- Expected project start date
- Free-text message and any other information that you voluntarily provide in the form or in subsequent correspondence
Fields marked with an asterisk are mandatory — without them, it is not possible to prepare a quotation.
2.2. Data Generated When Using the Website
- IP address
- Device and browser type, operating system
- Pages visited, time and duration of the visit
- Source that referred you to the website (e.g. search engine, advertisement, link from another website)
This data is collected using cookies and similar technologies — see Section 7.
2.3. Data We Receive from Third Parties
If you have submitted an inquiry through our partner, reseller or installer, that partner may provide us with your contact details and a description of your project. We may also supplement business customer data from publicly available sources (e.g. the commercial register or a company’s website).We do not knowingly collect or process special categories of personal data (Article 9 of the GDPR) and ask you not to provide such data to us.
3. Purposes of Processing, Legal Bases and Retention Periods
| Purpose | Data | Legal basis | Retention period |
| Responding to an inquiry, preparing a quotation, pre-contractual negotiations | Contact details, property and project data | Steps prior to entering into a contract at the request of the data subject (Article 6(1)(b)) | 3 years from the last contact if no contract is concluded |
| Referring an inquiry to a suitable partner or installer | Contact details, property and project data | Legitimate interest (Article 6(1)(f)) — effective processing of inquiries through the local partner network | See above; the partner processes the data under its own responsibility |
| Contract performance: delivery, installation, warranty, customer support | Contact, property, order and technical data | Performance of a contract (Article 6(1)(b)) | For the duration of the contract and 3 years after its termination; warranty data until the end of the warranty period + 3 years |
| Accounting and tax accounting | Invoice and transaction data | Legal obligation (Article 6(1)(c)) — Accounting Act | 7 years from the end of the financial year |
| Handling claims and disputes, bringing and defending legal claims | All relevant data | Legitimate interest (Article 6(1)(f)) | Until the expiry of the applicable limitation period |
| Website usage statistics and improvement | Usage data, IP address | Consent (Article 6(1)(a)) | Up to 14 months |
| Service-related notifications to existing customers | Contact details | Legitimate interest (Article 6(1)(f)) | During the customer relationship |
Where we process data on the basis of legitimate interest, we have assessed our interests against your rights and determined that the processing does not disproportionately affect your interests. You may request a summary of this assessment using the contact details provided in Section 1.
4. Data Transfers
4.1. Partners and Installers
Roofit.Solar sells and installs products in cooperation with local partners, resellers and installation companies. In order for your inquiry to receive a substantive response, we may transfer your contact and project data to a partner operating in your region.
The partner uses this data as an independent controller to prepare a quotation and contact you. This means that the partner’s subsequent processing of the data is governed by the partner’s own privacy notice. When transferring your inquiry, we will inform you which partner will contact you. You have the right to object to the transfer (see Section 6).
We only transfer data to partners with whom we have agreed that they will process data in accordance with applicable data protection legislation.
4.2 Data Processors
We use trusted service providers that process data only according to our instructions and under a data processing agreement concluded with us pursuant to Article 28 of the GDPR:
- Pipedrive — customer relationship management (CRM), where inquiries submitted through the website form are stored
- Google Ireland Ltd — Google Tag Manager and Google Analytics (website statistics), and Google reCAPTCHA (protection of forms against spam and automated bots)
- Website hosting and WordPress management service provider
- Email and office software provider
- Accounting and IT service providers
You may request a complete list of our data processors using the contact details provided in Section 1.
Google reCAPTCHA. Our quotation request form is protected by Google reCAPTCHA. As part of this process, your IP address and information about how you navigate the website and form are transmitted to Google in order to distinguish human users from automated requests. The legal basis for this processing is our legitimate interest in protecting our systems against misuse (Article 6(1)(f)).
Information about Google’s processing can be found at policies.google.com/privacy.
4.3 Other Recipients
Data may also be transferred to our legal advisers, auditors, insurers, debt collection service providers and government authorities where there is a legal basis or obligation to do so.
We do not sell your personal data to third parties.
5. Transfers of Data Outside the European Economic Area
We seek to keep data within the EU/EEA. However, some of our service providers may process data outside the EEA, particularly in the United States. In such cases, we ensure that the transfer is lawful on one of the following bases:
- An adequacy decision of the European Commission (e.g. the EU–US Data Privacy Framework, DPF)
- European Commission Standard Contractual Clauses (SCCs) together with additional safeguards
You may request a copy of the basis for the transfer and the relevant safeguards using the contact details provided in Section 1.
6. Your Rights
- Access — to obtain information about whether and what personal data we process about you and to receive a copy of that data
- Rectification — to request correction of inaccurate or incomplete data
- Erasure — to request deletion of data where there is no continuing legal basis for processing it
- Restriction of processing — to request temporary suspension of processing, for example if you dispute the accuracy of the data
- Data portability — to receive data processed on the basis of consent or a contract in a machine-readable format or to have it transferred to another controller
- Objection — to object to processing based on legitimate interest, including the transfer of an inquiry to a partner. In the case of an objection to direct marketing, we will always stop the processing
- Withdrawal of consent — to withdraw consent at any time. This does not affect the lawfulness of processing carried out before the withdrawal of consent
To submit a request, write to info@roofit.solar. We will respond within one month. To verify your identity, we may request additional information.
Submitting a complaint. If you believe that we are violating data protection requirements, you have the right to contact the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, , tel. +372 627 4135, www.aki.ee, or the supervisory authority in your country of residence.
7. Cookies
A cookie is a small text file that a website stores on your device.
Necessary cookies ensure that the website functions and remains secure. We use these without consent because the website cannot function without them.
Analytics cookies (Google Analytics, Google Tag Manager) help us understand how the website is used and improve it. We only use these with your consent, which you provide through the cookie notice.
You can withdraw your consent or change your choices at any time through the cookie settings. We retain this data for up to 14 months (see also Section 3).
Google reCAPTCHA uses cookies to protect forms and reads browser data. Without this, the quotation request form cannot be submitted.You can also manage and delete cookies through your browser settings. Blocking necessary cookies may limit the functionality of the website.
8. Security
We implement appropriate technical and organizational measures to protect data against unauthorized access, alteration, disclosure and destruction. These measures include restricting access rights based on job responsibilities, encrypted connections, backups and employees’ confidentiality obligations. In the event of a personal data breach, we will notify the Estonian Data Protection Inspectorate within 72 hours and, where necessary, also notify you.
9. Voluntary Provision of Data
Providing personal data is voluntary. However, without contact details, we cannot respond to your inquiry or prepare a quotation. Our services and quotation request form are intended for adults and representatives of companies. Minors are asked to submit an inquiry through a parent or legal representative.
10. Automated Decision-Making
We do not make decisions based solely on automated processing that would have a legal or similarly significant effect on you, nor do we use profiling for such decisions.
11. Changes to These Principles
We may update these principles from time to time to reflect changes in our activities or legislation. The current version is always available on our website. In the event of significant changes, we will notify you separately.
For questions, please contact: