1. Controller
The controller responsible for the processing of personal data on the website upmarkit.com is:
Upmarkit OÜ
Sepapaja 6, 15551 Tallinn, Estonia
represented by Klaus Heine
Email: klausheine@upmarkit.com
Phone: +372 5 274 468
For all questions about data protection and to exercise your rights, contact us at klausheine@upmarkit.com.
2. Scope
This notice applies to the website upmarkit.com. The Fablab learning platform (fablab.upmarkit.com) has its own privacy notice, linked there. This website has no user accounts for visitors; logins are intended only for the editorial team.
3. Hosting and access logs
The website runs on a server in Germany that we rent from a hosting provider (data centre in Dortmund). A data processing agreement under Article 28 GDPR is in place with the hosting provider.
On every request the web server automatically records in log files: IP address, date and time, requested address, amount of data transferred, the previously visited page (referrer), and browser type and operating system. These logs serve secure and stable operation, troubleshooting and the defence against attacks, and are deleted after 14 days. The legal basis is our legitimate interest in secure operation (Article 6(1)(f) GDPR).
Backups of the server are created weekly and kept in two generations, that is for about 14 days. They serve only for recovery after a failure.
4. Contact
The website has no contact form. If you write to us by email, we process your details (name, email address, content of the message) to handle your request and delete them once the request has been dealt with and no retention obligations apply.
The legal basis is handling your request as a pre-contractual measure (Article 6(1)(b) GDPR) or our legitimate interest in responding (Article 6(1)(f) GDPR).
5. Web analytics with Matomo
We use the analytics software Matomo, which runs on our own server (analytics.upmarkit.com). No data is transferred to third parties. Matomo stores the IP address only in shortened form, so that it cannot be traced back to your connection, and records pages visited, time spent, the previously visited page, browser and device type, and downloaded files. Matomo works without cookies; no identifiers are stored on your device.
We use the evaluation solely to understand which content is used and to improve the website. The legal basis is our legitimate interest in audience measurement (Article 6(1)(f) GDPR). You can object at any time: Matomo respects your browser's "Do Not Track" setting, and you can switch off tracking on our opt-out page. Logged-in editors are not tracked.
6. Cookies
The website sets no cookies for visitors, not even for web analytics. Cookies may be set only after your click by embedded videos (section 7). Editorial logins use a technically necessary session cookie.
7. YouTube videos
In some places we link to videos on YouTube. A video is loaded only when you click the link; the YouTube player then opens in an overlay. From that moment Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) processes your IP address and may set cookies; if you are signed in to Google, the request may be associated with your account. This may involve a transfer to the USA. Google's privacy policy applies. The legal basis is your decision to play the video (Article 6(1)(a) GDPR); without a click no data is sent to Google.
8. No other third-party services
Fonts, scripts and stylesheets are delivered from our own server. When pages are loaded, no content is retrieved from other providers.
9. Disclosure to third parties
Apart from the hosting provider (section 3) and, after your click, Google (section 7), we do not pass on your data unless we are legally obliged to do so or you have consented.
10. Retention
- Access logs: 14 days.
- Backups: about 14 days.
- Email requests: until dealt with, then deletion unless statutory retention obligations apply.
- Matomo statistics: pseudonymous, with shortened IP address, retained for evaluating website usage.
11. Your rights
You have the right to access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object to processing based on legitimate interest (Article 21). To do so, write to klausheine@upmarkit.com.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence or workplace. For us as an Estonian company, the Estonian Data Protection Inspectorate is competent (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia, www.aki.ee).
12. Data security
Data is transmitted encrypted (TLS). Access to the server is restricted to the operator; the editorial login is protected by passwords and lockouts after failed attempts.
13. Changes
We adapt this notice when the website or the legal situation changes. The version published here applies.
Version: 4 September 2026