Last updated: 26 October 2026
1. General information
This Privacy Policy describes how the personal data of visitors to pilus.ee is processed.
The controller responsible for processing personal data is:
Pilus OÜ
Registration number: 17002279
Address: Ravi tee 4, Haabneeme, Viimsi vald, Harjumaa, 74001, Estonia
Email: oleg@pilus.ee
Pilus OÜ processes personal data in accordance with the European Union’s General Data Protection Regulation (GDPR) and applicable Estonian legislation.
For questions concerning the processing of personal data, access to it, its rectification or erasure, please contact oleg@pilus.ee.
2. What data we process
When you use the website and request a consultation, we may process:
- your name and contact information;
- information entered in website forms;
- information about the condition of your hair and your preferences regarding procedures;
- photographs provided for a preliminary assessment;
- the content of enquiries and correspondence;
- technical data related to the use of the website.
We process information that users provide themselves, as well as technical data necessary for the operation and protection of the website.
3. Purposes of processing
Personal data may be used for:
- reviewing enquiries and requests;
- arranging and conducting consultations;
- making a preliminary assessment of whether procedures can be performed;
- communicating with users;
- ensuring the operation and security of the website;
- complying with applicable legal obligations.
The photographs and information about the condition of your hair that you provide are used in connection with your request for a consultation.
4. Legal bases for processing
Personal data is processed where there is an appropriate legal basis under Article 6 of the GDPR, in particular to take steps at the user’s request before entering into a contract, to comply with legal obligations or to pursue legitimate interests relating to website security.
Where the information provided constitutes data concerning health, its processing also requires an applicable condition under Article 9 of the GDPR, including the user’s explicit consent for reviewing the enquiry and conducting a consultation, or another basis provided for by law.
Consent to data processing for a consultation does not cover the use of photographs for advertising purposes or the sending of marketing messages.
5. Storage and disclosure of data
Enquiries submitted through the website may be stored in the website’s information systems and sent by email to the doctor for reviewing requests and conducting consultations.
Access to personal data is granted to the extent necessary to perform the relevant tasks.
Third-party technical service providers may be used to support the operation of the website and email.
We do not sell users’ personal data.
6. Retention periods
Personal data is retained for the period necessary to review enquiries, conduct consultations, maintain a history of interactions with patients and comply with legal requirements.
The retention period is determined taking into account the nature of the data provided, the purposes of processing, the need for continued medical care and applicable legal obligations.
Medical records may be subject to specific retention periods laid down by law.
Data whose continued retention is neither necessary nor mandatory is deleted or anonymised.
7. Cookies and protection against automated requests
The website may use cookies and similar technologies necessary for its operation and security.
Google reCAPTCHA is used to protect forms against automated submissions. When this service operates, certain technical data may be transmitted to Google.
Information about Google’s processing of data is available in Google’s privacy policy.
If optional tracking technologies are used on the website, users’ consent is requested where required by applicable legislation.
8. Protection of personal data
We take technical and organisational measures aimed at protecting personal data against unauthorised access, loss and unlawful use.
The specific safeguards are determined taking into account the nature of the information processed and the technical infrastructure used.
9. Users’ rights
Under the GDPR, users may have the right to:
- receive information about the processing of their data;
- request access to personal data;
- request rectification of inaccurate information;
- request erasure of data in the cases provided for by law;
- request restriction of processing;
- object to certain types of processing;
- withdraw consent where processing is based on consent.
The exercise of certain rights may be limited by legal requirements, particularly in relation to medical records.
For enquiries concerning personal data, please contact oleg@pilus.ee.
Users also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): https://www.aki.ee.
10. Changes to this Policy
This Privacy Policy may be updated to reflect changes in legislation, the operation of the website and personal data processing practices.
The current version is published on pilus.ee.