Privacy policy
How VD AGENTUUR OÜ (Vibex) handles personal data when you visit vibex.agency, book a call or email us.
Last updated: 26 October 2026 · Effective date: 26 October 2026
Data collection summary
| Data | Source | Legal basis | Retention |
|---|---|---|---|
| Name, email, chosen time and anything you add when booking | Calendly booking calendar on the Website | Steps before entering a contract / legitimate interest | 24 months after our last contact |
| Name, email and message content | Emails you send us | Steps before entering a contract / legitimate interest | 24 months after our last contact |
| IP address, browser and device data, pages requested | Web server and hosting logs | Legitimate interest (security, operating the site) | Up to 90 days |
| IP address and browser data | Google Fonts and Calendly, when their content loads | Legitimate interest | Set by each provider |
| Business contact data (journalists, clients, partners) | Email, calls, meetings, outreach | Contract / legitimate interest | For the business relationship, then as the law requires |
1. Introduction
This Privacy Policy explains how VD AGENTUUR OÜ ("Vibex", "we", "us", "our"), a company registered in Estonia (registry code 14449270, registered address Parda tn 6, Tallinn 10151, Estonia), processes personal data when you visit https://vibex.agency (the "Website"), book a call with us or contact us. We act as the controller of the personal data described here, in line with Regulation (EU) 2016/679 (GDPR) and the Estonian Personal Data Protection Act.
Plain English: We are a digital PR and content agency. This page tells you what personal data we collect through our website, why, and what you can do about it.
2. Information we collect
Information you give us. When you book a call through the booking calendar on the Website, you give us your name, your email address, the time you choose and any notes or answers you add. When you email us, we receive your name, email address, your message and any other details you choose to share.
Information collected automatically. Like most websites, our hosting provider logs your IP address, browser type, device type, referring page and the date and time of your visit. When a page loads fonts from Google Fonts, or the booking calendar from Calendly, your browser connects to those providers and they receive your IP address and basic browser data.
Information from other sources. In the course of our digital PR work we may hold business contact details of journalists, editors and prospective clients from public sources and professional networks.
We do not intentionally collect special categories of personal data (such as health data or political opinions) through the Website.
Plain English: We get what you enter when you book a call or email us, plus basic technical data that every web server records.
3. How we use your information
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Schedule and hold the call you booked, reply to enquiries and discuss possible work with you | Name, email, booking details, message | Art. 6(1)(f) legitimate interest, or 6(1)(b) steps before a contract |
| Operate, secure and troubleshoot the Website | IP address, device and log data | Art. 6(1)(f) legitimate interest |
| Comply with accounting, tax and other legal duties | Invoicing and contract data | Art. 6(1)(c) legal obligation |
We do not use the Website for analytics, advertising or newsletters. If that changes, we will ask for your consent first where the law requires it and update this policy.
Plain English: We use your data to hold the call you booked, answer you and keep the site running. Nothing else.
4. Cookies and tracking
Cookies are small files stored on your device. Our own pages do not set cookies, do not store anything in your browser and do not use analytics tools, tracking pixels or advertising tags.
Two third-party services load content on the Website:
- Calendly (booking calendar). It loads on pages that show the booking calendar and when you open the booking window. Calendly may set its own cookies needed for scheduling. See Calendly's privacy notice.
- Google Fonts (typefaces). Your browser requests the fonts from Google, which receives your IP address. Google states that the Fonts service does not set cookies. See Google's privacy policy.
You can block or delete cookies in your browser settings. Blocking Calendly's cookies may stop the booking calendar from working; you can always email us instead.
Plain English: We don't track you. The booking calendar and our fonts come from Calendly and Google, and they see your IP address when they load.
5. Information sharing
We do not sell your personal data. We share it only with:
- Service providers (processors) that help us run the Website and our business: Calendly (scheduling), Google (fonts), our web hosting provider, and our email and productivity tools.
- Professional advisers such as accountants and lawyers, bound by confidentiality.
- Authorities, where the law requires it.
Processors act only on our instructions under a data processing agreement.
Plain English: We never sell your data. Only the tools and advisers we need to run the business see it.
6. Data retention
| Data | Retention |
|---|---|
| Bookings and email enquiries | 24 months after our last contact, unless a business relationship continues |
| Server and hosting logs | Up to 90 days |
| Accounting records | 7 years, as required by Estonian accounting law |
When the period ends we delete or anonymize the data.
7. Your rights under the GDPR
You have these rights. To use any of them, contact us using the details in section 12. We will respond within one month.
- Right of access (Article 15): request a copy of the personal data we hold about you.
- Right to rectification (Article 16): have inaccurate or incomplete data corrected.
- Right to erasure (Article 17): ask us to delete your data, for example when it is no longer needed or you withdraw consent.
- Right to restrict processing (Article 18): ask us to limit how we use your data in certain cases.
- Right to data portability (Article 20): receive data you gave us in a structured, machine-readable format.
- Right to object (Article 21): object to processing based on legitimate interest, and at any time to direct marketing.
- Rights related to automated decision-making (Article 22): we do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.
Where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.
Complaints. You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee, info@aki.ee, or with the supervisory authority in your own EU country.
Plain English: You can see, fix, delete or move your data, object to how we use it, and complain to the regulator if you are unhappy.
8. Your rights under the CCPA
If you are a California resident and the CCPA applies, you have the right to:
- Know what personal information we collect, use, disclose and why.
- Delete personal information we collected from you, subject to exceptions.
- Opt out of the sale or sharing of your personal information. We do not sell or share personal information for cross-context behavioural advertising.
- Non-discrimination for exercising your rights.
- Correct inaccurate personal information.
- Limit use of sensitive personal information. We do not collect sensitive personal information for purposes that would trigger this right.
To exercise these rights, contact us as described in section 12. We may need to verify your identity first.
9. Data security
We use technical and organisational measures suited to the risk, including encrypted connections (HTTPS), access limited to people who need the data, and reputable service providers. No online transmission is completely secure, so we cannot guarantee absolute security. In the event of a personal data breach that poses a risk to you, we will notify the supervisory authority and affected individuals as the law requires.
10. International transfers
We aim to keep personal data within the European Economic Area. Calendly and Google are based in the United States, so data handled by them may be processed outside the EEA. For these transfers we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or Standard Contractual Clauses approved by the European Commission.
11. Children's privacy
The Website is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
12. Contact and updates
- Controller
- VD AGENTUUR OÜ (Vibex)
- Registry code
- 14449270
- Address
- Parda tn 6, Tallinn 10151, Estonia
- hello@vibex.agency
We may update this policy from time to time. The "Last updated" date at the top shows when it last changed, and for material changes we will post a notice on the Website.