Privacy policy
Last updated: 28 October 2026
This policy explains what personal data the Slotafit website collects, why, and what rights you have under the EU General Data Protection Regulation (GDPR).
Who is responsible
The data controller is Slotafit OÜ, a company registered in Estonia (registry code 17614893). Its official company details are listed in the Estonian e-Business Register (ariregister.rik.ee).
Registered postal address: For any privacy question or request, email .
What we collect and why
- Your email address, if you sign up. We use it for one thing: to email you once when Slotafit ordering opens. With it we store whether you have confirmed the address, a random code used for the confirm and unsubscribe links, and the dates you signed up and confirmed. Legal basis: your consent (Art. 6(1)(a) GDPR).
- Technical data needed to run the site securely. When you load a page, your browser sends your IP address and basic browser details to our hosting and network providers, who keep short-term server logs to deliver the site and protect it from attacks. To stop the sign-up form being abused, our server counts attempts per visitor using a scrambled, hourly-changing code derived from the IP address. That code can't be turned back into your IP address and is deleted after one hour. We do not store IP addresses with sign-ups. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
We don't use analytics, advertising trackers or social media plugins. Fonts are served from our own server, not from Google.
Cookies
We don't set any cookies. Our network provider, Cloudflare, may set a strictly necessary security cookie to tell people from bots. It isn't used for tracking, so no consent banner is required for it.
Double opt-in
After you sign up, we send a confirmation link. You are only added to the list once you press the button on the confirmation page. If you don't confirm, your address is deleted automatically within 7 days.
How long we keep it
- Unconfirmed sign-ups: deleted after 7 days.
- Confirmed sign-ups: kept until we send the launch email, then deleted. If ordering hasn't opened within 24 months, we delete the list anyway. You can unsubscribe at any time before that.
- Server logs held by our hosting and network providers: kept only for a limited period, as set by those providers, for security and troubleshooting.
Who processes the data for us
- Namecheap, Inc. hosts the website, stores the sign-up list and sends our emails.
- Cloudflare, Inc. provides DNS and protects the site against attacks.
- Google (Gmail) receives our contact emails and sign-up notifications.
These providers act on our behalf under data processing agreements. Where data is processed outside the EU/EEA, this relies on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. We never sell or share your email with anyone else.
Your rights
You can ask us to access, correct, delete or export your data, restrict or object to its use, and withdraw consent at any time. Withdrawing consent doesn't affect what we did before. The quickest way to delete your sign-up is the unsubscribe link in our emails. For anything else, email and we'll reply within one month.
You also have the right to complain to a data protection authority, in particular the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or the authority in the EU country where you live.
Changes
If we change this policy, we'll update the date at the top. If you're on our list and the change matters, we'll tell you by email.