EU / Estonian GDPR Privacy & Data Protection Policy
Effective Date: November 2026 · Standard: Regulation (EU) 2016/679 (GDPR), Estonian Personal Data Protection Act (Isikuandmete kaitse seadus), & WCAG 2.2 Level AA
Rasa X Machina OÜ (Tallinn, Estonia) engineers its web surfaces under strict Privacy by Design and by Default (GDPR Article 25). We deploy zero third-party advertising trackers, behavioral profiling pixels, or cross-site cookies. Browser localStorage is used strictly for functional user preferences (tx_pref_currency, tx_pref_lang, tx_pref_country) to ensure 100% single-currency pricing consistency.
1. Data Controller & Data Protection Contact (GDPR Art. 13)
Data Controller: Rasa X Machina OÜ (Tallinn, Republic of Estonia), founded by Collins Takem.
Data Protection Officer / Principal Contact: coltak@rasaxmachina.com / support@rasaxmachina.com.
Supervisory Authority: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon — AKI), Tatari 39, 10134 Tallinn, Estonia (www.aki.ee).
2. Categories of Personal Data & Lawful Basis (GDPR Art. 6)
- Contractual Performance (Art. 6(1)(b)): Billing email, name, organization, and selected SKU/plan when you purchase a software capability or commission a VRTTI Architecture Sprint.
- Explicit Consent (Art. 6(1)(a)): Scope inquiry submissions via our Merkle-Signed Proposal Calculator.
- Legal Obligation (Art. 6(1)(c)): Statutory Estonian accounting and tax invoice records (Estonian Accounting Act Raamatupidamise seadus — 7-year retention for financial ledger totals).
- Legitimate Interest & Enclave Security (Art. 6(1)(f)): Ephemeral MANAS System-1 firewall inspection to block SSRF, prompt-injection, and DDoS attacks.
3. Payment Security & Zero-PII On-Chain Ledger
Fiat card, Apple Pay, Google Pay, and SEPA transactions are processed directly by Stripe (PCI-DSS Level 1 certified) or Paddle / Gumroad. Rasa X Machina OÜ never receives, processes, or stores raw payment card numbers or CVV codes. Veritas-Rex TetraLedger records cryptographic SHA-256 Merkle hashes and anonymized receipt tokens—never plaintext personal data—on public blockchains (Solana / Base L2 / ETAMANGA).
4. Data Subject Rights & Cryptoshredding (GDPR Art. 15–22)
You may exercise the following rights at any time via our interactive portal (POST /api/v1/gdpr/request) or by emailing coltak@rasaxmachina.com:
- Right of Access (Art. 15): Receive a complete copy of all personal data associated with your email address.
- Right to Rectification (Art. 16): Correct inaccurate or incomplete account or inquiry records.
- Right to Erasure / "Right to be Forgotten" via Cryptoshredding (Art. 17): Aethervault destroys the per-subject encryption key and purges off-chain PII while preserving mathematical Merkle accounting integrity.
- Right to Data Portability (Art. 20): Export your records in structured, machine-readable JSON format.
5. European Sovereign Infrastructure & Transfers
Primary cloud relay and edge termination operate inside the European Union (Hetzner Finland/Germany EU enclave at 77.42.80.87 and Tallinn sovereign nodes) protected by post-quantum Rosenpass WireGuard tunnels and TLS 1.3. Where sub-processors (such as Stripe) process data internationally, EU Standard Contractual Clauses (SCCs) apply.
6. Web Accessibility Statement (WCAG 2.1 / 2.2 Level AA & EN 301 549)
All 28 subdomains of rasaxmachina.com are engineered in accordance with Chrome Modern Web Guidance 1.0, W3C WCAG 2.2 Level AA, and the European Accessibility Act (Directive (EU) 2019/882): keyboard skip-to-content navigation, semantic landmarks, high-contrast focus indicators, prefers-reduced-motion compliance, and screen-reader aria-live regions.