Privacy Policy

---

Last updated: 14 August 2026

This Privacy Policy explains how Ulam & Neumann OÜ collects, uses, stores, and otherwise processes personal data in connection with its website, professional services, customer relationships, communications, and payments.

The data controller responsible for the processing described in this Privacy Policy is:

Ulam & Neumann OÜ
Registry code: 16555361
VAT number: EE102589665
Registered address: Sepapaja tn 6, 15551 Tallinn, Estonia
Email: info@ulamneumann.com
Telephone: +372 513 2804

For questions concerning this Privacy Policy or the processing of personal data, please contact us at info@ulamneumann.com.

This Privacy Policy applies when you:

• visit our website;
• contact us by email, telephone, website form, or another communication channel;
• request information about our services;
• request or receive a quotation, proposal, or statement of work;
• enter into a contract with Ulam & Neumann;
• participate in a consultation, interview, workshop, training session, or research activity;
• receive professional services from us;
• make a payment to us;
• represent or work for one of our customers, prospective customers, suppliers, contractors, or professional partners; or
• otherwise interact with Ulam & Neumann in a professional capacity.

It applies to information relating to identifiable natural persons. Information relating solely to a legal entity is not personal data, although information concerning individuals who represent that legal entity may be personal data.

Depending on the nature of our relationship with you, we may process the following categories of personal data.

This may include:

• name;
• professional title or role;
• employer or organisation;
• email address;
• telephone number;
• business address;
• billing address; and
• other contact information you provide to us.

This may include:

• information contained in enquiries, proposals, quotations, contracts, statements of work, engagement letters, and correspondence;
• details of services requested or supplied;
• project scope and deliverables;
• customer instructions;
• meeting notes;
• project decisions and approvals;
• contractual terms;
• invoicing details; and
• records concerning the performance of an engagement.

This may include:

• invoice number;
• amount payable;
• currency;
• payment date;
• transaction reference;
• payment status;
• payment method;
• limited information provided by our bank or payment service provider concerning a transaction; and
• records relating to refunds, payment disputes, or chargebacks.

We do not normally receive or store complete payment-card numbers, card verification codes, or online-banking credentials. These are processed by the relevant bank, payment service provider, card scheme, or digital-wallet provider.

We may process correspondence and other communications exchanged with you, including:

• emails;
• messages;
• telephone call information;
• meeting correspondence;
• enquiries;
• feedback;
• complaints; and
• support requests.

When necessary for the provision of professional services, we may process information supplied by a customer or obtained during an engagement, including information relating to:

• business operations;
• regulatory or compliance matters;
• policies and procedures;
• organisational roles;
• professional responsibilities;
• research subjects;
• interview participants;
• business processes; and
• other information relevant to the agreed project.

Where possible, customers should avoid providing personal data that is not necessary for the agreed service.

When you use our website, our website or service providers may process limited technical information such as:

• IP address;
• browser type;
• device type;
• operating system;
• referring website;
• pages viewed;
• approximate date and time of access;
• security and diagnostic information; and
• cookie or similar technical identifiers where applicable.

The precise information processed depends on the website infrastructure and any analytics or cookie technologies in use.

We normally obtain personal data directly from you.

We may also obtain personal data from:

• your employer or organisation;
• another participant in a customer project;
• a customer that has engaged us to provide professional services;
• publicly available professional or business sources;
• company websites;
• public registers;
• professional networking platforms;
• our banking or payment providers;
• professional advisers; or
• other persons where this is relevant to an engagement and lawful.

Where we obtain personal data from someone other than the individual concerned, we process that information in accordance with applicable data-protection law.

We process personal data only where we have an appropriate legal basis under applicable data-protection law.

We process contact information, communications, and information about your requirements in order to:

• answer enquiries;
• understand your requirements;
• arrange introductory discussions;
• prepare quotations or proposals; and
• take steps requested before entering into a contract.

Legal basis: taking steps at your request before entering into a contract, where you are personally a party to the proposed contract; otherwise, our legitimate interest in developing and managing professional business relationships.

We process personal data where necessary to:

• establish and manage customer engagements;
• communicate with customers;
• perform consultancy, research, analysis, training, policy-development, documentation, and related services;
• arrange meetings and workshops;
• produce agreed deliverables;
• administer projects; and
• maintain appropriate records of work performed.

Legal basis: performance of a contract where you are personally a party to the contract; otherwise, our legitimate interest in performing contracts with our customers and administering professional engagements.

We process invoicing and transaction information to:

• issue invoices;
• receive and reconcile payments;
• provide payment links;
• process refunds;
• investigate incorrect or duplicate payments;
• handle payment disputes and chargebacks; and
• maintain financial records.

Legal basis: performance of a contract; compliance with legal obligations relating to accounting and taxation; and our legitimate interest in collecting amounts due and administering payments.

We process relevant records where necessary to:

• maintain accounting records;
• comply with tax obligations;
• respond to lawful requests from authorities;
• demonstrate contractual performance;
• comply with regulatory requirements; and
• establish, exercise, or defend legal claims.

Legal basis: compliance with legal obligations and, where appropriate, our legitimate interests in protecting our legal and commercial interests.

We may process professional contact information in order to:

• maintain relationships with existing and prospective customers;
• communicate with suppliers and business partners;
• maintain records of professional contacts;
• follow up on legitimate business discussions; and
• develop our professional services.

Legal basis: our legitimate interest in conducting and developing our business and maintaining professional relationships.

We may process technical data in order to:

• operate and maintain the website;
• ensure website and information-security functions;
• prevent abuse and malicious activity;
• diagnose technical problems; and
• understand basic website performance.

Legal basis: our legitimate interest in operating and securing our website.

Where non-essential cookies or comparable technologies require consent under applicable law, such technologies will be used on the basis of consent.

Where permitted by law, we may use professional contact details to communicate about our own services where we reasonably believe the communication is relevant to the recipient.

Where consent is legally required, we will rely on consent.

Recipients may object to direct marketing at any time by contacting info@ulamneumann.com or by using any unsubscribe mechanism provided in the communication.

Legal basis: legitimate interests where permitted by law, or consent where required.

Ulam & Neumann does not normally seek to collect special categories of personal data, such as information concerning health, political opinions, religious beliefs, trade-union membership, genetic or biometric information, or information concerning a person's sex life or sexual orientation.

However, professional consultancy, compliance, research, or policy work may occasionally involve information that falls within a special category.

Where such information must be processed, we will do so only where a lawful basis and an applicable condition under Article 9 GDPR are available.

Customers should not provide special-category personal data unless it is genuinely necessary for the relevant engagement and its processing has been appropriately considered.

Our compliance or regulatory work may, in limited circumstances, involve information relating to allegations, investigations, sanctions, fraud, money laundering, or other matters that could constitute personal data relating to criminal convictions or offences.

Such information will only be processed where lawful and necessary for the relevant professional engagement.

We may disclose personal data to service providers and other recipients where reasonably necessary for the purposes described in this Privacy Policy.

Recipients may include:

• website hosting and technical-service providers;
• business email and communication providers;
• cloud-storage and productivity-service providers;
• accounting and bookkeeping providers;
• auditors;
• banks and payment service providers, including LHV Pank where applicable;
• payment-card schemes and digital-wallet providers where necessary to process payments;
• fraud-prevention and transaction-security providers;
• professional advisers, including accountants and lawyers;
• contractors or consultants involved in performing an engagement;
• competent public authorities where disclosure is required by law; and
• courts, regulators, or other parties where necessary to establish, exercise, or defend legal claims.

We require processors acting on our behalf to process personal data only in accordance with our instructions and applicable data-protection requirements.

We do not sell personal data.

Some service providers used by Ulam & Neumann may process or store personal data outside Estonia or outside the European Economic Area.

Where personal data is transferred outside the European Economic Area to a country that has not been recognised by the European Commission as providing an adequate level of protection, we will use an appropriate transfer mechanism where required.

This may include:

• European Commission adequacy decisions;
• European Commission Standard Contractual Clauses;
• another transfer mechanism permitted under Chapter V GDPR; and
• supplementary safeguards where necessary.

You may contact us at info@ulamneumann.com for further information about the safeguards applicable to a particular international transfer.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to satisfy applicable legal, accounting, contractual, and regulatory requirements.

Retention periods vary depending on the type of information and our relationship with you.

As a general rule:

Information relating to enquiries that do not result in an engagement may normally be retained for up to three years after the last substantive communication, unless there is a reason to retain it for a shorter or longer period.

Contracts, project correspondence, significant instructions, deliverables, and records relating to completed professional engagements may normally be retained for up to seven years following completion of the engagement, or longer where reasonably necessary for legal claims, professional obligations, or another lawful purpose.

Invoices, payment records, and other information required for accounting or taxation will be retained for the period required under applicable Estonian law.

Professional contact details used for marketing will be retained until the person objects, withdraws consent where consent is relied upon, or the information is otherwise no longer reasonably required.

Website logs and technical information will normally be retained only for the period necessary for security, diagnostics, or legitimate website administration.

At the end of the applicable retention period, personal data will be deleted, anonymised, or securely archived where continued retention is legally required.

We use reasonable technical and organisational measures designed to protect personal data against:

• accidental or unlawful destruction;
• loss;
• alteration;
• unauthorised disclosure;
• unauthorised access; and
• other unlawful processing.

Measures may include appropriate access controls, authentication, secure cloud services, device security, backups, contractual safeguards, and restrictions on access to personal information.

No information system can be guaranteed to be completely secure. Where a personal-data breach occurs, we will assess and address it in accordance with applicable data-protection law.

Subject to the conditions and exceptions established by applicable law, you may have the following rights.

You may request confirmation as to whether we process your personal data and obtain access to that data and information concerning its processing.

You may request correction of inaccurate personal data and completion of incomplete information.

You may request deletion of personal data where the applicable legal conditions are satisfied.

The right to erasure does not apply where continued processing is necessary, for example, for compliance with a legal obligation or for the establishment, exercise, or defence of legal claims.

You may request restriction of processing in circumstances provided by law.

Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive personal data you provided to us in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Where processing is based on our legitimate interests, you may object to that processing on grounds relating to your particular situation.

We will cease the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is required for the establishment, exercise, or defence of legal claims.

You may object to processing for direct-marketing purposes at any time. If you do so, we will stop using your personal data for that purpose.

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

You have rights under GDPR in relation to decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

Ulam & Neumann does not ordinarily make decisions about customers or website users using solely automated decision-making of this kind.

Requests concerning your personal data may be submitted to:

info@ulamneumann.com

We may request reasonable information necessary to verify your identity before responding to a request.

We will respond within the period required under applicable data-protection law. GDPR normally requires a response within one month, although the period may be extended where permitted for particularly complex or numerous requests.

There is normally no fee for exercising data-protection rights. A reasonable fee may be charged, or a request refused, where permitted by law if a request is manifestly unfounded or excessive.

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with a competent data-protection supervisory authority.

In Estonia, the supervisory authority is:

Andmekaitse Inspektsioon
Estonian Data Protection Inspectorate
Tatari 39
10134 Tallinn
Estonia

You may also contact the supervisory authority in another EU or EEA Member State where this is permitted under applicable law.

We encourage you to contact us first at info@ulamneumann.com so that we have an opportunity to address your concern directly.

Certain personal data is necessary in order for us to:

• respond to a request for services;
• prepare a quotation or contract;
• perform an engagement;
• issue an invoice;
• process payment; or
• comply with statutory accounting and tax requirements.

Where necessary information is not provided, we may be unable to enter into or perform a contract or provide the requested service.

Other information may be optional. Where this is relevant, we will make this clear.

Customers may provide Ulam & Neumann with personal data relating to their employees, customers, contractors, interviewees, stakeholders, or other individuals as part of a consultancy or research engagement.

The respective data-protection roles of Ulam & Neumann and the customer depend on the circumstances.

Where Ulam & Neumann processes personal data solely on the customer's documented instructions, the parties may enter into a data-processing agreement as required by Article 28 GDPR.

Where Ulam & Neumann independently determines the purposes and essential means of processing, it may act as a separate controller.

Customers are responsible for ensuring that personal data they provide to Ulam & Neumann has been collected and disclosed lawfully.

Our website may use cookies or comparable technologies necessary for its operation, security, or functionality.

We may also use analytics or other non-essential technologies where appropriate.

Where applicable law requires consent before a non-essential cookie or similar technology is stored or accessed on your device, we will request that consent before using the relevant technology.

You may be able to manage cookies through the controls presented on the website or through your browser settings.

The exact cookies and technologies used by the website may change as the website infrastructure is updated. Where appropriate, information about such technologies will be provided through a cookie notice or consent-management interface.

Our website may contain links to websites or services operated by third parties.

Ulam & Neumann is not responsible for the privacy practices of independent third parties. When you follow an external link or use an independent service, its own privacy policy and terms apply.

This includes independent payment providers, banks, card schemes, digital-wallet providers, professional networking platforms, and other external services.

Our services are intended primarily for businesses and professionals and are not directed at children.

We do not knowingly seek to collect personal data directly from children through the website.

If you believe that a child has provided personal data to us in circumstances where it should not have been collected, please contact info@ulamneumann.com.

We may update this Privacy Policy where necessary to reflect:

• changes to our services;
• changes to the technologies or service providers we use;
• changes to our processing activities; or
• changes to applicable legal requirements.

The current version will be published on our website and identified by the “Last updated” date above.

Material changes will not retrospectively alter the legal basis on which personal data was previously processed.

For questions, requests, or complaints concerning privacy or personal data, please contact:

Ulam & Neumann OÜ
Registry code: 16555361
VAT number: EE102589665
Sepapaja tn 6, 15551 Tallinn, Estonia

Email: info@ulamneumann.com
Telephone: +372 513 2804