Privacy Policy

1. Who we are

Confi Food OÜ (“we”, “us”, “our”) runs confifood.com. We are the controller of the personal data described on this page. This policy explains what we collect, why, how long we keep it and what your rights are.

2. Cookies and tracking

This site sets no cookies of its own and runs no analytics, advertising or social media tracking. Fonts, images and scripts are served from confifood.com, so opening a page sends nothing to a third party. That is why you see no cookie banner here.

One thing is saved in your browser: if you change the text size on a course page, that choice is kept in your browser’s local storage so the next page opens at the same size. It holds no personal data and never leaves your device. Clearing your browser data removes it.

When you pay, you are taken to Stripe’s checkout page. Stripe uses its own cookies there under its own privacy policy.

3. What we collect and why

Reading the free course. Nothing. The free HACCP Food Handler course needs no account, no email and no sign up.

Contact, partner and quote forms. The name, email address, company and message you type. We use them to reply and, if you ask, to prepare a quote or proposal. Legal basis: steps taken at your request before a contract, and our legitimate interest in answering enquiries.

Buying a certificate or a course. Your name, email address, billing details and payment confirmation come to us from Stripe. Card numbers are entered on Stripe’s page and never reach our systems. If a company buys certificate seats for a team, it gives us one email address per learner so we can send each person their exam links. Legal basis: performing the contract, and our legal duty to keep accounting records.

Sitting the exams. The email address you paid with, your answers, your score and whether you passed. We use them to grade the exam, tell you the result and issue your certificate. Legal basis: performing the contract.

Your certificate. Your name, the certificate ID, the course and the issue and expiry dates. These are passed to TrustBite, the independent recognising body, which lists the certificate in its public registry so that employers and inspectors can verify it. Legal basis: performing the contract, since a verifiable certificate is what you bought.

Consulting and managed services. The business contact details and the documents a client shares with our team during an engagement. These are covered by the service contract.

Technical logs. Our hosting provider keeps short-lived server logs, including IP addresses, to keep the site secure and running. Legal basis: legitimate interest in security.

4. Who we share data with

We share personal data only with the providers we need to run the service, each under a data processing agreement:

• Stripe processes payments and holds the order record.
• Resend delivers our transactional emails, such as exam links, results and enquiry confirmations.
• Vercel hosts the website and the code that grades exams.
• Google Workspace holds our business email.
• TrustBite receives certificate holder names and certificate IDs for its public verification registry.

Some of these providers operate outside the European Economic Area. Where data leaves the EEA it is covered by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. We may also disclose data when the law requires it, for example to the tax authority.

5. How long we keep it

• Order and invoice records: 7 years, as Estonian accounting law requires.
• Exam links and access: 30 days from purchase, after which the links stop working.
• Exam results and certificate records: for the 3-year validity of the certificate plus 2 years, so we can answer verification requests and renewals.
• Enquiries that do not lead to work: 1 year after our last exchange.
• Client project files: for the length of the engagement plus 3 years, unless the contract says otherwise.
• Server logs: a short period, set by the hosting provider.

6. Security

The site is served over HTTPS only. Payment details are handled by Stripe, a PCI DSS Level 1 provider. Exam links are signed so they cannot be altered, and they expire. Access to our email and provider accounts is limited to our team.

7. Your rights

Under the GDPR you can ask us to:

• tell you what personal data we hold about you and give you a copy
• correct data that is wrong or incomplete
• delete your data, where we have no legal duty to keep it
• restrict or object to how we use it
• give you your data in a portable format

Write to lets_talk@confifood.com and we will answer within one month. If you think we have handled your data badly, you can complain to the Estonian Data Protection Inspectorate at www.aki.ee, or to the supervisory authority in your own country.

Note that a certificate listed in the TrustBite registry can be removed from the registry on request, but the certificate then stops being verifiable.

8. Children

Our courses and services are for people aged 18 and over, or younger learners enrolled by their employer or school. We do not knowingly collect data from children outside that setting. If you believe a child has sent us personal data, contact us and we will delete it.

9. Changes to this policy

If we change how we handle personal data, we update this page and the date at the top. Material changes to how we treat existing customers are announced by email.

10. Contact

For privacy questions or data requests: