Privacy Policy
Effective date: 15 September 2026. Last reviewed: 15 September 2026.
This policy explains how Liliakona OÜ, trading as Arcada Info ("Arcada Info", "we", "us"), handles personal data. It covers three different situations, and it is worth knowing which one applies to you:
- You received a message we sent for a client brand. In that case the brand is the data controller and we act as its processor. Sections 3 to 9 explain what that means for you, and you can exercise your rights with either party.
- You are visiting this website or contacting us directly. In that case we are the controller of the data you give us. Sections 10 and 11 apply.
- You subscribed to our newsletter on this website. In that case we are the controller as well, and section 12 sets out exactly what we record and why.
1. Who we are
| Legal entity | Liliakona OÜ |
|---|---|
| Registration number | 17368980 |
| Registered address | Rotermanni tn 6, Tallinn, 10111, Estonia |
| Privacy contact | privacy@arcada-info.com |
| Telephone | +372 5812 349 |
2. What we do
Arcada Info is a communications service provider. Brands hire us to plan, build and deliver their customer communications, including service notifications, newsletters, product news and promotional campaigns, over email, SMS and push. We do not sell products to consumers, apart from the opt-in newsletter described in section 12 we do not build our own marketing databases, and we do not sell, rent or share personal data with third parties for their own marketing.
3. Where the data comes from
We receive contact records from our clients. A client transfers records that it collected itself, from people who registered an account with it or subscribed through a form it operates, and it does so under a written data processing agreement that names the purpose of the processing.
We do not obtain personal data by scraping websites or social networks, we do not purchase, rent or exchange contact lists, we do not use appended or co-registered data, and we do not accept lists from public data vendors. If a client cannot document where a list came from and when consent was given, we do not load it.
4. Categories of personal data we process
| Category | Examples |
|---|---|
| Contact identifiers | Email address, mobile number, push token, first and last name where the client holds it |
| Account attributes shared by the client | Registration date, language, country, communication preferences, consent record and its timestamp and source |
| Message and engagement events | Sent, delivered, bounced, opened, clicked, unsubscribed, marked as spam, with time stamps |
| Technical data attached to those events | Mail client or device family, approximate location derived from IP at the level of country, IP address in delivery logs |
| Suppression data | The addresses and numbers that must never be contacted again, held as a hashed or plain identifier depending on the channel |
We do not ask clients for, and do not want, special category data such as health, political opinions, religious beliefs or biometric data.
5. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Sending service and transactional messages relating to an account the person holds with our client | Performance of a contract between the person and our client, or the client's legitimate interest in servicing its own customers |
| Sending newsletters, product news and promotional campaigns | The consent the person gave to our client, or in some jurisdictions the soft opt-in for an existing customer, in both cases recorded and revocable at any time |
| Measuring delivery and engagement, and reporting to the client | Legitimate interest in operating a functioning and non-abusive sending programme |
| Maintaining suppression lists | Legal obligation to honour opt-outs, and legitimate interest in never contacting a person who asked us to stop |
| Security, fraud prevention, abuse investigation and record keeping | Legal obligation and legitimate interest |
Where processing rests on consent, withdrawing it is free and takes effect for the future. Withdrawal does not make earlier processing unlawful.
6. Our role: processor, not controller
For client campaigns we process personal data only on the documented instructions of the client that provided it. We do not decide the purpose of a campaign, we do not use the data for our own marketing, we do not combine one client's data with another's, and we do not keep a copy after the engagement ends, except for suppression records as described in section 8.
7. Who we share data with
We share personal data only with the following categories of recipient, and only to the extent needed:
- The client brand whose customers they are, including aggregated and per-recipient campaign results.
- Sending platforms and telecom aggregators that physically deliver email, SMS and push messages.
- Infrastructure providers for hosting, storage and backup.
- Professional advisers, auditors and authorities where we are legally required to disclose.
Every processor we use is bound by a written contract with confidentiality and data protection terms at least equivalent to ours. The current subprocessor list is available on request from privacy@arcada-info.com. We never sell personal data and never disclose it for the marketing purposes of another company.
8. Retention
- Campaign contact records are retained for the term of the client agreement and are deleted or returned within 30 days of its end.
- Delivery and engagement logs are retained for up to 24 months, then deleted or aggregated so that they no longer identify a person.
- Suppression records are retained indefinitely. This is deliberate: an opt-out is only reliable if the identifier survives every future import.
- Abuse reports and the correspondence around them are retained for 24 months as evidence of how the complaint was handled.
9. Your rights
Depending on where you live, you may have the right to access the data we hold about you, to have it corrected, to have it erased, to restrict or object to processing, to receive it in a portable format, to withdraw consent, and to opt out of the sale or sharing of personal information, which in our case never takes place.
To exercise any of these, write to privacy@arcada-info.com from the address concerned, or include the email address or phone number that received the message so we can locate the record. We reply within 30 days. Where the request relates to a client's customer records we forward it to that client without delay and support them in answering it. We do not charge for this and we do not require you to create an account.
If you are not satisfied with the outcome, you may lodge a complaint with the data protection authority in your country of residence.
10. This website
This site does not run advertising trackers or third party analytics, and it does not embed social media widgets. The contact form does not transmit anything to us: it opens your own mail application with the message prepared, so the content reaches us as an ordinary email, and nothing is stored on the site. The newsletter sign-up form is the only part of this site that sends data to our server; it is covered in section 12.
Our hosting provider keeps standard server logs, including IP address, user agent, requested URL and time stamp, for security and troubleshooting. These are retained for a short period and are not used to profile visitors.
Cookies
This website sets no advertising, analytics or profiling cookies. Any cookie present is strictly necessary for the site to be served, and no consent banner is required for those under the ePrivacy rules. If this changes, we will publish a cookie notice and ask for consent before setting anything non-essential.
11. Business contacts
If you contact us as a prospective client, partner or supplier, we process your name, company, contact details and the content of your message on the basis of our legitimate interest in responding and in managing the relationship. We keep this correspondence for up to 24 months after the last exchange.
12. Newsletter subscribers
If you subscribe to our newsletter on this website, Liliakona OÜ is the controller of your data.
| What we record | Your email address; the date and time of your consent in UTC; the exact wording and version of the consent text you agreed to; the IP address and browser user agent of the sign-up request; and the page the form was sent from. |
|---|---|
| Why | To send you the newsletter you asked for, and to be able to demonstrate that you consented. |
| Legal basis | Your consent under Article 6(1)(a) GDPR for sending the newsletter, and our obligation under Article 7(1) GDPR to demonstrate that consent for keeping the sign-up record. |
| Checks we run | We check that the address is correctly formed and that its mail domain exists, and we filter out automated sign-ups. We do not enrich the address with data from any other source. |
| Where it is kept | On our own server, in a location that is not part of the public website and is accessible only to authorised staff. It is never published, sold, or shared for anyone else's marketing. |
| How long | For as long as you stay subscribed. When you unsubscribe, the address is removed from the mailing list and kept only on our suppression list, with the times of consent and of withdrawal, so that it is never added again by mistake. |
| How to leave | Use the unsubscribe link in any newsletter, or write to unsubscribe@arcada-info.com. Withdrawal takes effect within 24 hours and costs nothing. |
13. International transfers
Our providers may process data outside the country where it was collected. Where personal data covered by the GDPR is transferred outside the European Economic Area or the United Kingdom, we rely on an adequacy decision where one exists, and otherwise on the Standard Contractual Clauses together with a transfer risk assessment. A copy of the safeguards used for a given transfer is available on request.
14. Security
We protect personal data with encryption in transit and at rest, access control limited to named staff on a need to know basis, multi-factor authentication on administrative systems, logging of exports and administrative actions, separate environments for each client program, and periodic review of access rights. We notify the affected client without undue delay, and in any case within 24 hours of becoming aware, if a personal data breach affects their data.
15. Children
Our services are not directed at children. We do not knowingly process data of anyone below the legal age applicable to the client's product or below 16, whichever is higher, and we require clients to exclude such records before transfer. If you believe we hold data about a minor, contact us and we will delete it.
16. Changes to this policy
We update this policy when our practices or the law change. The effective date at the top always shows the current version, and material changes are communicated to clients in advance.
17. Contact
Liliakona OÜ
Rotermanni tn 6, Tallinn, 10111, Estonia
privacy@arcada-info.com
+372 5812 349