Privacy policy
Last updated: 2 November 2026
Who is responsible (controller)
This policy explains how we process personal data on the website cway.ee under the General Data Protection Regulation (GDPR) and Estonian law.
The controller is SIA Conway Container Solutions Eesti filiaal (registry code 16718113, VAT EE102609244), Narva mnt 7-636, 10117 Tallinn, Estonia. It is the Estonian branch of Conway Container Solutions SIA (Latvia, registry no. 40203131241).
For privacy questions and requests write to sales@cway.ee or call +372 505 46 14. We have not appointed a data protection officer.
What we process, why, and on what legal basis
The table shows every purpose for which we use personal data on this website.
| Purpose | Data | Legal basis | Kept for |
|---|---|---|---|
| Answering enquiries and quote requests (forms, e-mail, phone, WhatsApp) | name, phone, e-mail, company, registration number, delivery address, message, page and language | your request to take steps before a contract (GDPR Art. 6(1)(b)); for contact persons of companies, our legitimate interest in business communication (Art. 6(1)(f)) | 24 months after our last contact. If we make a contract: as long as the law requires (for example accounting documents 7 years). |
| AI chat assistant | chat messages (and name, phone or e-mail if you give them so that we can contact you) | Art. 6(1)(b) and (f) | We do not keep the conversation. Our AI provider normally deletes messages within 30 days. Contact details you give are treated like an enquiry (first row). |
| Security and running of the website | IP address, browser data, time and address of requests (server logs), abuse limits, a hidden spam-trap field | our legitimate interest in security and stable operation (Art. 6(1)(f)) | Technical logs: up to 30 days at our hosting provider. Request counters: only in memory, a few minutes. |
| Proof of your cookie choice | random choice number, date, version, your choices (no IP address, no browser data) | legal obligation to be able to show consent (GDPR Art. 7(1); Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) | 24 months (the choice itself stays in your browser for 12 months) |
| Statistics (Google Analytics) | cookie identifiers, pages visited, device and browser data, approximate location, referring page | your consent (Art. 6(1)(a)) - only if you switch on “Statistics” | Cookies up to 2 years. Google keeps event data for a limited period set by us (at most 14 months). |
| Visit analysis (Microsoft Clarity) | random visitor and visit numbers (cookies), pages visited, mouse movements, clicks, scrolling, device and browser data, approximate location from the IP address; text typed into form fields is not recorded | your consent (Art. 6(1)(a)) - only if you switch on “Statistics” | Cookies up to 1 year. Clarity keeps visit recordings for 30 days (marked or randomly selected recordings up to 9 months) and heatmaps for up to 9 months. |
| Error reports (Conway’s own system) | a short anonymous report of a technical error: error text, page address without parameters, device type; no cookies, personal identifiers or text typed into forms are sent | your consent (Art. 6(1)(a)) - only if you switch on “Statistics” | Up to 30 days. |
| Advertising measurement (Google Ads, Meta Pixel), including the ad-click record | cookie identifiers, pages visited, ad click number (gclid), campaign tags, first page, time, actions on the site; when you send an enquiry, your hashed e-mail and phone to Google Ads | your consent (Art. 6(1)(a)) - only if you switch on “Advertising” | Cookies 90 days to 13 months; our ad-click record 90 days. Google and Meta keep data under their own rules. |
| E-mail offers and news (SendPulse) | name, e-mail, phone | your consent (Art. 6(1)(a)) - only if you tick the box on the form | until you unsubscribe; addresses with no activity for 24 months are deleted |
| Contracts and accounting (only if you become a customer) | contract, invoice and delivery data | contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)) | as long as the law requires (accounting documents 7 years) |
Where the data comes from
From you. If you contact us for a company, we may also receive your details from that company. We do not buy personal data.
Cookies and similar technologies
Until you choose, we set no statistics or advertising cookies and we load no Google, Microsoft or Meta tools. Necessary items are used without consent because the site cannot work without them. The full list is in the cookie notice:
You can change or withdraw your choice at any time with the “Cookie settings” button at the bottom of every page. Your choice is valid for 12 months.
Who receives your data
- Railway Corp. (USA): hosting of the website and its database. The servers are in the EU (Amsterdam).
- Microsoft (Microsoft 365, Outlook): e-mail; enquiries are sent to our staff by e-mail.
- Our customer relationship management (CRM) system: where enquiries and offers are managed.
- Anthropic PBC (USA): the AI chat; it processes your chat messages to write answers. Anthropic keeps them for a limited time (normally up to 30 days) and does not use them to train its models.
- SendPulse Inc. (USA, EU data centres): e-mail service - only if you tick the offers box.
- OpenFreeMap (map server): the pictures of the delivery price map - only when you press “Show the map”, or at once if you chose “Accept all” in the cookie banner. When the map loads, the server learns your IP address and browser type; we send nothing else to it.
- Google (Google Ireland Limited, Ireland; Google LLC, USA): Analytics and Ads - only with your consent.
- Microsoft (Microsoft Ireland Operations Limited, Ireland; Microsoft Corporation, USA): Microsoft Clarity (heatmaps and visit recordings) - only with your consent. Microsoft says it acts as a data controller for Clarity data; Microsoft is responsible for what it does with the data (see Microsoft's privacy statement).
- Meta (Meta Platforms Ireland Limited, Ireland; Meta Platforms, Inc., USA): Meta Pixel - only with your consent. For the pixel, we and Meta are joint controllers for collecting the data and sending it to Meta. Meta is responsible for what it does with the data afterwards (see Meta's privacy information).
- Service providers who maintain the website and give IT support, under confidentiality and data processing agreements.
- Public authorities, if the law requires it.
We do not sell personal data.
Links to other sites and WhatsApp
Our pages link to Facebook, Instagram, LinkedIn, TikTok, YouTube and Google Maps. Nothing is sent to them until you click a link; after that their own privacy policies apply. If you contact us through WhatsApp, the WhatsApp service (Meta) is used under its own terms and privacy policy.
Transfers outside the EU and EEA
Some recipients are in the USA (Railway, Anthropic, SendPulse, Google, Meta, Microsoft). Where the recipient takes part in the EU–US Data Privacy Framework, we rely on the European Commission's adequacy decision of 10 July 2023; otherwise we rely on the EU Standard Contractual Clauses (Commission Decision 2021/914) and additional safeguards. You can get a copy of the safeguards by writing to sales@cway.ee.
How long we keep data
Enquiries (forms, e-mail, contacts given in the chat) are kept in our CRM, in staff mailboxes and in our website database for 24 months after our last contact with you, unless we make a contract with you. Other periods are in the table above. When a period ends we delete the data.
Your rights
- to access your data (GDPR Art. 15);
- to have it corrected (Art. 16);
- to have it erased (Art. 17);
- to restrict the processing (Art. 18);
- to receive your data in a portable form (Art. 20), where we process it by automated means on the basis of consent or contract;
- to object (Art. 21), in particular to processing based on legitimate interest;
- to withdraw your consent at any time (the “Cookie settings” button; the unsubscribe link in e-mails). Withdrawal does not affect earlier processing.
We do not take decisions about you based only on automated processing. The AI assistant gives general information only.
Send your request to sales@cway.ee. We answer within one month (Art. 12(3)). We may ask you to prove your identity.
Complaints
If you think we process your data unlawfully, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, https://www.aki.ee, or to the data protection authority of the country where you live or work.
Providing data and children
You do not have to give us your data, but without contact details we cannot answer your request. The website is meant for business customers, not for children.
Changes to this policy
We update this policy when our processing changes. The date at the top shows the last update.