Last updated: 15 October 2026
Who is responsible
Marselling OÜ (registration no. 16967810), Tallinn, Estonia, operates Legatia.eu and is responsible for the personal data described in this notice.
For privacy questions or requests, contact info@legatia.eu.
Contact enquiries
If you use the contact form, we receive your name, email address, country, the service you select, and your message. Company name is optional. If you ask about GPSR support, the form also asks what you sell and, optionally, where you sell it, roughly how many products you have, whether you already have an EU Responsible Person and when you would like to sell in the EU. The form also asks you to confirm that you have read this notice. We use these details to respond to your enquiry and, where relevant, prepare a requested service proposal. If you have allowed analytics, the enquiry record also includes how you found the website: the type of source, the domain of an external referring website, campaign tags in the link you followed and the first page you visited. We use this to understand which channels bring enquiries.
Where you ask about a possible service or proposal, we process the information to take steps at your request before entering into a contract. For other business enquiries, we rely on our legitimate interest in responding and keeping a proportionate record of the correspondence.
We store enquiries in a private admin dashboard and deliver a copy to our business email account. If no client relationship begins, the dashboard copy is automatically deleted after 12 months. The email notification is also subject to the storage and deletion settings of the info@legatia.eu mailbox; deleting the dashboard record does not delete the mailbox copy. If you become a client, relevant records are handled separately and kept for the period required for the service, contractual and legal purposes. We may keep a limited record for longer where necessary to establish, exercise or defend legal claims.
Website statistics
When you open a page, our server adds one to daily totals that show how the website is used: the date, the page, whether you arrived from outside the site, the type of source (for example direct, search engine, social network, another website or a campaign link), the domain of the referring website, campaign tags in the link you followed (utm_source, utm_medium, utm_campaign), whether the page was not found, the device type (desktop, mobile or tablet) and an approximate country.
These details are taken from the request your browser sends to load the page and are used only at that moment to increase the totals. The device type is derived from your browser's user agent and the country from Hostinger's server GeoIP service; neither your IP address nor your user agent is stored, nothing is stored on or read from your device for this purpose, and the totals cannot be used to identify you or follow your visit. Other query string values are not recorded. Automated traffic such as search engine crawlers is not counted. We do this on the basis of our legitimate interest in understanding how the website is used and which channels bring visitors (GDPR Article 6(1)(f)). Daily totals are kept for 12 months and then deleted.
Hostinger manages the GeoIP database and updates it weekly. The country estimate may be inaccurate or unavailable, for example because of a VPN or mobile network routing. A standard website request reaches our hosting provider, which may process connection data such as an IP address to deliver and protect the site.
Google Analytics (only with your consent)
If you choose “Allow analytics”, we also use Google Analytics 4, a web analytics service provided by Google Ireland Limited, to understand how the website is used: for example which pages are viewed, how long visits last, how visitors found the site, the device and browser type, and the approximate country and city. Google Analytics sets cookies in your browser to recognise repeat visits. Google Analytics does not log or store IP addresses of visitors from the EU, Switzerland or the UK: Google uses the IP address only to estimate the location and then discards it. We have turned off Google signals and advertising features, and we do not use Google Analytics data for advertising. Google Analytics data is kept for 14 months.
We use Google Analytics on the basis of your consent (GDPR Article 6(1)(a)). Google may process the data in the United States; Google LLC is certified under the EU–US Data Privacy Framework. If you choose “Necessary only” or withdraw your choice using “Cookie settings”, Google Analytics is not loaded and its cookies are removed. Visits from browsers that have not allowed analytics are counted only in our own daily totals described above. More information: How Google uses information from sites that use its services.
Cookies and optional enquiry source
We use analytics cookies only if you choose “Allow analytics”. We use browser local storage to remember your privacy choice. If you choose “Allow analytics”, Google Analytics sets the cookies listed below, and your browser also keeps a note of how you arrived on the site in session storage for the current tab: the type of source, the domain of an external referring website, campaign tags in the link you followed and the first page you visited. If you send an enquiry, this note is sent with it so that we know which channel it came from. The note is deleted when you close the tab or withdraw your choice. You can change your choice at any time using “Cookie settings” in the footer. Your choice is stored in this browser for six months; if you clear browser storage or the choice expires, we will ask again.
| Storage | Purpose | Provider and duration |
|---|---|---|
legatia_consent_v7 (local storage) | Remembers your privacy choice. It is not an analytics cookie. | Legatia.eu; six months. |
legatia_attribution (session storage, only if you allow analytics) | Remembers how you arrived on the site in this browser tab (source type, referring website domain, campaign tags and first page), so that an enquiry you send can be linked to its source. | Legatia.eu; until you close the tab. |
_ga (cookie, only if you allow analytics) | Google Analytics: distinguishes visitors so that repeat visits can be recognised. | Google; six months. |
_ga_H38FVFSGV6 (cookie, only if you allow analytics) | Google Analytics: keeps track of the current visit (session). | Google; six months. |
You can manage or delete cookies, local storage and session storage in your browser settings.
Businesses we contact
We sometimes write to businesses that may benefit from our services, for example brands that have paused sales to the EU or ship operators affected by FuelEU Maritime. We only contact businesses, using a business email address or contact form that the business has published itself. We send individual emails, not bulk campaigns, and each email says how we found your details and how to opt out.
- What we process: your name and role where published, your business email address or contact form, your company's name, website and location, the products or fleet it publicly describes, and notes on our correspondence, such as when we wrote, whether you replied and whether you asked us not to contact you again.
- Where the details come from: your company's own website or shop page, business registers such as Companies House, trade fair exhibitor lists, marketplace shop pages and other public business directories.
- Purpose and legal basis: to offer services relevant to your business. We rely on our legitimate interest in contacting businesses about relevant services (GDPR Article 6(1)(f)).
- Your right to object: you can ask us to stop at any time by replying to our email or writing to margus@legatia.eu. We stop without undue delay and in any case within 10 business days, and keep only your email address or company name on a do-not-contact list so that we do not write to you again.
- How long we keep it: if you do not reply or show interest, we delete your details 12 months after our last message. If you become a client, the client records described above apply.
- Who else processes it: our emails are sent through Hostinger's email service, and we prepare our research and messages with software tools, including an AI assistant service. These providers process the details only to provide their service to us. We do not sell or share your details with anyone else.
Admin area security
To limit repeated failed attempts to sign in to the private admin area, we create a keyed, one-way fingerprint from the connection IP address after a failed sign-in. The raw IP address is not saved in the admin database, and these security fingerprints are deleted after one day.
Service providers
The website, private enquiry dashboard and website statistics are hosted on Hostinger infrastructure. Enquiry notifications and our business emails are sent through Hostinger's email service. If you allow analytics, Google Analytics is provided by Google Ireland Limited. We use software tools, including an AI assistant service, to research and prepare our business correspondence. These providers may process information as needed to provide and protect their services under their applicable terms and privacy documentation.
Your rights
Subject to applicable law, you can ask us for access to your personal data, correction or deletion, or restriction of processing. You may object to processing based on legitimate interests.
Contact info@legatia.eu to make a request. You may also lodge a complaint with the Estonian Data Protection Inspectorate.
Changes to this notice
We may update this notice if our data processing changes. The current version and its update date will be published on this page.