Privacy Policy
Effective date: 1 July 2026 | Last updated: 1 July 2026
This Privacy Policy explains how Hantasy OÜ (“we”, “us”, “our”, the “controller”) collects, uses, discloses and protects your personal data when you visit https://basnira.com (the “Website”) and purchase or use the Singularity Protocol: composed audio-visual works delivered to you through a unique access link (“SkyMark”). We are committed to processing your personal data lawfully, fairly and transparently in accordance with the EU General Data Protection Regulation 2016/679 (“GDPR”) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).
In case of any discrepancy between language versions of this policy, the English version governs.
1. Who We Are (Data Controller)
The controller responsible for your personal data is:
| Legal name | Hantasy OÜ |
|---|---|
| Registry code | 17329558 |
| Registered address | Sakala tn 7-2, 10141 Tallinn, Estonia |
| Website | https://basnira.com |
| Privacy contact e-mail | info@basnira.com |
| Data Protection Officer | Not appointed. A DPO is not mandatory given the nature and scale of our processing. Privacy enquiries are handled at the contact e-mail above. |
2. What This Service Is
basnira offers the Singularity Protocol: composed audio-visual works. When you make a purchase, we deliver the work you have acquired via a SkyMark: a unique access link and identifier that we send to you by e-mail. There is no scheduled appointment, no time-slot booking, and no separate application to install.
The Singularity Protocol is a creative, media product. It is not a medical, therapeutic, diagnostic or health service. We do not collect, request or process any health data or other special categories of personal data (GDPR Article 9).
3. Personal Data We Process
3.1 Account and contact data
- Name;
- E-mail address;
- Password: stored only as a secure, one-way hash (we never store your password in readable form);
- Billing address;
- Telephone number (only if you choose to provide it).
3.2 Order and payment data
- Order ID, the product purchased, date of purchase, amount and currency;
- Payment method and the transaction ID provided by our payment provider.
Your full card number, security code (CVC) and expiry date are never seen or stored by us. Card payments are handled directly by our payment provider in a PCI-DSS-compliant environment.
3.3 Access and delivery data
- The SkyMark (the unique access identifier and link) issued for your order;
- Access and usage records tied to the order (for example, which work was opened and the associated timestamps), used to deliver your purchase and prevent misuse.
3.4 Newsletter / lead-capture data
- The e-mail address you submit to receive our “Singularity Insights” series. This is based on your consent, and you can unsubscribe at any time with a single click.
3.5 Technical data
- IP address;
- Browser and device information (user agent);
- Pages viewed and the associated timestamps.
3.6 Cookies
See Section 11 (Cookies) for details of the cookies we use.
4. Why We Process Your Data and Our Legal Bases
We only process your personal data where we have a valid legal basis under Article 6 of the GDPR. We do not carry out any processing of special-category data under Article 9.
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating and managing your account; processing your orders; delivering the purchased work via SkyMark | Account & contact, order & payment, access & delivery | Performance of a contract, Art. 6(1)(b) |
| Issuing invoices; keeping accounting and tax records | Order & payment, contact/billing | Compliance with a legal obligation, Art. 6(1)(c) |
| Sending the “Singularity Insights” newsletter / lead-capture series | Newsletter e-mail address | Consent, Art. 6(1)(a) |
| Security of the Website and accounts, fraud prevention, and anonymous statistics | Technical data, access & delivery records | Legitimate interests, Art. 6(1)(f) |
| Establishing, exercising or defending legal claims | Relevant data as required | Legitimate interests, Art. 6(1)(f) |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to such processing as described in Section 9 (Your Rights). Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
5. Who We Share Your Data With (Recipients and Sub-Processors)
We do not sell your personal data. We share it only with the carefully selected service providers and recipients listed below, and only to the extent necessary. Each processor acts under a data-processing agreement in accordance with GDPR Article 28, or, where applicable, as an independent controller.
| Recipient | Purpose | Location |
|---|---|---|
| Websupport s.r.o. Karadžičova 7608/12, 821 08 Bratislava, Slovakia |
Website hosting and transactional e-mail | EU |
| Stripe Payments Europe, Ltd. Dublin, Ireland |
Card payment processing | EU / USA, with GDPR safeguards (EU-US Data Privacy Framework and/or Standard Contractual Clauses) |
| Embedded-media providers (e.g. Google / YouTube) | Only where the Website embeds their media | EU / USA, with GDPR safeguards |
| Accounting service provider (Estonia) | Bookkeeping and statutory accounting | EU (Estonia) |
| Public authorities and courts | Only where disclosure is legally required | EU (Estonia) |
6. International Transfers
Some of our providers (for example, Stripe and Google) may process personal data in the United States. Where personal data is transferred outside the European Economic Area, we ensure that the transfer takes place only under the safeguards required by Chapter V of the GDPR, namely:
- certification under the EU-US Data Privacy Framework; and/or
- the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914);
together with additional technical and organisational measures such as encryption and access controls. You may request a copy of the relevant Standard Contractual Clauses by writing to info@basnira.com.
7. How Long We Keep Your Data (Retention)
We retain personal data only for as long as necessary for the purposes described above, and then delete or anonymise it. Our standard retention periods are:
| Data category | Retention period |
|---|---|
| Account data | Duration of account activity + 1 year, or until you delete your account |
| Order and invoicing / accounting data | 7 years (as required by the Estonian Accounting Act) |
| Access and usage logs | 1 year |
| Web-server logs (IP address, user agent) | 90 days |
| Newsletter consent | Until you withdraw your consent |
| Complaint records | 3 years after the complaint is closed |
8. Security
We apply appropriate technical and organisational measures to protect your personal data, including:
- HTTPS/TLS encryption across the entire Website;
- passwords stored only as secure hashes;
- access limited to staff who genuinely need it;
- regular security updates;
- encrypted backups.
In the event of a personal data breach, we will notify the supervisory authority within 72 hours where required, and will inform affected users where the breach is likely to result in a high risk to their rights and freedoms.
9. Your Rights
Subject to the conditions and exceptions in the GDPR (Articles 12–22), you have the following rights in relation to your personal data:
- Access: to obtain confirmation of whether we process your data and a copy of it;
- Rectification: to have inaccurate or incomplete data corrected;
- Erasure: to have your data deleted (“right to be forgotten”), where applicable;
- Restriction: to restrict our processing in certain circumstances;
- Data portability: to receive certain data in a structured, commonly used, machine-readable format;
- Objection: to object to processing based on our legitimate interests;
- Withdrawal of consent: to withdraw consent at any time (effective going forward);
- Automated decision-making: rights in relation to automated decisions, as described in Section 13.
To exercise any of these rights, please e-mail info@basnira.com. We will respond within one month; in complex cases this period may be extended by up to two further months, and we will inform you if that is necessary. Exercising your rights is free of charge, except where a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act.
10. Supervisory Authority and Complaints
If you believe that our processing of your personal data infringes data-protection law, you have the right to lodge a complaint with the Estonian supervisory authority:
| Authority | Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon (AKI) |
|---|---|
| Address | Tatari 39, 10134 Tallinn, Estonia |
| info@aki.ee | |
| Website | www.aki.ee |
You may also lodge a complaint with the data-protection authority in your EU country of residence, and you have the right to an effective judicial remedy.
11. Cookies
We use cookies and similar technologies to operate the Website and to improve your experience. Strictly necessary cookies, those required to run the Website, your session and the checkout, are used without consent, as they are essential to providing the service you request. Any statistics or marketing cookies are set only after you give consent through our cookie banner, and you can change your choice at any time.
| Cookie / provider | Purpose | Category |
|---|---|---|
| WordPress | Maintains your site session | Strictly necessary |
| WooCommerce | Manages your shopping cart and checkout | Strictly necessary |
Stripe (__stripe_mid, __stripe_sid) |
Fraud prevention during payment | Strictly necessary |
| Embedded-media cookies (if present) | Set by embedded-media providers only where their media is displayed | Consent-based |
12. Children
Our service is intended for adults (18+). We do not knowingly collect personal data from children under the age of 16. If we become aware that we have collected such data, we will delete it without undue delay.
13. Automated Decision-Making
We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or that similarly significantly affects you within the meaning of Article 22 of the GDPR.
14. Changes to This Policy
We may update this Privacy Policy from time to time, with prospective effect. Where changes are material, we will announce them on the Website and, for registered users, by e-mail at least 15 days before they take effect. The “Last updated” date at the top of this policy will always reflect the current version.
15. Contact
If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us at info@basnira.com, or write to Hantasy OÜ, Sakala tn 7-2, 10141 Tallinn, Estonia.