Formulaires professionnels — information en français
ROYAL BALTIC&CO OÜ, registre estonien n° 17595055, Tallinn, Kesklinna linnaosa, V. Reimani tn 7a-8, 10124, Estonie, est responsable du traitement. Les coordonnées, informations sur l’entreprise et contenu de la demande servent à examiner les candidatures B2B ou fournisseurs, répondre aux demandes et gérer la relation professionnelle. Les champs marqués comme obligatoires sont nécessaires pour traiter la demande.
Le traitement repose, selon la situation, sur les mesures précontractuelles ou le contrat (article 6.1.b du RGPD), l’intérêt légitime à gérer les échanges avec les représentants professionnels (article 6.1.f) ou une obligation légale (article 6.1.c). L’envoi d’un formulaire n’inscrit pas à une newsletter. Les technologies facultatives soumises à consentement sont gérées séparément dans les paramètres des cookies.
Seuls les collaborateurs habilités et les prestataires nécessaires au service accèdent aux données. La liste des prestataires et les garanties des transferts hors Espace économique européen figurent sur la page Prestataires et DPA et ci-dessous.
La politique de conservation prévoit normalement jusqu’à 12 mois pour une candidature refusée ou incomplète, jusqu’à 3 ans après le dernier échange commercial pertinent et la durée de la relation pour un compte actif, puis normalement jusqu’à 24 mois après sa clôture. Les obligations légales et litiges peuvent justifier une durée différente. Les pièces comptables soumises à la législation estonienne sont conservées pendant la durée légale applicable, généralement 7 ans. Voir les règles détaillées ci-dessous.
Vous pouvez demander l’accès, la rectification, l’effacement, la limitation ou la portabilité de vos données, et vous opposer à certains traitements, selon les conditions du RGPD. Lorsqu’un traitement repose sur le consentement, vous pouvez le retirer à tout moment. Contact : info@royal-baltic.eu ou formulaire d’exercice des droits. Vous pouvez adresser une réclamation à la CNIL ou à l’autorité de contrôle compétente, notamment l’Andmekaitse Inspektsioon en Estonie.
1. Controller and scope
The controller for the Royal Baltic website and B2B platform is ROYAL BALTIC&CO OÜ, registry code 17595055, Tallinn, Kesklinna linnaosa, V. Reimani tn 7a-8, 10124, Estonia. Privacy enquiries and data-subject requests may be sent to info@royal-baltic.eu.
This policy applies to visitors, B2B applicants and customers, supplier contacts and other business representatives whose personal data is processed through royal-baltic.eu and the related B2B workflows.
2. Personal data we process
- business contact data such as name, role, work email and telephone number;
- company data linked to a contact, including company name, registry/VAT identifiers and business type;
- account and authentication identifiers, account status and access/security information;
- RFQs, orders, delivery information, invoices, payment status and commercial correspondence;
- technical security data such as timestamps, request metadata, device/browser information and security logs;
- privacy choices and consent receipts using a random consent identifier, without storing name, email or IP in the consent receipt;
- support, supplier and other communications voluntarily sent to Royal Baltic.
The platform is not designed to collect special categories of personal data. Please do not submit health, biometric, political, religious or similarly sensitive information unless it is strictly necessary and there is a lawful basis to do so.
3. Purposes and legal bases
| Purpose | Typical data | GDPR basis |
|---|---|---|
| B2B application, account, RFQ and order handling | contact, company, order data | Art. 6(1)(b); for representatives of corporate customers, Art. 6(1)(f) legitimate interest in conducting the business relationship |
| Invoices, accounting, tax and statutory records | company/contact, transaction and invoice data | Art. 6(1)(c) legal obligation |
| Security, fraud prevention and service integrity | authentication and technical logs | Art. 6(1)(f) legitimate interests |
| Transactional service email | email, account/order status, message content | Art. 6(1)(b), 6(1)(c) or 6(1)(f), depending on the message |
| Functional external content | data sent to the selected external provider | Art. 6(1)(a) consent where consent is required |
| Analytics | online identifiers and usage measurements | Art. 6(1)(a) consent; disabled before opt-in |
| Advertising / remarketing | online identifiers and conversion data | Art. 6(1)(a) consent; disabled before opt-in |
4. Cookies and consent
Optional functional, analytics and marketing technologies are disabled by default. Royal Baltic uses a self-hosted Klaro consent interface and a first-party consent cookie. Google advertising/analytics code is not loaded before the relevant opt-in. The detailed storage, categories and withdrawal controls are described in the Cookie Policy.
Consent can be changed or withdrawn at any time using Cookie settings in the footer. Withdrawal does not affect the lawfulness of processing already carried out before withdrawal.
5. Recipients and processors
Personal data is disclosed only where needed for the relevant service. Depending on the function used, recipients may include IONOS SE for domain registration and company email infrastructure. Royal Baltic's IONOS account confirms a Data Processing Agreement (DPA/AVV) completed on 22 September 2026; IONOS states that the DPA has been part of its Terms and Conditions since 19 July 2022. Vercel is used for hosting this rb-z-code.vercel.app application, development/preview deployments and deployment tooling; Supabase for database/authentication/storage; and other providers for transactional email, payment and optional Google services. Royal Baltic's current DeepL API Free integration is restricted by internal policy to non-personal editorial content and must not receive customer, contact, account, order, invoice or other personal data. A current operational register, provider roles and transfer safeguards is maintained on the Subprocessors page.
Royal Baltic does not sell personal data. Payment providers or Google services may act as independent controllers for specified processing under their own terms; where this applies, their own privacy information also governs that processing.
6. International transfers
This rb-z-code.vercel.app application is hosted on Vercel infrastructure; international processing may occur. Company domains and mailboxes use IONOS SE. The primary Supabase project is hosted in the EU (Ireland / eu-west-1). Other service providers or their approved subprocessors may likewise process data outside the EEA. Where GDPR Chapter V applies, Royal Baltic relies on the provider's applicable transfer mechanism, such as an adequacy decision, the EU Standard Contractual Clauses, and where applicable the EU-U.S. Data Privacy Framework, together with contractual and technical safeguards.
More detail and links to the current provider data-protection terms are available on the Subprocessors page.
7. Data retention
| Data | Royal Baltic retention rule |
|---|---|
| Accounting, invoice and transaction records | 7 years where required by Estonian accounting/tax law |
| Active B2B account/profile | for the account relationship; normally deleted or anonymised within 24 months after closure unless linked records must be retained longer |
| Rejected/incomplete B2B application | normally up to 12 months after the decision, unless a dispute, fraud or legal obligation justifies longer retention |
| Commercial/support correspondence | normally up to 3 years after the last relevant interaction; longer if part of a transaction or legal claim record |
| Consent receipts | 3 years after the latest consent change or withdrawal as an accountability record |
| GDPR/data-subject request records | 3 years after submission/resolution as an accountability and request-handling record, unless a dispute or legal obligation requires longer |
| Routine security/application logs | normally up to 90 days unless needed to investigate an incident, abuse or legal claim |
| Optional analytics/marketing data | according to the configured provider retention period and only after consent; settings are reviewed before production activation |
A shorter period is used where data is no longer necessary. A longer period may apply where required by law, an unresolved dispute, fraud/security investigation or the establishment, exercise or defence of legal claims.
8. Your GDPR rights and requests
Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction, portability and objection, and you may withdraw consent at any time. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation.
You can use the dedicated privacy request form or send a request to info@royal-baltic.eu with the subject GDPR request. Please describe the account/contact data concerned and the right you wish to exercise. Royal Baltic may request proportionate information to verify identity where necessary. Requests are handled without undue delay and normally within one month, subject to the extensions permitted by the GDPR for complex or numerous requests.
9. Complaints
You may complain to a competent data-protection supervisory authority. Royal Baltic's Estonian lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, email info@aki.ee. You may also have the right to contact the supervisory authority in the EU/EEA country where you live or work or where the alleged infringement occurred.
10. Automated decisions
Royal Baltic does not use the website to make solely automated decisions producing legal or similarly significant effects on a person. B2B verification and customer-class decisions may use system data, but final business approval is subject to human review.
11. Security and changes
Royal Baltic uses access controls, role separation, encrypted transport, database security controls and data minimisation appropriate to the service. No internet service can promise absolute security.
Material changes to the purposes or consent categories trigger a consent-version review. Where renewed consent is required, the previous optional consent is treated as invalid until the user makes a new choice.