GDPR Privacy Rights

Scope

Effective 8 November 2026. This page supplements Adhit Media OÜ's Privacy Policy for processing for which Adhit is responsible. It explains GDPR rights where that law applies. It is not a certification of every advertising integration or of the independent processing of advertisers, publishers or other partners.

Adhit may determine its own purposes as a controller or act solely on a customer's instructions as a processor. Roles depend on the actual processing. Adhit's responsibilities for its own disclosures and instructed processors cannot be excluded by calling another organisation a partner. Privacy contact: info@adhit.com; Vesivärava tn 50, 10152 Tallinn, Estonia.

Legal bases and transparency

The Privacy Policy explains the purposes of corporate communications, service administration, billing, security and optional website statistics. The applicable basis may be consent, necessary steps for an individual's contract, a legal obligation or a properly assessed legitimate interest. Listing these bases does not mean that each can be used for every purpose.

Consent for optional corporate statistics can be changed through Statistics settings in the footer. Advertising tracking is a separate activity and must meet the disclosure, lawful-basis and cookie-consent requirements that apply to its actual use. Corporate statistics controls do not establish network-wide consent propagation.

Information at collection must describe relevant purposes, lawful grounds, recipients, retention periods or meaningful retention criteria, and any applicable transfer safeguards. Where data come from another source, Article 14 may require additional information. Online and pseudonymous identifiers can remain personal data.

Your rights

Where the legal conditions apply, you may request access to personal data and relevant processing information, rectification, erasure, restriction and portability. Erasure is subject to exceptions, including applicable legal obligations and legal claims.

You may object to processing based on legitimate interests on grounds relating to your situation. Objection to direct marketing, including related profiling, is not subject to a further balancing test. Consent may be withdrawn at any time without affecting earlier lawful processing.

Where Article 22 applies to a solely automated decision producing legal or similarly significant effects, the applicable safeguards and exceptions must be assessed. Ordinary automated ad selection is not automatically such a decision. Contact us about the processing relevant to your request rather than assuming that all partner systems operate in the same way.

Requests and response periods

Send requests to info@adhit.com, identifying the relevant service and right. Adhit may request proportionate information needed to verify identity or locate records. Do not send passwords or unsolicited identity documents. An authorised representative may need to demonstrate authority.

Article 12 normally requires a response within one month. An extension of up to two further months is permitted where justified by complexity or the number of requests, with reasons and notice within the first month. Requests are generally free, subject to the conditions for manifestly unfounded or excessive requests. Refusals must explain the relevant reason and available remedies.

For information independently controlled by a partner, contact that partner. This does not prevent a request about Adhit's own processing. Where Adhit acts solely as a processor, requests are coordinated with the relevant controller.

Retention transfers and complaints

Exact retention periods are not always available for a category; GDPR permits meaningful criteria instead. Adhit's own retention criteria and confirmed website-statistics periods are described in the Privacy Policy. Independent controllers determine their own retention. Processors acting on Adhit's instructions remain subject to the applicable contractual and legal requirements.

Restricted transfers outside the EEA require a valid Chapter V mechanism and any necessary additional safeguards. No blanket representation is made about all independent partners' transfer arrangements. You may ask Adhit about safeguards applicable to its own processing.

You may complain to the Estonian Data Protection Inspectorate, https://www.aki.ee, or another competent authority, including in your habitual residence, place of work or the place of an alleged infringement. Judicial remedies remain available.