Privacy Policy

Last updated: June 2026

1. Introduction

This Privacy Policy describes how Peppergroup OÜ (“Company”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal data in connection with the website pepper-reputation.com (the “Site”).

We are committed to processing personal data in compliance with:

• The EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679); and
• The California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), where applicable.

This Site is a B2B marketing landing page for Pepper Reputation, a reputation management service. The Site does not support user accounts, logins, or payment processing. The only personal data we collect is either submitted voluntarily through our enquiry form or captured automatically through standard server and analytics infrastructure.

2. Data Controller

Peppergroup OÜ Harju maakond, Tallinn, Kesklinna linnaosa, Karu tn 14-8, 10120, Estonia Registration number: 16106462 Privacy contact: [email protected]

For all privacy-related questions, data subject access requests (DSARs), or complaints, please write to the email address above.

3. Scope

This Policy applies exclusively to personal data collected through pepper-reputation.com. It does not apply to:

• Other Peppergroup OÜ websites or products (e.g., pepper.partners);
• Personal data processed under client service agreements;
• Personal data of our employees or contractors.

4. Personal Data We Collect

4.1 Enquiry Form Data

When you voluntarily submit an enquiry through the form on the Site, we collect the following fields:

The Site also offers a free Trustpilot profile audit. Its form and the follow-up consultation request collect the same categories of data listed above — including the Trustpilot profile URL you ask us to analyze. Audit results are derived solely from publicly available Trustpilot data; we do not collect private account information.

Form data is transmitted to our server over HTTPS and forwarded to our internal sales team via the Telegram Bot API into a private sales channel.

4.2 Automatically Collected Technical Data

Our web server automatically records the following technical information for every request to the Site:

• IP address of the connecting device
• Browser and device information (User-Agent string)
• Date and time of the request

This is captured through standard nginx server logs and application logs. It is not combined with enquiry form data for profiling purposes.

4.3 Analytics Data

We use Google Analytics 4 (loaded via Google Tag Manager) to understand how visitors interact with the Site. This involves setting cookies on your device. See Section 8 and our Cookie Policy for full details.

5. Legal Bases for Processing (GDPR)

Note on legitimate interests: Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms, taking into account that (a) this is a B2B context where data relates to professional rather than personal life, and (b) the data processed is limited and proportionate to the purpose. You may object at any time (see Section 10).

6. How We Use Your Data

We use the personal data described above to:

• Receive, review, and respond to business enquiries submitted through the Site;
• Follow up with you as part of our sales process for Pepper Reputation services;
• Maintain records of incoming enquiries for business continuity purposes;
• Ensure the security, stability, and proper operation of the Site;
• Understand how visitors interact with the Site and improve its content and performance (analytics only).

We do not use personal data collected through this Site for automated decision-making or profiling as defined under Art. 22 GDPR.

7. Data Processors and Third-Party Recipients

We share personal data with the following processors and recipients solely to the extent necessary for the purposes described above.

7.1 Sub-processors

We have entered into or rely on data processing terms with each sub-processor to ensure appropriate handling of personal data.

7.2 Other Disclosures

We may also disclose personal data to:

• Regulatory or law enforcement authorities, where required or permitted by applicable law;
• Professional advisers (legal, accounting, auditing), subject to appropriate confidentiality obligations;
• Successors or acquirers in the event of a business merger, acquisition, or asset sale, in which case affected individuals will be informed.

We do not sell your personal data. We do not share personal data with third parties for their own marketing or advertising purposes.

8. International Data Transfers

Peppergroup OÜ is established in Estonia (EU/EEA). Some sub-processors transfer personal data outside the EEA:

• Telegram is headquartered in Dubai, UAE. Transfers to Telegram are made in reliance on necessity for the performance of services and/or available appropriate safeguards under Telegram’s terms of service. We regularly review this arrangement in light of applicable guidance.
• Google LLC (GA4) transfers data to the United States. Google relies on Standard Contractual Clauses (SCCs) approved by the European Commission (Commission Implementing Decision (EU) 2021/914) as the transfer mechanism under GDPR, supplemented by Google’s additional technical safeguards.

9. Data Retention

10. Cookies

We use the following cookies on this Site:

Google Tag Manager itself does not set cookies; it only loads other scripts (currently only GA4). If additional analytics or marketing tools are added in the future, this Policy and our Cookie Policy will be updated.

Consent and control: Under GDPR, analytics cookies require your prior consent. When you first visit the Site, a cookie consent banner will allow you to Accept all, Reject all, or Manage preferences by category. You may change or withdraw your consent at any time by revisiting the cookie preferences panel.

For full details, please see our Cookie Policy.

11. Your Rights

11.1 Rights Under GDPR (EEA and UK Residents)

If you are located in the European Economic Area or the United Kingdom, you have the following rights under GDPR:

• Right of access (Art. 15) — to obtain confirmation of whether we process your personal data and to receive a copy of it.
• Right to rectification (Art. 16) — to have inaccurate personal data corrected or incomplete data completed.
• Right to erasure (Art. 17) — to request deletion of your personal data where it is no longer necessary, consent has been withdrawn, or processing is unlawful.
• Right to restriction of processing (Art. 18) — to request that we limit processing in certain circumstances (e.g., while accuracy is disputed).
• Right to data portability (Art. 20) — to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to object (Art. 21) — to object at any time to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent (Art. 7(3)) — to withdraw consent at any time where processing is consent-based, without affecting the lawfulness of processing prior to withdrawal.

How to exercise your rights: Send a written request to [email protected]. We will respond within 30 calendar days of receipt. In complex or high-volume cases, we may extend this by a further 2 months and will notify you of any extension.

We do not charge a fee for reasonable requests. We may request identity verification before processing sensitive requests.

Right to lodge a complaint: You have the right to lodge a complaint with the supervisory authority in your country of residence or the Member State where the alleged infringement occurred. As Peppergroup OÜ is registered in Estonia, the lead supervisory authority is:

Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) Tatari 39, 10134 Tallinn, Estonia Website: www.aki.ee Email: [email protected] Phone: +372 627 4135

11.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know — to request disclosure of the categories and specific pieces of personal information collected, the sources, the business or commercial purposes for collection, and the categories of third parties with whom it is shared or disclosed.
• Right to Delete — to request deletion of personal information we have collected, subject to certain exceptions (e.g., legal obligations).
• Right to Correct — to request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing — to opt out of the sale or sharing of your personal information for cross-context behavioural advertising. We do not sell personal information and do not share it for cross-context behavioural advertising purposes.
• Right to Limit Use of Sensitive Personal Information — not applicable; we do not collect sensitive personal information as defined under CPRA.
• Right to Non-Discrimination — we will not discriminate against you in pricing, service, or quality for exercising any rights under CCPA/CPRA.

How to exercise your rights: Email [email protected] with the subject line “CCPA Privacy Request” and a description of your request. We will respond within 45 calendar days. Where reasonably necessary, we may extend this by a further 45 days and will notify you in advance.

Categories of personal information collected (CCPA statutory categories):

We do not knowingly collect personal information from individuals under 16 years of age. This Site is intended exclusively for B2B use by business professionals.

12. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. Specific safeguards include:

• All form submissions are transmitted over HTTPS (TLS encryption in transit);
• The Telegram sales channel receiving enquiries is private and access-restricted to authorised sales team members;
• Server infrastructure operates within Docker-containerised environments with access controls.

In the event of a personal data breach, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach (where required by GDPR Art. 33) and will notify affected individuals where the breach is likely to result in high risk to their rights and freedoms (GDPR Art. 34).

13. Children’s Privacy

This Site is intended solely for B2B use by business professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately at [email protected] and we will promptly delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the “Last updated” date at the top of this page. We encourage you to review this Policy periodically. Continued use of the Site after any changes are posted constitutes your acknowledgement of the updated Policy.

15. Contact

For any privacy-related questions, requests, or concerns:

Peppergroup OÜ Harju maakond, Tallinn, Kesklinna linnaosa, Karu tn 14-8, 10120, Estonia Email: [email protected]

This Privacy Policy applies to pepper-reputation.com, operated by Peppergroup OÜ.