CreoMundus
CreoMundus OÜ

Privacy notice

Last updated: October 2026

1. Controller

The controller responsible for processing your personal data under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) is CreoMundus OÜ, Sepapaja tn. 6, 15551 Tallinn, Estonia.

Contact for data protection: Dietmar Hering
Email: mail@creomundus.eu
Phone: +372 53637546

2. Data we process

  • Visiting the website: IP address, date and time, pages visited, browser type (server log files kept by the hosting provider).
  • Contacting us: name, email address, phone number and the content of your message when you write or call us.
  • Chat assistant: your input in the chat and the answers; a hash of your IP address to prevent abuse.
  • Pre-ordering the book: first name, last name, email address, chosen edition (print or e-book), chosen language and the time of your consent.

3. Purposes and legal bases

  • Reserving a copy and informing you when the book is published: your consent, Art. 6(1)(a) GDPR.
  • Handling enquiries and preparing or performing a contract: Art. 6(1)(b) GDPR.
  • Secure and stable operation of the website: legitimate interest, Art. 6(1)(f) GDPR.
  • Legal retention and documentation duties: Art. 6(1)(c) GDPR.

4. Pre-order

Reserving a copy is free and non-binding. No payment is taken on this page. We use your details to email you once the book is available and the order link is ready. You can withdraw your consent at any time with effect for the future, by email to the address above or via the unsubscribe link in our emails.

Once the order link is available, payment may be made through payment providers (card payment, PayPal). We will inform you separately before any payment data is collected.

5. Contact, chat assistant and booking

Contact form and email. When you write to us through the form on the contact page or by email, we process your name, email address and message to answer your enquiry. The form sends your details to our mailbox and may also create a contact in our HubSpot account. The legal basis is Art. 6(1)(b) GDPR (preparing a contract) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

AI chat assistant. On the contact page you can ask an AI assistant questions. It is an AI and not a person. When you send a message, it is transmitted together with the conversation so far, via our server, to Anthropic, PBC (USA), so that Claude can generate the answer. Anthropic acts on our behalf. We do not store the chat content on our server. To prevent abuse we keep, for a short time, only an irreversible hash of your IP address with a counter. If you send the chat history through the contact form, it becomes part of your message. Please do not enter sensitive data in the chat. The legal basis is Art. 6(1)(f) GDPR (providing an information service to answer questions). The transfer to the USA takes place on the basis of appropriate safeguards, such as standard contractual clauses.

Booking a time. The “Book a time” button leads to appointment booking via Google Calendar (Google Ireland Limited). Data is only transmitted to Google when you open the link, and Google’s privacy terms apply there. We use the details you give when booking to hold the appointment (Art. 6(1)(b) GDPR).

WhatsApp. The “By WhatsApp” button opens a chat with us via WhatsApp (WhatsApp Ireland Limited). Only when you open the link and send a message does WhatsApp process your data under its own terms. We receive your phone number and the content of your message and use them only to answer your enquiry (Art. 6(1)(b) or (f) GDPR).

6. Recipients and processors

  • Website hosting: Hostinger. The provider processes technical access data on our behalf.
  • Form and contact management: HubSpot (HubSpot Ireland Limited, Dublin). The form on the pre-order page is loaded from HubSpot servers in the EU, so your IP address is transmitted to HubSpot. We store the pre-order data there. A transfer to third countries cannot be ruled out; it takes place on the basis of appropriate safeguards such as standard contractual clauses.
  • AI assistant (only if you use the chat): Anthropic, PBC, USA. See section 5 for details.
  • Booking and WhatsApp (only if you open the respective links): Google Ireland Limited and WhatsApp Ireland Limited. See section 5 for details.
  • Web analytics (only with your consent): Google Analytics, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. See section 7 for details.
  • Visitor analytics (only with your consent): HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland. See section 7 for details.
  • We do not pass your data to other third parties unless legally required.

7. Fonts, cookies and web analytics

The fonts on this website are loaded from our own server. No connection to Google Fonts is made.

Technically necessary cookies (HubSpot form). When you open the pre-order page, the form is loaded from HubSpot. HubSpot, or its infrastructure provider Cloudflare, may set a technically necessary cookie named “__cf_bm”. It protects against automated access (bot detection) and expires after about 30 minutes. The legal basis is Section 25(2) no. 2 of the German TDDDG and Art. 6(1)(f) GDPR (legitimate interest in operating the form securely).

Visitor analytics with HubSpot (only with consent). If you agree in the notice window, we additionally load the tracking script of HubSpot Ireland Limited. It recognises returning visits and links a later form submission to the pages viewed beforehand, so that we can see how an enquiry came about. Cookies are stored on your device: “__hstc” (visit history, six months), “hubspotutk” (visitor identification on forms, six months), “__hssc” (session, 30 minutes) and “__hssrc” (detects a browser restart, end of session). The data transmitted includes your IP address, the pages you view and the times. Processing takes place on servers in the EU; a transfer to HubSpot, Inc. in the USA cannot be ruled out and is based on standard contractual clauses. Without your consent the script is not loaded. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) of the German TDDDG. You can withdraw it at any time with effect for the future via the “Cookie settings” link in the footer of every page. Further information: legal.hubspot.com/privacy-policy.

Web analytics with Google Analytics (only with consent). If you agree in the notice window, we use Google Analytics 4 from Google Ireland Limited to understand how the website is used (for example pages viewed, time on page, approximate region, device type). This stores cookies (“_ga” and “_ga_” with an identifier) on your device, valid for up to two years, and transmits data to Google. Google Analytics 4 does not log IP addresses. Personalised advertising features and Google signals are switched off. A transfer to Google LLC in the USA is possible; Google is certified under the EU-US Data Privacy Framework. Without your consent, Google Analytics is not loaded and no connection to Google is made. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time with effect for the future via the “Cookie settings” link in the footer of every page. More information: policies.google.com/privacy.

8. Retention

We keep your data only for as long as needed for the purposes above or as required by law. Reservations are deleted when you withdraw consent, and at the latest 24 months after the book is published. For later orders, statutory retention periods for accounting records apply (seven years in Estonia). We keep enquiries until your matter is finally resolved, and beyond that only while a contractual relationship exists or legal obligations require it. We do not store chat content. Server log files are deleted after a short period.

9. Your rights

Under the GDPR you have the right to:

  • access your stored data (Art. 15)
  • rectification of inaccurate data (Art. 16)
  • erasure (Art. 17)
  • restriction of processing (Art. 18)
  • data portability (Art. 20)
  • object to processing (Art. 21)
  • withdraw consent with effect for the future (Art. 7(3))

We respond to requests within one month. You also have the right to lodge a complaint with a supervisory authority, for example the competent Estonian authority (Andmekaitse Inspektsioon, www.aki.ee) or the authority in your place of residence.

10. Data security

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss and alteration. Data is transmitted in encrypted form via HTTPS.

11. Links to other websites

This website may contain links to third-party websites. We are not responsible for their privacy practices or content.

12. Changes

We update this notice when our offering or the legal situation changes. The current version is always available on this page.