Legal

Privacy notice

This notice explains what personal data GreenDice AS processes, why and for how long, who we share it with and what rights you have.

Last updated 1 November 2026

1. Who is responsible for your data

When we process data for our own purposes (the website, Täpi, communication, contracts and providing the service), the controller is GreenDice AS (registry code 16522580).

GreenDice AS
Aia 3, 10111 Tallinn, Estonia

Data protection questions: tugi@greendice.ee (subject “Data protection”)
Phone: +372 5681 0666

If you use the GreenDice service through a school, municipality or employer, that organisation is the controller of your user account and school-related data. In that case we process the data on the organisation's behalf and following its instructions. See our data processing terms.

2. What data we process and why

PurposeDataLegal basisRetention

Running and securing the websiteIP address, time, page opened, browser type (server log)Legitimate interest in keeping the site working and protecting it from attacks (GDPR Art. 6(1)(f))Up to 14 days

Täpi chatYour messages; IP address for rate limitingLegitimate interest in answering your question and protecting the service from abuse (Art. 6(1)(f))GreenDice doesn't store messages; the IP address stays in server memory for up to 10 minutes. See Täpi

Enquiries and communicationName, contact details, content of the email or callSteps prior to a contract (Art. 6(1)(b)) or legitimate interest in replying to you (Art. 6(1)(f))Until the matter is resolved; correspondence up to 3 years

Providing the serviceName, contact details, contract details, details of the device you use (model, serial number), support tickets, invoices and paymentsPerformance of a contract (Art. 6(1)(b)); legal obligation under accounting law (Art. 6(1)(c))For the term of the contract and 3 years after it ends; accounting records 7 years

Tracking the device lifecycleLink between device and user, place of use at county level, return and routing to material recyclingPerformance of a contract (Art. 6(1)(b)) and legitimate interest in proving that every device is reused and finally reaches material recycling (Art. 6(1)(f))Until the end of the device's lifecycle and 3 years after

Partners and clientsContact person's name, position, contact details, communication historyLegitimate interest in working together and performing contracts (Art. 6(1)(f))During the cooperation and 3 years after it ends

Job applicationsCV, cover letter and anything else you send usSteps prior to a contract (Art. 6(1)(b))Up to 1 year after the selection; longer only with your consent

Stories, photos and videosName, photo, video, quoteConsent (Art. 6(1)(a))Until consent is withdrawn

Partners whose devices have been reused through GreenDice only see aggregated data, such as sector and county. Private individuals are never shown by name.

3. Täpi, the AI chat

Täpi's answers are generated by an OpenAI language model. Your message and the earlier messages in the same chat (up to the last 12) are sent to OpenAI only to generate the answer.
GreenDice doesn't store or log the content of chats. The server only records that a request was made.
OpenAI doesn't use data sent through its API to train its models. OpenAI may keep requests for up to 30 days to detect abuse and deletes them after that.
The chat history is kept in your browser (sessionStorage) and is deleted when you close the tab.
Don't share passwords, personal ID codes, bank details or health information with Täpi. For a personal issue, write to tugi@greendice.ee or create a support ticket.

4. Cookies and browser storage

This site has no advertising or analytics cookies, no tracking code and no social media plugins. We store only two functional values in your browser:

gd-vaade (localStorage) remembers whether you chose the view for individuals, businesses or education. You can delete it in your browser settings.
tapi-log (sessionStorage) keeps your Täpi chat and is deleted when you close the tab.

These are needed for features you use yourself, so we don't ask for consent. Fonts and videos are loaded from GreenDice's own server. Some images and figures come from other GreenDice addresses (www.greendice.ee, partner.greendice.ee).

Login and the online shop are at www.greendice.ee (Odoo platform), which uses the cookies needed for logging in and for the shopping cart.

5. Who we share data with

We don't sell personal data. We use trusted service providers (processors) that process data only on our instructions and under a contract.

ProviderPurposeLocation

Zone Media OÜServers and web hostingEstonia

Odoo S.A.Customer management, contracts, invoices, support tickets, www.greendice.eeBelgium (EU)

Microsoft Ireland Operations LtdEmail, Teams, SharePointIreland (EU)

OpenAI Ireland LtdTäpi's answersIreland (EU); processing may take place in the USA

Where a provider processes data outside the European Economic Area, this is done under the European Commission's standard contractual clauses or the EU–US Data Privacy Framework. We disclose data to authorities only when the law requires it.

6. Data on devices

We erase data from devices returned by partners and users according to the NIST SP 800-88 standard and issue an erasure certificate. We don't view or copy the contents of devices. Back up your files before returning a device, as erased data cannot be recovered.

7. Your rights

You have the right to:

find out what data we process about you and get a copy of it;
have inaccurate data corrected;
have your data erased when it's no longer needed and the law doesn't require us to keep it;
restrict processing or object to processing based on legitimate interest;
receive the data you provided in a machine-readable format (data portability);
withdraw your consent at any time.

Write to tugi@greendice.ee. We reply within one month. Before releasing data, we may ask you to verify your identity. A parent or guardian may make a request about a child's data.

If you believe we are violating your rights, you can contact the Estonian Data Protection Inspectorate (info@aki.ee) or a court. We'd still like you to write to us first so we can resolve the matter quickly.

8. How we protect data

All connections are encrypted (HTTPS).
Only employees who need the data for their work have access to it, and they are bound by confidentiality.
Where possible, we use services located in Estonia and the European Union.
We notify the Data Protection Inspectorate and, where required, you of any personal data breach as provided by law.

9. Changes

We update this notice when our processing changes. The current version is always on this page. We announce significant changes on the site or by email.