Privacy Notice
Version 2026-11-EE · Information notice under Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), the Estonian Personal Data Protection Act (isikuandmete kaitse seadus) and the Estonian Electronic Communications Act (elektroonilise side seadus).
1. Data controller
Oteling, established in Estonia. Contact: contact@oteling.live.
2. Personal data we process, purposes and legal grounds
| Data | Purpose | Legal ground |
|---|---|---|
| E-mail address; time and version of your consent; approximate location (country/city derived from your IP address at sign-up; the IP address itself is not stored) | Sending a confirmation e-mail and news about Oteling’s launch and development; proving your consent; understanding where our audience is | Your consent — GDPR Art. 6(1)(a); direct-marketing e-mails also under the Estonian Electronic Communications Act § 1031 |
| Anonymous visit data: date/time, approximate region (country/city), device type (mobile/desktop), referrer. A daily-rotating one-way hash is used to avoid counting the same visitor repeatedly; the IP address is never stored. | Measuring visits and improving the website | Your consent given via the cookie banner — GDPR Art. 6(1)(a) and Electronic Communications Act § 1021 |
| Technical security data (e.g. IP address in short-lived server logs, security cookie) | Site security and fraud/abuse prevention | Legitimate interest — GDPR Art. 6(1)(f) |
3. Recipients and transfers
We do not sell your data. Data is stored on our own server in Estonia (European Union). E-mails are sent through our e-mail service provider (Metutech), acting as our processor under a data-processing agreement. If a processor is located outside the European Economic Area, transfers are made only with appropriate safeguards under GDPR Chapter V (such as Standard Contractual Clauses). Data may be disclosed to authorities where legally required.
4. Retention
Subscriber data is kept until you unsubscribe; after that we keep only the minimum needed to honour your opt-out (for example to prevent re-sending) for up to 12 months, then delete it. Anonymous visit data is kept for up to 24 months.
5. Your rights
Under GDPR Articles 15–22 you may request access to your data, correction, erasure, restriction of processing, data portability, and object to processing. You may withdraw your consent at any time (Art. 7(3)) — every e-mail contains an unsubscribe link, and cookie choices can be changed via “Cookie settings”. Withdrawal does not affect processing carried out before it. Write to contact@oteling.live; we reply within one month.
You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee, info@aki.ee) or with the supervisory authority of your country of residence (GDPR Art. 77).
6. Double opt-in
After you enter your e-mail we send a confirmation message. You are subscribed only after clicking the confirmation link.
7. Cookies
See our Cookie Policy.