This privacy policy explains how we process personal data on the website valgesoo.ee and in connection with accommodation and event enquiries for Valgesoo Maakivivilla. It is based on Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR) and the Estonian Personal Data Protection Act.
Last updated: 2 November 2026.
1. Controller
The controller of personal data is Platinum Invest OÜ (registry code 11704394), Päeva tn 25-2, 50103 Tartu, Estonia. Contact for privacy matters: kkriisa@gmail.com, telephone +372 55 647 526.
2. What data we process and why
Enquiries and communication. When you send us an enquiry through the contact form or the booking request form, write to us by email or call us, we process your name, email address, telephone number (if you provide it) and the content of your message and, for booking requests, also the requested dates and arrival time, the number of adults and children, type of enquiry and requested extras. Enquiries sent through the forms are forwarded by email and are not stored in the website database; only the time of sending and the page address are added to the email. Messages previously sent through the contact form and stored in the website database (together with the sender’s IP address and browser details) will be deleted when the retention period stated below expires. The purpose is to answer your enquiry, provide a quotation and organise accommodation or an event. The legal basis is steps taken at your request before entering into a contract (GDPR Article 6(1)(b)) and our legitimate interest in answering the enquiries we receive (Article 6(1)(f)).
Bookings and contracts. If an enquiry leads to a contract or booking, we process your name, contact details, booking details and, where necessary, billing details. The legal basis is performance of the contract (Article 6(1)(b)) and compliance with accounting obligations (Article 6(1)(c)). If you book through Booking.com or Airbnb, those platforms process your data under their own terms and we receive the booking details we need to fulfil your booking.
Website visit statistics. We use the Independent Analytics plugin for statistics. It runs only on this website and does not send data to third parties. The plugin does not use cookies. The visitor’s IP address is used to determine an approximate location (country, city), and a one-way hash is created from it, the browser details and a random value that changes daily; the hash is used to count visitors. The IP address itself is not stored in the statistics database. We store the pages visited, the referring website, the device and browser type, the approximate location and the time of the visit. The purpose is to understand how the website is used and to improve its content and usability. The legal basis is our legitimate interest (Article 6(1)(f)).
Website security. Security plugins and the web host’s server logs process IP addresses and technical request data in order to detect and block attacks and spam. The legal basis is our legitimate interest in keeping the website secure (Article 6(1)(f)).
3. Cookies and similar technologies
The website does not use marketing or statistics cookies or third party tracking codes. When you choose the language of the website, a language preference cookie (pll_language) and a technical entry of the translation widget (gt_autoswitch) are stored in your browser so that the chosen language is remembered. They are used only to remember the language you have chosen. When the automatic translation widget is used, the servers of the translation service provider may be used to translate the content of the website.
If we add other cookies or tracking technologies to the website in the future, we will update this policy before they are introduced and, where required, ask for your consent.
4. Who we share data with
We do not sell personal data. The following service providers may process data on our behalf:
- the web hosting provider Zone Media OÜ (registry code 10577829, Lõõtsa tn 5, 11415 Tallinn; Zone.ee), on whose servers the website and its database are located;
- the email service provider Google (Gmail), through which emails sent to and from us are processed;
- Booking.com and Airbnb, where a booking is made through their platform (they are controllers of their own data).
We may also disclose data to public authorities where we are required to do so by law.
5. Transfers outside the European Economic Area
Google and other international service providers may process data outside the European Economic Area. In that case the transfer takes place on the basis of a European Commission adequacy decision or standard contractual clauses.
6. How long we keep data
- enquiries and communication: up to 12 months after the last communication;
- contract and billing data: for the period required by the Estonian Accounting Act, which is seven years;
- website visit statistics: up to 24 months;
- security logs: only for as long as necessary to detect and investigate security incidents.
7. Your rights
You have the right to obtain information about the processing of your data and a copy of it, to request rectification or erasure of your data, to restrict processing, to object to processing based on legitimate interests, to receive your data in a portable form and to withdraw any consent you have given (GDPR Articles 15 to 21). To exercise your rights, send a request to kkriisa@gmail.com. We will reply within one month.
If you believe your data has been processed unlawfully, you may contact the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee) or the courts.
8. Providing data
The required fields of the contact form and the booking request form are necessary for us to answer your enquiry. Without them we cannot reply.
9. Changes to this policy
We may update this policy when necessary. The current version is always published on this page.