HundiPlaces to stay

Privacy Policy

1. General Provisions

1.1. This Privacy Policy sets out the principles governing the collection, processing and storage of personal data. The controller of personal data is Vieno Haldus OÜ, registry code 12716407, address Hiiessaare, Hiiu vald, Hiiumaa, Estonia (hereinafter the Controller).

1.2. For the purposes of this Privacy Policy, a data subject means a customer, a visitor to the website or any other natural person whose personal data is processed by the Controller.

1.3. For the purposes of this Privacy Policy, a customer means any person who purchases, orders or uses goods or services offered by the Controller or submits an enquiry concerning them.

1.4. The Controller complies with applicable legislation when processing personal data and processes personal data lawfully, fairly, transparently and securely, and only to the extent necessary to achieve the relevant purpose.

2. Collection, Processing and Storage of Personal Data

2.1. Personal data is collected primarily electronically through the website, enquiry and booking forms, email, guest registration or e-check-in, customer communication and, where necessary, other channels related to the provision of services.

2.2. Personal data is processed for the purposes and on the legal bases described in this Privacy Policy. Depending on the circumstances, processing may be based on the performance of a contract or pre-contractual measures, compliance with a legal obligation, the legitimate interests of the Controller or the consent of the data subject.

2.3. The data subject is responsible for ensuring that the information they provide is correct, accurate and up to date. Where necessary, we ask the data subject to inform the Controller of any changes to their information.

2.4. The Controller is not liable for damage resulting from incorrect or incomplete information provided by the data subject.

3. Processing of Personal Data

3.1. Depending on the service used, the Controller may process, among other things, the following personal data:

  • 3.1.1. first and last name;
  • 3.1.2. date of birth and other information necessary for the provision of accommodation services or for guest registration required by law;
  • 3.1.3. telephone number;
  • 3.1.4. email address;
  • 3.1.5. address, where necessary for the provision of services, invoicing or delivery of goods;
  • 3.1.6. information relating to bookings, stays and services used;
  • 3.1.7. information relating to enquiries, customer communication and agreements;
  • 3.1.8. information relating to payments and invoicing;
  • 3.1.9. identification document details and information concerning nationality or place of residence where collection of such information is required by law for guest registration;
  • 3.1.10. customer feedback, review text, rating and the public display name chosen by the customer.

3.2. Where necessary, the Controller may also process information obtained from public registers or other lawful sources if this is necessary for the performance of a contract, the establishment or protection of a claim or right, or compliance with a legal obligation.

3.3. The legal bases for processing personal data arise from Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (GDPR), in particular:

  • a) the data subject has given consent to the processing of their personal data for one or more specific purposes;
  • b) processing is necessary for the performance of a contract to which the data subject is party or in order to take pre-contractual measures at the request of the data subject;
  • c) processing is necessary for compliance with a legal obligation to which the Controller is subject;
  • f) processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

3.4. Personal data may be processed for, among other things, the following purposes:

3.4.1. Management of services or enquiries
Responding to enquiries, preparing offers, preparing bookings or orders and providing services.

3.4.2. Management of accommodation and bookings
Managing bookings, arrivals and departures, number of guests, services and customer communication.

3.4.3. Compliance with legal obligations
Including guest registration related to the provision of accommodation services, accounting and other obligations arising from law.

3.4.4. Customer management and communication
Responding to customer questions, sending service-related notices and managing the customer relationship.

3.4.5. Financial administration and accounting
Processing invoices, payments and accounting documents.

3.4.6. Sale of goods and services
Managing orders for goods or services, payments and, where necessary, deliveries.

3.4.7. Feedback and reviews
Requesting customer feedback and publishing a review on the hundi.ee website with the customer’s consent or on the basis of a review submitted by the customer through the review form. The review text, rating and the display name chosen by the customer may be published. The customer’s email address, telephone number or booking details are not published together with the review.

3.4.8. Marketing
Marketing activities may be carried out where there is a valid legal basis for doing so, including, where required, the consent of the data subject.

3.4.9. Security and protection of rights
Preventing fraud, misuse or other violations and protecting the rights and claims of the Controller.

3.5. The Controller may use service providers and processors in the processing of personal data, including providers of web hosting, IT services, email services, accounting services, payment solutions, booking systems and, where necessary, transport and courier services.

For payment processing, the Controller may use Maksekeskus AS or another payment service provider. Only the information necessary for processing the payment or providing the relevant service is disclosed to the respective service provider.

3.6. When processing and storing personal data, the Controller applies appropriate organisational and technical security measures to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or any other unlawful processing.

3.7. Personal data is retained in accordance with the purpose of processing and the retention periods prescribed by applicable law, and no longer than necessary to achieve the relevant purpose.

4. Rights of the Data Subject

4.1. The data subject has the right to obtain information about whether and which personal data concerning them is being processed and the right to access their personal data.

4.2. The data subject has the right to request the correction or completion of inaccurate or incomplete personal data.

4.3. Where the processing of personal data is based on consent, the data subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

4.4. The data subject may exercise their rights by contacting the Controller at info@hundi.ee.

4.5. If the data subject considers that the processing of their personal data infringes their rights, they have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

5. Website and Cookies

5.1. The Hundi website uses technically necessary local settings for the basic functioning of the website. These include storing the user’s cookie choice in the browser’s local storage for six months. This storage does not contain personal data and is used without separate consent to the extent permitted by law.

5.2. To analyse the use of the website, the controller uses only the Google Analytics 4 service, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The website does not use Google Tag Manager, Google Ads, Meta Pixel or any other analytics or marketing tools.

5.3. Google Analytics 4 is activated only after the user has given consent. Before consent is given, or if consent is refused, the analytics service is not loaded and no analytics data is transmitted. The legal basis for the processing is the data subject’s consent (Article 6(1)(a) of the General Data Protection Regulation).

5.4. If consent is given, Google Analytics 4 stores the cookies _ga and _ga_* on the user’s device, with a lifetime of up to 2 years. Advertising and personalisation features as well as Google signals are disabled.

5.5. Google may also process data outside the European Economic Area, including in the United States. In such cases, the transfer takes place subject to applicable safeguards, such as an adequacy decision of the European Commission or standard contractual clauses.

5.6. The user may change or withdraw their consent at any time via the “Cookie settings” link in the website footer. When consent is withdrawn, analytics is stopped and, where possible, the cookies _ga and _ga_* are deleted. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5.7. The pages for submitting feedback and reviews (addresses /tagasiside/…) are not tracked by analytics.

6. Final Provisions

6.1. This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (GDPR), the data protection legislation of the Republic of Estonia and other applicable legislation of the Republic of Estonia and the European Union.

6.2. The Controller has the right to amend or supplement this Privacy Policy. The current version of the Privacy Policy is published on the website hundi.ee.

Contact

Vieno Haldus OÜ
Registry code: 12716407
Address: Hiiessaare, Hiiu vald, Hiiumaa, Estonia
Email: info@hundi.ee
Telephone: +372 56 690 512