Privacy Policy

Who we are

This website, purjelaud.ee, and the water activities and accommodation offered at Lake Nõuni are operated by Toretto OÜ (registry code 12123802, VAT EE101608068), located at Nõuni küla, Otepää vald, Valgamaa 67515, Estonia. We are the controller of the personal data described in this policy.

If you have any questions about this policy or how we handle your data, contact us at info@purjelaud.ee or +372 5271907.

What data we collect

We only collect the personal data we need to answer your enquiries and provide our services. Depending on how you interact with us, this may include:

• Contact details you submit through the contact form — your name, email address, phone number, and the content of your message.
• Booking and enquiry information, such as the activity or accommodation you are interested in, your preferred dates, and the number of participants.
• Technical data automatically logged by our hosting provider, such as your IP address, browser type, and the pages you visit, used to keep the site secure and working.
• Aggregated, anonymous usage statistics that help us understand how the site is used.

Why we use your data and our legal basis

We process your personal data for the following purposes and on the following legal bases under the EU General Data Protection Regulation (GDPR):

• To respond to your enquiries and prepare a booking — based on your request and the steps necessary to enter into a contract with you (GDPR Article 6(1)(b)).
• To provide our activities and accommodation and communicate with you about them — based on the contract between us (Article 6(1)(b)).
• To keep our website secure, prevent abuse, and improve our services — based on our legitimate interests (Article 6(1)(f)).
• To meet legal obligations such as accounting and tax requirements — based on a legal obligation (Article 6(1)(c)).

Who we share data with

We never sell your personal data. We share it only with trusted service providers that help us run our website and services, and only to the extent necessary:

• Resend — delivers the emails generated by our contact form.
• Vercel — hosts the website and provides privacy-friendly, aggregated analytics.
• Google Maps — displays maps and directions; Google may set cookies when a map loads.
• OpenWeatherMap — provides the weather information shown on the site.

Some of these providers may process data outside the European Economic Area. Where that happens, appropriate safeguards such as the European Commission's Standard Contractual Clauses are in place. We may also disclose data where required by law.

Cookies and analytics

We keep cookies to a minimum. Our analytics are aggregated and do not identify you individually. Third-party services such as embedded maps may set their own cookies — you can control or block cookies through your browser settings, though some features may then not work as expected.

How long we keep your data

We keep personal data only for as long as necessary for the purpose it was collected for. Contact and enquiry messages are kept for as long as needed to handle your request and for a reasonable period afterwards; booking and accounting records are kept for as long as required by Estonian law (generally seven years for accounting documents).

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data where there is no legal reason for us to keep it;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw any consent you have given, at any time.

To exercise any of these rights, contact us at info@purjelaud.ee. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).

How we protect your data

We apply appropriate technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access. Our contact form includes protections against spam and automated abuse.

Children

Our website is not directed at children, and we do not knowingly collect personal data from children. Bookings for participants under 18 must be made by a parent or guardian.

Changes to this policy

We may update this policy from time to time. The current version is always available on this page, with the date of the latest change shown above.