Privacy policy (draft)

DRAFT: needs a lawyer's review before real customer data is used

Items in square brackets are to be filled in. Do not use this text before legal review. The Estonian version is the source; this is a translation of it.

1. Controller

The controller of personal data is [Organisation name] (registry code [registry code], address [address], email [contact email]), i.e. the organisation using the service (the venue). The technical provider of the booking system ([Provider name]) is the venue's processor.

2. What data we process

Request and booking data: name, email, phone, company name and registry code, event date, number of guests, free text.
Quotes and billing: quote content, amounts, statuses.
Newsletter consent (only if you gave it): name and email.
Staff: email, name, sign-in times.
Technical logs: email sending log, sign-in links (kept temporarily).

3. Purposes and legal basis

Purpose	Basis (GDPR Art. 6)
Answering a request, making a quote, carrying out a booking	paragraph 1(b) (contract / pre-contractual steps)
Obligations under accounting and tax law	point (c) (legal obligation)
System security and abuse prevention	point (f) (legitimate interest)
Newsletter	point (a) (consent, can be withdrawn at any time)

Hosting and database: [host name, location].
Resend: sending emails (EU data location not confirmed; needs assessment and, if required, standard contractual clauses).
Anthropic: AI assistant [for the lawyer to check]. The venue may use the assistant in the following ways: (1) filling in the request form from your description (up to 1,500 characters, the text is not stored); (2) drafting a reply to your message (up to 6,000 characters); (3) a reminder about an unanswered quote (event data only, not your text); (4) a short summary of the request and spam detection (up to 3,000 characters); (5) the venue's weekly totals (not your data); (6) an answer to a question you ask in the "Ask a question" box on the venue's page (up to 500 characters; the answer is based only on data the venue has published); (7) improving the wording of a quote (the quote's greeting, summary and closing; amounts and price lines are not sent) [for the lawyer to check: the greeting may contain your name]; (8) a short event briefing for the venue's team (event data and notes, including your message, up to 400 characters). Before sending, email addresses and phone numbers are removed from the text and the name, email, phone and company fields are not sent, but text you write freely may contain other personal data. The assistant does not set prices or confirm bookings; a staff member sends you the email (or an automatic reminder the venue has switched on). Drafts and summaries are deleted together with other customer data (section 5). The venue can switch off each use. Retention and data location on Anthropic's side: [for the lawyer to check].
Montonio: payment service (the venue's own account).
Mailchimp: newsletter (the venue's own account; name and email only, only with consent).

We do not sell data.

5. Retention

Customer data is anonymised when [36] months have passed since the last booking and there are no future bookings (the venue can change the period).
The original text of requests is deleted after [36] months.
Sign-in links are deleted 7 days after use or expiry.
Billing data is kept for [7] years as required by law.
Backups: [N] days; deleted data disappears from backups within that time.

6. Your rights

You have the right to access your data, correct it, have it deleted, restrict processing, object, receive the data in a machine-readable form (an administrator can make a CSV export) and withdraw consent at any time. Contact: [contact email]. We reply within one month. You can lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee).

7. Security

Access is limited by role, sign-in uses a one-time link, data is encrypted in transit, and row-level access rules apply in the database.

8. Changes

Last updated: [date].