Privacy Policy

1. Data controller and contact

The controller of your personal data is MTÜ Spot Pärnu, registry code 80663499, address Kirsi tn 48, Pärnu, Pärnu County, 80010, Estonia.

Questions and requests: info@spotparnu.ee.

2. What data we collect

• Emails and contact enquiries: when you write to info@spotparnu.ee, we process your email address, your name (if provided) and the contents of your message.
• Server logs: our hosting service may record technical request data, such as your IP address, time, the requested URL including any campaign parameters, and browser type. These are used to keep the website working and secure.
• Browser storage: your device stores your category choices, the time you made your choice and when it expires, the method of selection and the consent notice version. This does not include your name or email address.
• GTM and cookieless signals: Google Tag Manager loads when the page opens, with Google's measurement consent states denied. The container request sends technical connection data, such as your IP address, to Google. Activated consent-aware Google tags may send limited cookieless measurement signals even when consent is denied, such as the page URL, consent state and technical data. A cookieless signal is not necessarily anonymous information.
• Analytics and advertising: if you allow the relevant category and the corresponding tags are activated, Google and Meta may receive the visited page URL, referring page, event and device/browser data, IP address, and cookie or advertising identifiers. Analytics helps us understand website use; marketing is used to measure advertising effectiveness and personalise advertising. Meta and other tags that do not support Google's Consent Mode must be blocked separately until the relevant consent is given.
• External map: if you allow external content, OpenStreetMap's server receives your IP address when map tiles load.
• Newsletter form: we process your email address, your separate newsletter consent and its time, and the name, audience category and company name provided in the form. The company name is sent only if you select company representative. We also send the source of consent and the consent wording to Smaily. Submitting the form starts a subscription and an automated email sequence through Smaily; no separate email confirmation is requested (single opt-in). We show a successful subscription only after Smaily confirms acceptance. To prevent repeated submissions, our server retains a protected hash derived from the address and the request status, not a copy of the form data.
• Form abuse prevention: temporary counters limit the number of requests. The counter associated with an email address uses a protected hash instead of the address. The hash may still be an identifier relating to personal data, rather than anonymous information.
• Sharing links: the URL displayed after newsletter signup has no campaign parameters. When you copy it or open a sharing service, UTM parameters describing the campaign and selected sharing channel are added. The link does not contain your submitted name, email address or a personal subscriber identifier. These parameters may appear in the destination page's technical logs and, with consent, activated analytics.

The website has no user accounts or payments. The newsletter form is available on both the Estonian and English landing pages. If the service fails, the form displays a message; we do not show success without confirmed acceptance. If the result of a request is unclear, the data may have reached the service provider — please contact us before trying again.

3. Purposes and legal bases

• Responding to enquiries: legitimate interests or steps before entering into a contract, depending on the enquiry.
• Technical operation and security of the website (server logs): legitimate interests.
• Remembering your consent choice: necessary to respect your choice.
• Using analytics and advertising cookies, sharing advertising data, personalised advertising and external content: your prior consent, which you can withdraw at any time.
• Email newsletter: separate consent when subscribing.

Using or scrolling through the website, or reading the terms of use, does not provide consent to optional data processing. Refusing consent does not prevent you from viewing the main content or subscribing to the newsletter with separate consent. UTM parameters in a link do not provide consent to analytics or advertising.

4. Services and processors

The following services support the website or measurement with consent. Loading GTM does not mean all measurement tags are active. On a page running JavaScript, a measurement tag's activation depends on its configuration and the consent for its category.

If JavaScript is disabled in your browser, Google Tag Manager's noscript fallback loads through a hidden iframe. This request also sends technical connection data to Google. JavaScript consent defaults, restoration of saved choices and this website's cookie controls do not work in that case. The fallback's contents and any processing depend on the GTM container configuration.

Recipients of data for Google services may include Google Ireland Limited and, depending on the service, Google LLC or other Google entities. See how Google uses data from our website, Google's explanation of cookies and Google's EU User Consent Policy. A provider's role as processor or independent controller depends on the service and contract.

Cookie consent is not consent to email marketing. We ask for separate consent to send the newsletter. You can unsubscribe through the link in each email or by writing to info@spotparnu.ee.

A sharing button may open the selected service's website or your device's share dialog. That service may receive the shared URL, campaign parameters, public sharing text and connection data such as your IP address. Its own privacy terms apply to its processing. This website does not post on your behalf or send newsletter form data to the sharing service.

5. Retention and data transfers

A consent choice stored in your browser is valid for 180 days (approximately six months). An expired choice or one that does not match this consent notice version does not grant measurement consent. A new choice replaces the previous one; deleting browser data removes the saved choice. The website currently keeps no separate server-side history of cookie consents.

We process newsletter data until you unsubscribe or the purpose ends. The minimum information needed to honour an unsubscribe request, demonstrate consent or handle legal claims may be retained to the extent required by the need and legal basis; it is not used to send newsletters after you unsubscribe.

Protected hashes, request statuses and the random technical signup event ID used to prevent repeated form submissions expire after 24 hours. The ID is not an email address or a value derived from one. Rate-limit counters expire after one minute or one hour. Expired records are removed during regular server cleanup or the next form request. These records do not retain names, email addresses or other form data.

The website adds confirmed signup, successful link copying, sharing-button use and social-profile link opening events to the local GTM event queue. Events contain a random technical ID and the button location or channel name, but no personal information entered into the form. Using a share button does not prove that a post was published, and opening a profile link does not prove that someone followed the account. These actions do not change cookie consent choices; forwarding by GTM tags must follow the relevant consent state.

Contact enquiries are retained for the time needed to respond and resolve the matter and, if necessary, during the period for handling legal claims. Technical log retention depends on hosting configuration and security incident investigation needs; measurement data retention depends on the activated service's configuration. The 180-day validity of cookie consent does not determine the retention period for those data. For details, contact info@spotparnu.ee.

Hosting, Google and Meta services may involve processing personal data outside the European Economic Area. Applicable data protection requirements must be followed for these transfers. Information about processing locations and safeguards applicable to a particular transfer is available in providers' privacy policies and from info@spotparnu.ee. Cookie consent does not replace required data transfer safeguards.

6. Your rights

• Access your personal data;
• request correction of inaccurate data;
• request deletion;
• request restriction of processing;
• data portability;
• object to processing;
• withdraw consent (Cookie settings).

To withdraw cookie consent, open Cookie settings from the footer and choose “Withdraw consent”, or turn off the relevant category and save. Google's consent states are updated to reflect your choice in the already loaded container. Limited cookieless signals may continue when consent is denied. Where possible, we remove this site's accessible cookies for the relevant category; this website cannot itself delete other domains' cookies or data already sent.

Requests: info@spotparnu.ee. Rights apply subject to the conditions set by law. Withdrawal of consent does not affect the lawfulness of earlier processing.

7. Complaints

If you believe processing infringes your rights, you may contact the Estonian Data Protection Inspectorate: www.aki.ee. Please also contact us first.

8. Changes and contact

We may update this policy, for example when connecting services. The current version is always available on this page. Questions: info@spotparnu.ee. See also our Terms of Use.