Last modified 26.04.2023 

Applicability of privacy policy

1. This Privacy Policy (hereinafter: the Privacy Policy) applies to all cases where Hessnery OÜ (hereinafter: Hessnery) processes the personal data of natural persons (hereinafter: the Data Subject) as a data controller by providing accommodation services within the framework of its economic and professional activities (hereinafter: the Accommodation Services).     
2. Within the framework of the Accommodation Services, Hessnery allows natural and legal persons to enter into a contract with them for the use of the Hessnery Residences accommodation by natural persons (hereinafter: the Users) through their website and booking system (hereinafter jointly: the Booking System).   
3. Hessnery is committed to protecting and respecting the privacy of the Data Subjects. Please read this Privacy Policy carefully to understand Hessnery’s rules and practices regarding the processing of personal data. 
4. The Privacy Policy is effective as of the date above. Hessnery may unilaterally amend and supplement the Privacy Policy. Hessnery notifies the Data Subjects of changes to the Privacy Policy by making them available on their website (or otherwise at Hessnery’s discretion). 

Data controller

1. The controller of the personal data of the data subjects is Hessnery OÜ, registry code 12532251, address Pärnu mnt 146, Tallinn 11317, Harju County. 
2. In all matters related to the Privacy Policy and the processing of personal data, you can contact Hessnery by sending an inquiry by e-mail to info@hessnery.ee. 

Which personal data are processed and for what purpose

1. Hessnery collects and processes personal data for the following purposes: 
2. For the provision of Accommodation Services, which includes communication with the Data Subject; 
3. to communicate with a potential client in connection with the provision of Accommodation Services in the future, if the Data Subject has expressed the wish to do so; 
4. to send news, special offers and general information about the Accommodation Services to the User, unless the User has opted out of receiving such information; 
5. to improve and better the Accommodation Services; 
6. to implement the rights of Hessnery provided for in the legislation and contract in force in the Republic of Estonia; 
7. to perform the commitments arising from the legislation in force in the Republic of Estonia, incl. to fulfil the commitments applicable to the accommodation establishment. 
8. Hessnery collects and processes the following personal data: 
9. For the purpose of providing the Accommodation Services (purpose established in clause 3.1(a)): 
10. First name and surname, contact details (e-mail address, postal address, telephone number), personal identification code and/or date of birth, copy of identity document, vehicle registration number, payment details; 
11. language preference and gender for the purpose of providing better quality Accommodation Services; 
12. specific conditions for the use of the Accommodation Services, such as the period during which the Accommodation Services are provided, move-in and move-out dates, the type of accommodation to be rented, the time available for visiting the building and the room, information on additional services, etc; 
13. security camera recordings (image only, no sound) and access system logs to ensure the security of the User and their property; 
14. the name, telephone number and relationship to the User of an emergency contact for emergency assistance; 
15. any other personal data that the User may voluntarily provide in connection with the Accommodation Services, such as questions and comments. 
16. for the purpose of communication with a potential client (purpose established in clause 3.1(b)): data voluntarily made available by a person, which is usually first and last name, e-mail address. 
17. About the Accommodation Services for the purpose of sending news, special offers and general information (purpose established in clause 3.1(c)): first and last name, e-mail address. 
18. For the purpose of improving and bettering the Accommodation Services (purpose established in clause 3.1(d)): primarily data voluntarily made available by the User, such as their feedback on the Accommodation Services, as well as any other personal data listed above, depending on the specific updates made for the Accommodation Services. Usually, the personal data will be pseudonymised in this case. 
19. For the purpose of exercising and protecting Hessnery’s rights (purpose established in clause 3.1(e)): any of the above personal data determined in accordance with the specific law that Hessnery applies. 
20. For the purpose of fulfilling the commitments arising from the legislation in force (purpose established in clause3.1(f)): 
21. pursuant to the legal obligation provided for in the Republic of Estonia (available at: https://www.riigiteataja.ee/akt/104122020003?leiaKehtiv; hereinafter: TourA), a copy of the User’s identity document or travel document, as well as the first name and surname, date of birth, nationality, country of residence, the time of provision of the Accommodation Services, the purpose of the trip, the number of minor children staying with the User and, in the cases provided for in TourA, the type, number and country of issue of the travel document (for this purpose, only the personal data contained in the copy of the User’s identity document or travel document shall be collected for the User’s minor child);  
22. any other personal data listed above, which will be determined in accordance with the specific commitment that Hessnery must fulfil. 
23. As a general rule, the User’s provision of personal data is necessary for the provision of the Accommodation Services and, if the User refuses to provide such personal data, Hessnery may deny or restrict the User’s right to use the Accommodation Services. 
24. As a general rule, Hessnery collects personal data directly from the Data Subject itself, except for: 
25. in a situation where the personal data of the Data Subject is collected from another person who is entitled to do so (e.g., a person who is in direct communication when entering into a contract with Hessnery); 
26. personal data that Hessnery collects independently about the Data Subject (e.g., security camera recordings, logs of access systems, etc.). 

Legal bases for the processing of personal data

1. Hessnery processes the User’s personal data as it is necessary for the provision of the Accommodation Services (purpose established in clause 3.1(a)) or for taking prior measures for the provision of the Accommodation Services in accordance with the Data Subject’s request (purpose established in clause 3.1(b)). In this case, the legal basis for the processing of personal data is the performance of a contract concluded with the participation of the Data Subject or the taking of measures prior to entering into a contract in accordance with the Data Subject’s request. 
2. To the extent that Hessnery processes personal data for sending news, special offers and general information about the Accommodation Services (purpose established in clause 3.1(c)), the legal basis for the processing of personal data is Hessnery’s legitimate interest in keeping the User informed of news, special offers and general information related to the Accommodation Services. The User always has the option to unsubscribe from receiving such notifications (e.g., the unsubscribe button below each email). If the User opts out of receiving notifications, Hessnery will no longer send such information or process their personal data for this purpose. 
3. To the extent that Hessnery processes personal data for the purpose of improving and bettering the Accommodation Services (purpose established in clause 3.1(d)), the legal basis for the processing of personal data is Hessnery’s legitimate interest in improving and improving the provision of the Accommodation Services and their quality. Hessnery cannot offer the best and most modern Hosting services without making the necessary upgrades. 
4. To the extent that Hessnery processes personal data in emergency situations to ensure the safety of the Data Subject (purpose established in clause 3.2(a)v), the legal basis for the processing of personal data is the performance of a contract concluded with the participation of the Data Subject and the protection of the vital interests of the Data Subject. 
5. In addition, Hessnery processes personal data for the purpose of exercising and protecting Hessnery’s rights arising from the legislation and contracts in force in the Republic of Estonia (purpose established in clause 3.1(e)). In this case, the legitimate interest of Hessnery as the data controller is the legal basis for the processing of personal data. Hessnery’s legitimate interest is to defend their rights in the way Hessnery sees fit. 
6. Hessnery also processes personal data for the performance of obligations arising from the legislation in force in the Republic of Estonia (purpose established in clause 3.1(f)). In this case, the legal basis for the processing of personal data is the fulfilment of Hessnery’s legal obligations as the data controller and/or accommodation establishment. 

Transfer of personal data to third parties

1. Hessnery shall not transfer the personal data of the Data Subject to third parties, except for: 
2. to the service partners who provide cloud server services, where personal data is stored and processed (e.g., Elkdata OÜ, founded in Estonia; and Microsoft Corporation, founded in the USA); 
3. to the service partners who provide software development services by processing personal data transmitted through the Hessnery Booking System (e.g., LaFamilia OÜ, founded in Estonia; Bonefarm OÜ, founded in Estonia); 
4. to the service partners who manage and store the contracts concluded and transferred between Hessnery and the Data Subject, thereby processing the personal data contained in the contracts (e.g., Moderan Solutions OÜ, founded in EstoniaXXXX; Saago Tech OÜ, founded in Estonia);  
5. to the service partners who are responsible for the functioning of the security systems and user rights of the Hessnery building, while processing personal data that is necessary for the functioning of the respective system (e.g., Viking Security AS, founded in Estonia);  
6. to the service partners who are responsible for the operation of doors and access systems and user rights of the Hessnery building, while processing personal data that is necessary for the functioning of the respective system (e.g., Valnes AS, founded in Estonia);  
7. to the service partners who provide email server services (e.g., Microsoft Corporation, founded in the United States);    
8. to the service partners who automatically create and forward invoices on behalf of Hessnery by processing personal data contained in invoices (e.g., Excellent Business Solutions Eesti AS, founded in Estonia);  
9. to the service partners who provide a financial security service by processing the personal data of the Data Subject upon making a deposit (e.g., RendIn OÜ, founded in Estonia); 
10. to the service partners who provide collection services by processing personal data for debt collection (the service partner will be identified when the service is used – no personal data will be transferred until then);  
11. to the service partners who provide Hessnery with the service of making electronic payments (e.g., Swedbank AS, founded in Estonia); 
12. to the service partners who provide the service of depositing the User’s assets, if necessary according to the situation (e.g., Minilaod OÜ, founded in Estonia; Adduco OÜ, founded in Estonia). 
13. All processors referred to in clause 5.1 shall ensure the protection of personal data as stipulated by the legislation governing the protection of personal data. When you transfer personal data outside the European Economic Area (e.g., Microsoft Corporation, a company founded in the U.S.), appropriate safeguards are in place that are consistent with the data protection requirements of the European Union. 
14. Hessnery is also entitled to disclose the Data Subject’s personal data to an authority which, pursuant to the legislation in force in the Republic of Estonia, has the right to require Hessnery to disclose the personal data it processes and if Hessnery is obliged to disclose the personal data to such authority. 

Storage of personal data

1. Hessnery processes and stores personal data only for as long as it is necessary to fulfil the purpose of the processing – once the purpose has been fulfilled, the personal data will be deleted or rendered anonymous. 
2. Hessnery processes and stores personal data as follows: 
3. up to 30 days after the end of the provision of Accommodation Services, if the personal data are processed for the purpose of providing the Accommodation Services (purpose established in clause 3.1(a));  
4. up to 30 days after the last contact with the Data Subject to the extent that Hessnery retains the personal data of the Data Subject in connection with taking measures prior to entering into a contract in accordance with the Data Subject’s request (purpose established in clause 3.1(b)); 
5. up to 1 year after the end of the provision of the Accommodation Service or until the unsubscribing from processing (whichever comes first) to the extent that Hessnery processes personal data for the purpose of sending news, special offers and general information (purpose established in clause 3.1(c)); 
6. up to 30 days after the end of the provision of Accommodation Services, if the personal data are processed for the purpose of updating the Accommodation Services (purpose established in clause 3.1(d)); 
7. up to 3 years after the end of the provision of the Accommodation Services or until the limitation period of the respective right of claim (the limitation period for legal claims is generally 10 years), where Hessnery processes personal data for the purpose of exercising and protecting Hessnery’s rights (purpose established in clause 3.1(e)); 
8. up to 3 years after the end of the provision of the Accommodation Services (or another term provided by law), where Hessnery processes personal data for the performance of a legal obligation (purpose established in clause 3.1(f)). 
9. As a general rule, security camera recordings are stored for up to 2 months, except for in a situation where Hessnery processes security camera recordings as necessary for the purpose of exercising and protecting Hessnery’s rights (purpose established in clause 3.1(e)) or for fulfilling a legal obligation (purpose established in clause 3.1(f)), in which case the security camera recordings are stored until the need ceases to exist. 
10. The personal data that Hessnery collects and processes as an accommodation establishment pursuant to TourA will be stored in accordance with the law for up to 2 years from the date of registration of such data. 
11. The personal data contained in the underlying accounting documents shall be retained by Hessnery for 7 years from the end of the financial year to which they relate. 

Rights of data subject

1. The Data Subject has the right to address Hessnery at any time with a corresponding simple written and free-form request to the e-mail address info@hessnery.ee, in order to: 
2. request access to the personal data concerning the Data Subject; 
3. request the rectification of personal data; 
4. request the deletion of personal data; 
5. restrict the processing of personal data; 
6. object to the processing of personal data; 
7. request the transfer of personal data; 
8. request that no decision based on automated processing is taken in relation to the Data Subject, if any; 
9. withdraw consent to the processing of personal data, if given; 
10. submit a complaint to a supervisory authority (Data Protection Inspectorate, for more information, see: https://www.aki.ee/en; or contact: info@aki.ee).