PRIVACY

Your data

This page is a translation from Estonian. The original is the Estonian version.

We use your data only to respond to your request and booking request and to draw up a transaction if we get that far.

Controller

Väärtus Ekspert OÜ, registry code 17442156, Jõe tänav 2a, Tallinn, info@vaartusekspert.ee.

What data we collect, why and on what basis

Valuation request

We store the item details, the description of the item, photos and your email or phone number and contact preference. We use them to review the item, contact you and give a valuation or offer. Only our staff who respond to the request can see them. We keep the photos in a private file storage.

Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) of the General Data Protection Regulation).

Booking an item

We store your name, email, phone number, preferred visiting time, note and the selected items. We use them to contact you and confirm the booking. We do not ask for payment or invoicing details online: the purchase and payment take place at the boutique.

Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b)).

Contact form

We store your name, email, phone number (if you add it) and message. We use them to reply to your message.

Legal basis: our legitimate interest in replying to your enquiry (Article 6(1)(f)).

Without your name and email or phone number, we cannot respond to your request, booking request or message. Other fields are optional.

Confirmation emails and staff notifications

After a request, booking request or message, we send an automatic confirmation to your email address. It contains only your name and the category of the request or the booked items, not the text you wrote. The notification sent to our staff contains only a reference and a link to the protected administration view. When we reply to you, we send the email to the same address.

Our staff may also receive a notification about a new request, booking request or message on their phone or computer. It contains only the type and number of the event, for example “New request P-0042”, not your name, contact details or item details. The notification is sent encrypted via the push service of the staff member's browser vendor (Apple, Google, Mozilla or Microsoft). The notification settings of the staff member's device are deleted when they turn notifications off, log out or their access is ended.

Legal basis: the same as for the request, booking request or message the email relates to.

If we buy an item from you

In the case of a transaction, we draw up a purchase and sale agreement. Transaction documents (purchase and sale agreement, invoice) may contain personal data, including the details of an identity document.

Legal basis: our legal obligation (Article 6(1)(c)): the Accounting Act requires us to keep the documents for 7 years.

Service providers

We use reliable service providers (web hosting, email and email delivery) who process data only according to our instructions. The data is located mainly in the European Union. If a service provider processes data outside the European Union, this is done on the basis of appropriate safeguards, for example the European Commission's standard contractual clauses.

Page visits, cookies and browser storage

To keep the website secure and investigate errors, the server stores a technical log of visits: the time, the address of the page opened, the response status, the domain of the referring site and the browser type. We keep the IP address only in shortened form, so that it does not identify a specific device. Form content, cookies and login data are not written to the log. The log is deleted automatically after 7 days.

Legal basis: our legitimate interest in ensuring the security and functioning of the website (Article 6(1)(f)).

Visit statistics. We count page visits ourselves, without cookies, browser storage or external services. For each page view we store the time, the page address (without the query part), where you came from (for example a search engine, directly or a campaign link tag), the device type and the browser family. To tell apart visitors on the same day, we use an anonymous identifier calculated from the IP address, the browser and a random daily key. The key is kept only during the same day, is deleted the following day and is not stored in backups. This means that on the following day the identifier can no longer be linked to you. We do not store the IP address itself. When a request, booking or message is sent, we count only their number together with the source of the visit, not their content.

Legal basis: our legitimate interest in knowing how the website is used and improving it (Article 6(1)(f)).

We use cookies that are necessary for the secure functioning of the forms and for staff login. Fonts and images are loaded from this website's own server. Google Ads cookies are used only with your consent (see below).

Measuring Google Ads advertising. If you click “Accept” in the cookie banner, the page loads the Google Ads tag (provider Google Ireland Limited). The tag stores Google cookies in your browser (for example _gcl_au, for up to 90 days) and sends Google the address of the page you opened, the ad click identifier, technical browser data and your IP address. When you send an enquiry or a contact message, we only tell Google that an enquiry or message was sent. Your name, contact details, item description, photos and message are not sent to Google. This lets us see whether our ads bring enquiries. We do not allow ad personalisation. Google may also process the data outside the European Union (under the EU–US Data Privacy Framework). If you click “Decline”, the Google tag is not loaded and nothing is sent to Google. Your choice is remembered for 6 months in the cookie ve-consent. You can withdraw your consent at any time using the “Cookie settings” link in the footer; we then also delete the Google cookies from this website's address.

Legal basis: your consent (Article 6(1)(a)). Withdrawing consent does not affect processing carried out before the withdrawal.

The selection of items added to a booking is kept in your browser's local storage (name ve-shop-cart-v1) so that it is preserved as you move between pages. Only the identifiers of the selected items are stored there, not your name or contact details. The selection is cleared when the booking request has been sent or when you remove the items; otherwise it remains in the browser until you delete your browser data.

If you choose a language in the page header, the chosen language is stored in your browser's local storage (name ve-lang) so that we can offer the page in the same language next time. No other data is stored there; you can remove the choice by deleting your browser data.

Form entries and photos are not stored permanently in your browser. Refreshing or closing the page removes them from the open form.

How long we keep data

• Requests, bookings and contact messages that did not lead to a transaction: personal data and photos are removed automatically after 12 months. Only a record without personal data is kept for statistics.
• Draft purchase records that did not lead to a transaction: the seller's data, documents and photos are removed automatically after 12 months.
• Purchase and sale agreements and other transaction documents: 7 years from the end of the financial year (Accounting Act). After that, we review them.
• Internal messages from our staff to the website developer, including screenshots: deleted automatically 12 months after the message is closed. Customer data is not added to them.
• Technical log of visits: 7 days.
• Individual page views in the visit statistics: 30 days. After that, only daily totals without personal data remain.
• Encrypted backups: 30 days. Deleted data disappears from the backups within this time.

Your rights

You have the right to:

• access the data we hold about you;
• have incorrect data corrected;
• have your data deleted if the law does not oblige us to keep it;
• request restriction of processing;
• object to processing based on our legitimate interest (contact messages and the visit log);
• receive the data you have provided in a machine-readable form or have it transferred, if the processing is based on pre-contractual steps or a contract;
• lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee).

To exercise your rights, write to info@vaartusekspert.ee. If necessary, we will ask you to confirm your identity before disclosing any data.

The booking principles are on the Terms page.