Privacy Notice

1. Data controller

osaühing Raiesmaa (Estonian registry code 10967453), registered address Staadioni tn 1, Häädemeeste alevik, Häädemeeste vald, Pärnu maakond, 86001, Estonia. Rannakodu location: Penu village, Häädemeeste municipality, Pärnu County 86014, Estonia. Contact: rannakodu@gmail.com, +372 5649 2074.

2. Personal data we process

We process information you give us through the website booking enquiry form, direct email correspondence or telephone conversations. Calls are not recorded; we may make written notes needed to handle the enquiry. The web server and security tools may also process technical data.

• name, email address, phone number and, if provided, company name;
• arrival and departure dates, numbers of adults and children, and children’s ages;
• selected accommodation or enquiry type, additional services and special requests;
• free-text information and the content of customer communication by form, email or telephone;
• the status, time, source, language, text version and withdrawal time of an optional newsletter consent;
• technical data such as IP address, browser user agent, request time and page visited where recorded in server, security or analytics logs.

3. Purposes of processing

We use personal data only for defined purposes.

• responding to the enquiry, checking availability and preparing a possible booking;
• arranging accommodation, catering, sauna and other requested services;
• customer communication and documenting agreements;
• sending newsletters and special offers only where the person has given separate voluntary consent;
• protecting the website, form and email systems, preventing misuse and resolving technical faults;
• meeting legal obligations if the enquiry results in a booking or transaction.

4. Legal bases

We process accommodation and service enquiries to take steps at your request before entering into a contract (GDPR Article 6(1)(b)). We rely on legitimate interests for security, preventing misuse and managing possible legal claims (Article 6(1)(f)), and on Article 6(1)(c) where processing is required by law.

Newsletters and special offers are sent only on the basis of separate voluntary consent (Article 6(1)(a)). The box is unchecked by default, the enquiry can be submitted without it, and acknowledging this Privacy Notice is not marketing consent. Withdrawal does not affect processing that was lawful before the withdrawal.

5. Retention

We retain personal data only for as long as it is needed for the purpose described below or to meet a legal obligation.

• WordPress booking enquiries: WordPress does not retain the booking enquiry payload as a persistent post, post metadata, custom-table row, option, session or debug-log entry. The form validates the data and hands the enquiry to Rannakodu by email. Only short-lived technical hashes and counters that do not expose readable enquiry content are used for abuse and duplicate prevention.
• Gmail correspondence: the enquiry and subsequent correspondence are kept in Rannakodu’s mailbox only for as long as needed to answer the enquiry, arrange a possible booking, document agreements or manage legal claims. Closed or unsuccessful enquiries are removed under Rannakodu’s internal retention and deletion procedure.
• Server logs: the plugin does not write enquiry payloads to WordPress logs. The hosting provider may process technical server and security logs to operate and protect the service and resolve faults.
• Backups: because no new WordPress enquiry record is created, a new enquiry payload is not added to the WordPress database as a separately backed-up record. Separate marketing-consent evidence may remain in a WordPress database backup until that backup is routinely replaced or deleted.
• Marketing-consent evidence: the separate record contains only the email address, active or withdrawn status, consent and withdrawal times, source, language, consent-text version and a one-way hash of the active unsubscribe token. Withdrawal immediately makes consent inactive and removes the token hash. Evidence is deleted when it is no longer needed to demonstrate consent or its withdrawal.
• Confirmed bookings and transactions: related contractual and accounting information is retained separately for the periods required by applicable law.

6. Recipients and service providers

Access is limited to authorised people handling Rannakodu enquiries and bookings, and to providers only to the extent necessary to deliver their services.

• the hosting and server-management provider (Elkdata infrastructure);
• email providers, including Google when messages are processed in Rannakodu’s Gmail mailbox;
• technical WordPress and WPML components;
• Google Fonts and, at the visitor’s choice, Google Maps as described in section 7.

7. Cookies and external services

The website uses technical features required for operation and may store a language-preference or session cookie. The website’s Lato typeface is loaded from Google Fonts; this requires the visitor’s browser to connect to a Google server and transmit the IP address and technical browser information needed to serve the request.

Google Maps is loaded only when a visitor chooses to open the map on the contact page. No map-display request is sent to Google Maps before that choice. The contact details remain available without opening the map. Google’s terms and privacy policy apply when the map or the external Google Maps link is opened.

8. Transfers outside the European Economic Area

Some providers, including Google, may process personal data outside the European Economic Area. A transfer may rely on a European Commission adequacy decision, Standard Contractual Clauses or another safeguard permitted by GDPR Chapter V. General information about transfer tools is available from the European Commission.

9. Your rights and withdrawal of marketing consent

Depending on the legal basis and circumstances, you may have the right to information, access, rectification, erasure, restriction, objection, data portability and withdrawal of consent at any time.

When newsletter consent is recorded in live mode, the booking-enquiry acknowledgement includes a secure unsubscribe link. The link opens a separate confirmation step before withdrawal. You may also withdraw consent or make another request by emailing rannakodu@gmail.com. We normally respond within one month. You may also complain to the Estonian Data Protection Inspectorate (Tatari 39, 10134 Tallinn, Estonia; info@aki.ee).

10. Security and changes to this notice

We apply appropriate technical and organisational measures to reduce the risk of unauthorised access, alteration, disclosure or destruction, but no system is entirely risk-free. The booking form uses session checks, anti-spam controls, rate limiting and server-side validation. WordPress does not retain booking enquiry payloads; separate marketing-consent records are private, restricted to administrators and excluded from the public REST interface.

The mailbox is accessible only to authorised people and requires account authentication.

Please do not enter health data or other sensitive information in the free-text field. Describe only the practical requirement needed to arrange your stay.

We may update this Privacy Notice when our services, technical systems or legal requirements change. The current version and its last-updated date will be published on this page.