Privacy Policy

Data controller

The controller of your personal data is BMMajand OÜ (registry code 11496274), registered address Sae tee 12, Soinaste küla, Kambja vald, 61709 Tartumaa, Estonia. We operate the direct-booking site ojasaarevilla.ee and the Ojasaarõ luxury spa villa. For any privacy matter, write to tere@ojasaarevilla.ee.

What data we collect

When you book: your name, email, phone number, chosen dates, number of guests, and anything you include in your message. Payment is handled on our behalf by Montonio (see below) — we never see or store your card or bank details.

When you buy a gift card: the buyer’s email and, if you choose, the recipient’s name, recipient’s email, and your personal message.

When you contact us: whatever you share by email, form, or WhatsApp (name, contact details, the substance of your enquiry).

When you use the site: technical logs (IP address, browser type) and data collected via cookies — only to the extent you consent (see “Cookies”).

Why we use it, and the legal basis

To fulfil your booking or gift card and to communicate with you — performance of a contract (GDPR Art. 6(1)(b)).

To meet accounting and tax obligations (invoices) — legal obligation (Art. 6(1)(c)).

To keep the site secure and working and — with your consent — for analytics and marketing — legitimate interest or consent (Art. 6(1)(f) and (a)).

Processors we share data with

We do not sell your data. We share it only with trusted providers acting on our behalf:

Montonio Finance — payment service (bank links, card payments). Payment takes place on Montonio’s secure page.

Email and hosting providers — to send booking confirmations and gift cards and to host the site.

Where required, our accountant and public authorities to the extent the law requires.

Email and WhatsApp communication

We use your email to send booking confirmations, gift-card codes, and arrival information. If you reach us on WhatsApp, we process that conversation to answer your enquiry. We send marketing emails only with your consent, and every such email has a one-click unsubscribe.

Cookies and analytics

Cookies necessary for the site to work are always loaded. Analytics and marketing cookies (e.g. Google Analytics, Google Tag Manager, Meta) are loaded only after your consent on the cookie banner. You can change or withdraw your choice at any time. Details are on the cookie banner.

How long we keep data

Booking and gift-card data: for as long as needed to provide the service and to handle warranty/disputes.

Accounting documents: 7 years, as required by Estonian accounting law.

Consent-based data (marketing, analytics): until you withdraw consent.

Your rights

You have the right to access, rectify, or erase your data, to restrict or object to processing, to data portability, and to withdraw consent. Contact us at tere@ojasaarevilla.ee. If you believe we are infringing your rights, you may complain to the Estonian Data Protection Inspectorate (aki.ee).