Emmaste Teemaja Cafe
ESTENGFIN

Privacy Policy

Last updated: 26.04.2026

This privacy policy explains how Sailing Estonia OÜ (hereinafter Emmaste Teemaja or we) processes personal data when you use the website emmasteteemaja.ee, request a quote, book a catered event, order food for your summer house, or otherwise communicate with us.

1. Data controller

Sailing Estonia OÜ
Emmaste village, 92017, Hiiumaa, Estonia
Email: info@housecatering.ee
Phone: +372 53 423 957

2. What personal data we collect

  • Quote and booking data: name, email address, phone number, event date, location, guest count, menu preferences, budget and any free-text information you submit through the quote form.
  • Communication data: emails, messages and call history arising from contact with us.
  • Online shop interest data: the product you have expressed interest in and your contact info, so that we can reach out when the product becomes available.
  • Technical and usage data: browser type, device type, screen size, referrer, pages visited, buttons clicked, form steps completed, timestamps. Used to improve the site and produce aggregate statistics.
  • Advertising attribution: campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and click identifiers gclid (Google Ads) and fbclid (Meta) when you arrive via an ad. Stored on first touch in a first-party cookie and browser storage so we can attribute a later quote request to the correct campaign.
  • Cookies and third-party technologies: see section 6.

We do not persistently store your full IP address in any of our databases.

3. Purposes and legal bases

PurposeLegal basis
Producing quotes, confirming bookings, entering into and performing the catering contract.Performance of a contract / pre-contractual steps (GDPR art. 6(1)(b)).
Customer communication, answering questions, booking reminders.Contract performance (art. 6(1)(b)) or legitimate interest (art. 6(1)(f)).
Improving the website, usage statistics, error monitoring, A/B testing.Legitimate interest (art. 6(1)(f)).
Measuring advertising performance and conversion reporting (Google Ads, Meta).Legitimate interest (art. 6(1)(f)) and, where required, consent (art. 6(1)(a)).
Direct marketing to existing customers.Legitimate interest within an existing customer relationship (Estonian Electronic Communications Act § 103(3)) or separate consent (art. 6(1)(a)).
Accounting and tax compliance.Legal obligation (art. 6(1)(c)) — Estonian Accounting Act.
Fraud and abuse prevention.Legitimate interest (art. 6(1)(f)).

4. Who we share data with (processors)

We do not sell your data. We share data with trusted service providers only to the extent necessary to deliver the service. Each of them is bound by a data processing agreement (DPA):

  • Vercel Inc. (USA / EU) — website and serverless function hosting; Vercel Analytics, Speed Insights.
  • Neon Inc. (USA / EU) — managed Postgres database hosted in an EU region.
  • Resend, Inc. (USA) — transactional email delivery (quotes, confirmations, reminders).
  • Anthropic, PBC (USA) — Claude language model used to draft quotes and replies. Traffic is routed through Vercel AI Gateway with zero data retention so Anthropic does not retain our prompts for training.
  • OpenAI, L.L.C. (USA) — embedding and lightweight classification models used by our knowledge-base search; also routed through Vercel AI Gateway.
  • Google LLC (USA) — Google Tag Manager and Google Ads conversion measurement.
  • Meta Platforms, Inc. (USA) — Meta Pixel and Conversions API. If you arrive from a Facebook or Instagram ad we share event-level signals (e.g. form opened, quote requested) so we can measure ad performance. We do not share free-text quote descriptions or menu preferences.
  • Hetzner Online GmbH (Germany) — hosting of our n8n workflow server that runs quote and reminder workflows.
  • Merit Tarkvara AS (Estonia) — accounting in Merit Aktiva.
  • Compucash AS (Estonia) — point-of-sale system where some on-site transactions are recorded.

Where data is transferred outside the European Economic Area (e.g. to the USA), we rely on the European Commission's Standard Contractual Clauses (SCC) or an equivalent safeguard.

5. Data retention

  • Quote requests that do not result in a booking: up to 24 months for follow-up, then deleted or anonymised.
  • Booking and customer data: 7 years from the end of the transaction, as required by the Estonian Accounting Act.
  • Site event logs (site_events): up to 24 months for analytics and product improvement.
  • Advertising attribution: browser storage and cookie for up to 90 days.
  • Email correspondence: up to 36 months or until you ask us to delete it.

6. Cookies and similar technologies

  • Strictly necessary cookies — language preference, form state, security. No consent required.
  • Attribution storage (e.g. tt_attr) — stores UTM, gclid and fbclid parameters from the first visit for 90 days, so a later quote request can be linked to the correct ad.
  • Analytics — Vercel Analytics and Speed Insights, which use anonymised aggregates, plus our own first-party event log.
  • Advertising — Google Tag Manager, Google Ads and Meta Pixel. Meta Pixel only loads if NEXT_PUBLIC_META_PIXEL_ID is configured.

You can disable or clear cookies in your browser. Blocking third-party cookies may break advertising attribution.

7. Your rights

  • Right of access — confirm whether we process your data and obtain a copy.
  • Right to rectification — correct inaccurate data.
  • Right to erasure(“right to be forgotten”) — unless we have another legal ground to retain it.
  • Right to restrict processing.
  • Right to data portability.
  • Right to object to processing based on legitimate interest.
  • Right to withdraw consent, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise these rights, write to info@housecatering.ee. We respond within 30 days.

8. Lodging a complaint

If you believe we have processed your data unlawfully, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate:

Andmekaitse Inspektsioon
Tatari 39, 10134 Tallinn, Estonia
Email: info@aki.ee
Web: www.aki.ee

9. Automated decisions and profiling

We do not make automated decisions producing legal effects on you. We do use language models (Claude, GPT) to classify inputs and draft quote replies, but a human always reviews the final reply before it is sent.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or on the website. The current version date is shown at the top.