Privacy Policy

01Who we are

The data controller is HOTBURO OÜ (registry code 17256169, Tallinn, Lasnamäe linnaosa, Tuulemäe tn 5). We are a design and development studio. In this policy “we” means Hotburo and “you” means a site visitor or client.

For any data question, write to hello@hotburo.com.

02What we collect

• Contact form data: name, company, email, phone, project description, estimated budget and page language.
• Correspondence: anything you send us by email or messengers (Telegram), including files.
• Technical data: IP address, browser and device type, request time — logged automatically by our hosting servers for security and reliability.
• Analytics data (only with your consent in the cookie banner): pages viewed, clicks, device type, approximate location — via Google Analytics 4 with IP anonymisation.
• Client data under a contract: representatives’ contacts, company details and information needed to deliver the work and invoice.

03Why we use it

We don’t use your data for automated decision-making or profiling, and we don’t send newsletters without separate consent.

• To reply to your request and prepare an estimate or proposal — steps at your request before entering a contract (Art. 6(1)(b) GDPR).
• To deliver the contract and run the project — performance of a contract (Art. 6(1)(b)).
• To keep accounting records and meet tax obligations — legal obligation (Art. 6(1)(c)).
• To protect the site from abuse and spam — our legitimate interest (Art. 6(1)(f)).

04Who we share it with

We never sell or rent data. Access is limited to team members working on your request and to providers we can’t work without: hosting and infrastructure (Vercel, Neon), analytics (Google Analytics — with consent), email, messengers and accounting services. They process data on our instructions.

If data is transferred outside the EU/EEA, we rely on European Commission adequacy decisions or Standard Contractual Clauses (SCCs).

We may disclose data where the law or a public authority requires it.

05How long we keep it

After that, data is deleted or anonymised.

• Enquiries that didn’t turn into a project — up to 24 months after the last contact.
• Contract documents and invoices — as long as Estonian law requires (usually 7 years).
• Server logs — usually up to 30 days.

06Your rights

Under the GDPR you have the right to:

• know what data we hold about you and get a copy;
• correct inaccurate data;
• have data deleted when we no longer have a reason to keep it;
• restrict or object to processing;
• receive your data in a machine-readable format (portability);
• withdraw consent where processing is based on it.

07How to exercise them

Write to hello@hotburo.com — we reply within 30 days. If you believe we are breaching your rights, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data protection authority in your country.

08Security

We use encrypted connections (HTTPS), limit access to the admin panel and data to people who need it, and keep our software up to date. No method of transmission over the internet is completely secure, but we do everything reasonably possible.

09Children

The site and our services are aimed at businesses. We don’t knowingly collect data from people under 16.

10Changes

We may update this policy. The current version is always on this page, with the date at the top.