KOGUTEENUSED.EE Privacy Policy
Valav OÜ protects the privacy of the users and visitors of KOGUTEENUSED.EE (https://koguteenused.ee). This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it and what rights you have. We process personal data under the EU General Data Protection Regulation (GDPR) and Estonian law.
1. Who we are
The controller of your personal data is:
- Valav OÜ, registry code 14741935
- Address: Kalda 9a, 11625 Tallinn, Estonia
- Email: klienditugi@koguteenused.ee
Write to this address with any question about your data or this policy.
2. What data we collect
Account data. When you register: your name, username, email address, password and, if you give it, your Estonian personal identification code. If you register with Smart-ID, Mobiil-ID or an ID card, we receive your name and personal identification code from the authentication service. Company accounts also give the company name, registry code, VAT number and address. You can add a phone number in your profile. When you register, we also record when you accepted the User Agreement and which version of this Privacy Policy you were shown.
Ads and profile. The texts, photos, locations and contact details of your ads and requests, and your profile, CV and portfolio.
Messages and ratings. Messages you exchange with other users through the portal, and the ratings and reviews you give and receive.
Payments. Your orders, paid plans, e-wallet balance and transactions, and the invoices we issue. Card and bank details are entered on the payment provider's page, not on KOGUTEENUSED.EE, and we don't receive them.
Form submissions. What you send through the contact form (name, email address, topic and message) or the advertising inquiry form (name, email address, company, phone number and message).
Technical data. Your IP address, browser and device type, the pages you open and the time of your visit. These are recorded in our server logs and, depending on your cookie choices, by the services described in sections 6 and 9.
Cookie choices. Which cookie categories you allowed or refused, and when.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Creating and running your account, publishing your ads, delivering messages, ratings and notifications | Contract (b) |
| Paid plans, e-wallet, payments, refunds and invoices | Contract (b) |
| Keeping accounting records | Legal obligation (c), Estonian Accounting Act |
| Answering your contact and advertising inquiries | Legitimate interest (f): replying to people who contact us |
| Securing the portal, preventing spam and fraud, enforcing the User Agreement (see section 4) | Legitimate interest (f): a safe and trustworthy portal |
| Error monitoring and server logs | Legitimate interest (f): keeping the portal working |
| Responding to authorities and courts, and defending legal claims | Legal obligation (c) or legitimate interest (f) |
| Visitor statistics (Google Analytics) | Consent (a) |
| Measuring our advertising (Google Ads, Meta Pixel) | Consent (a) |
You don't have to give us your data, but without the account data we can't create an account for you, and without a message we can't answer your inquiry.
Where we rely on legitimate interest, you can object at any time (see section 12).
4. Automatic spam checks and account blocking
To protect users from spam, the portal automatically checks the messages that users send to ad authors. If an account sends the same message to many different ads within a month, or to ads in unrelated categories, the account is blocked automatically, and both the user and our administrators are notified by email.
If your account was blocked and you think it was a mistake, write to klienditugi@koguteenused.ee. An administrator will review the decision. You have the right to have the decision reviewed by a person and to state your point of view.
Administrators can also block an account, and can add the personal identification code of an account that seriously breached the User Agreement to a list that prevents it from registering again.
5. What other people can see
Your ads, profile, CV, portfolio and the ratings and reviews you receive are public on KOGUTEENUSED.EE. For each ad, you choose whether your email address and phone number are shown to everyone, only to registered users, or to no one. Your personal identification code is never shown to other users.
6. Who we share your data with
We don't sell your personal data. We share it only with the following service providers, to the extent needed for the purposes above:
- Hosting: our servers are in the European Union. Emails from KOGUTEENUSED.EE are sent from our own server.
- SK ID Solutions AS (Estonia): Smart-ID and Mobiil-ID authentication.
- Paysera LT, UAB (Lithuania): payment processing. Paysera processes the payment data as an independent controller under its own privacy policy.
- Pusher Ltd (United Kingdom; the service runs in the EU): real-time delivery of notifications and messages.
- SmartBear Software (Bugsnag) (USA): error monitoring. Error reports contain technical data about the error and the request.
- Maa- ja Ruumiamet (Estonian Land and Spatial Development Board): the address search and maps on ad pages are loaded from its In-ADS service, which receives your IP address.
- Google LLC:
- Google Analytics and Google Ads (see section 9);
- reCAPTCHA on the registration, contact and advertising forms, which checks that the form is filled in by a person and not by a bot, using information about your device and browser;
- Google Fonts, which our pages load from Google's servers;
- the Google Maps map on the contact page;
- YouTube videos on the home page, embedded in privacy-enhanced mode (youtube-nocookie.com).
Fonts, maps, videos and reCAPTCHA are loaded from Google's servers, so Google receives your IP address and browser data.
- Meta Platforms Ireland Limited: the Meta (Facebook) Pixel, only if you allow advertising cookies.
We may also disclose personal data to authorities, courts or law enforcement when the law requires it, or when it is needed to establish, exercise or defend legal claims.
7. Transfers outside the European Union
Google, Meta and SmartBear can process data in the United States. These transfers are based on the European Commission's adequacy decision for the EU–US Data Privacy Framework, in which these companies participate. Pusher is based in the United Kingdom, which also has an adequacy decision.
8. How long we keep your data
- Account data, ads, messages and ratings are kept for as long as your account exists. When you ask us to delete your account (see section 12), we delete them.
- Accounting records, such as invoices and payment records, are kept for 7 years from the end of the financial year, as required by the Estonian Accounting Act, even after your account is deleted.
- Blocking records: if an account was blocked for a serious breach of the User Agreement, we may keep its personal identification code on the block list to prevent repeated abuse.
- Cookies are kept for the periods given in section 9.
9. Cookies and similar technologies
Cookies are small text files that a website stores in your browser. Necessary cookies are always used. Analytics and advertising cookies are used only if you allow them. When you first visit, a banner asks for your choice. You can change it at any time with the "Cookie settings" link at the bottom of every page.
| Cookie | Category | Purpose | Expires |
|---|---|---|---|
| koguteenused_session | Necessary | KOGUTEENUSED.EE: keeps you logged in | 7 days |
| XSRF-TOKEN | Necessary | KOGUTEENUSED.EE: form security | 7 days |
| cc_cookie | Necessary | KOGUTEENUSED.EE: remembers your cookie choice | 6 months |
| _ga, _ga_* | Analytics | Google Analytics: visit statistics | 2 years |
| _fbp | Advertising | Meta (Facebook): measuring our ads | 3 months |
| _gcl_au | Advertising | Google Ads: measuring our ads | 3 months |
Google Analytics and Google Ads. Google Analytics and Google Ads set their cookies only if you allow analytics or advertising cookies. Google signals are switched off. Google Analytics doesn't store IP addresses.
Meta Pixel. The Meta Pixel is loaded only if you allow advertising cookies. It tells Meta that you visited KOGUTEENUSED.EE, so we can measure and improve our ads on Facebook and Instagram.
Services loaded from other sites (reCAPTCHA, Google Maps, YouTube, In-ADS) may also store data in your browser under their own policies.
You can also delete or block cookies in your browser settings, but the portal may then not work properly, for example you won't be able to log in.
10. IP address and server logs
When you open KOGUTEENUSED.EE, your browser sends us your IP address and basic information about your browser and device. This is technically necessary to deliver the pages to you. Our server records these requests in log files, which we use to keep the portal working and secure, for example to investigate errors and to detect attacks and abuse.
11. How we protect your data
We store your data on servers in the European Union and use technical and organisational measures to protect it against loss, misuse and unauthorised access. Connections to the portal are encrypted (HTTPS), passwords are stored only in hashed form, and only authorised administrators have access to user data. No method of storing or transmitting data over the internet is completely secure, so we can't guarantee absolute security.
12. Your rights
You have the right to:
- get a copy of your personal data and information on how we process it;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we process your data;
- receive the data you gave us in a machine-readable format (data portability);
- object to processing based on legitimate interest;
- withdraw your consent at any time with the "Cookie settings" link. Withdrawal doesn't affect processing that took place before it.
Deleting your account. Send a request from your account's email address to klienditugi@koguteenused.ee. We delete the account and its data, except the records we must keep by law (section 8).
We answer requests within one month. We may ask you to confirm your identity before we answer.
If you think we process your data unlawfully, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee), or to the supervisory authority of the EU country where you live. We'd appreciate it if you contacted us first, so we can try to solve the problem.
13. Links to other websites
KOGUTEENUSED.EE contains links to other websites, including in users' ads. We're not responsible for the privacy practices of those websites.
14. Changes to this policy
We may update this Privacy Policy by publishing a new version on this page. Please check this page from time to time to stay informed of any changes.