Privacy Policy

Who We Are

We operate a medieval banquet evening experience service in Tallinn Old Town, offering candlelit cellar dining and themed tours. We act as the data controller for all personal information collected through our website and booking system. Our commitment is to ensure that your data is processed fairly and securely in accordance with applicable data protection regulations.

Information We Collect

We collect various types of information depending on how you interact with us:

• Booking Information: When you reserve an experience, we collect your name, email address, phone number, date of visit, number of guests, and any dietary requirements or special requests.
• Contact Form Data: If you contact us through our website, we collect your name, email, and message content.
• Payment Information: We collect payment details necessary to process your reservation. Payment processing is handled by secure third-party payment providers.
• Website Usage Data: We collect information about how you use our website, including pages visited, time spent, and navigation patterns through cookies and analytics tools.
• Device Information: We automatically collect information about your device, including browser type, operating system, and IP address.

Legal Basis for Processing

We process your personal information on the following legal grounds:

• Consent: Where you have explicitly consented to our processing, such as subscribing to our newsletter or accepting cookies for analytics purposes.
• Contract Performance: Processing is necessary to fulfill your booking request and provide the services you have reserved.
• Legitimate Interest: We process data to improve our services, prevent fraud, and enhance website security and functionality.
• Legal Obligation: We may process data to comply with applicable laws, tax requirements, and legal requests from authorities.

How We Use Your Information

We use the information we collect for the following purposes:

• Processing and confirming your banquet reservations
• Sending booking confirmations, reminders, and updates
• Processing payments and handling refunds
• Responding to your inquiries and providing customer support
• Improving our website functionality and user experience
• Analyzing website traffic and user behavior through analytics
• Sending promotional communications (only with your consent)
• Preventing fraud and maintaining website security
• Complying with legal obligations and resolving disputes

Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy:

• Booking Information: Retained for up to 24 months after your experience date to handle follow-up communications, manage disputes, and maintain service records.
• Contact Form Messages: Retained for up to 24 months after the last interaction unless ongoing correspondence is required.
• Payment Records: Retained for up to 7 years to comply with tax and accounting regulations.
• Analytics and Cookie Data: Retained for up to 14 months and automatically deleted thereafter.
• Website Server Logs: Retained for up to 12 months for security and troubleshooting purposes.
• Newsletter Subscribers: Retained until you unsubscribe or request deletion.

Your Rights

You have the following rights regarding your personal information:

• Right of Access: You may request a copy of all personal information we hold about you.
• Right to Rectification: You can request that we correct or update any inaccurate information.
• Right to Erasure: You may request deletion of your personal data, subject to legal obligations we must fulfill.
• Right to Restrict Processing: You can request that we limit how we use your information in certain circumstances.
• Right to Data Portability: You may request your data in a structured, commonly used format.
• Right to Object: You can object to our processing of your data for marketing or analytics purposes.
• Right to Lodge a Complaint: You have the right to file a complaint with the Estonian Data Protection Authority (Andmekaitse Inspektsioon).

To exercise any of these rights, please contact us using the information provided in the Contact Us section below.

Cookies and Tracking Technologies

Our website uses cookies to enhance your browsing experience and gather analytics data. Cookies are small text files stored on your device that help us remember your preferences and understand how you use our site. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device).

We employ cookies for essential functionality, user preferences, security, and analytics. You can manage your cookie preferences through your browser settings. However, disabling cookies may affect some website features. For detailed information about our cookie usage, please refer to our separate Cookie Policy.

Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Our website uses SSL encryption to secure data transmission. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of any passwords or account information you create.

Third-Party Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following limited circumstances: with payment processors to complete transactions, with service providers who assist in website operation and maintenance under strict confidentiality agreements, and when required by law or to comply with legal requests from authorities. These third parties are bound by confidentiality obligations and are only permitted to use your data for specified purposes.

International Data Transfers

Our website and services are based in Estonia and operated within the European Economic Area (EEA). Your personal information is processed and stored within the EEA in compliance with GDPR requirements. We do not intentionally transfer your data outside the EEA unless required by law or with your explicit consent.

Children's Privacy

Our services are intended for adults and families. We do not knowingly collect personal information from children under 16 years of age. If we become aware that we have collected data from a child under 16 without proper parental consent, we will take immediate steps to delete such information. Parents or guardians who believe their child's information has been collected should contact us immediately.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of significant changes by posting the updated policy on our website and updating the "Last updated" date at the top of this page. Your continued use of our services following the posting of updated terms constitutes your acceptance of those changes. We encourage you to review this policy periodically to stay informed about how we protect your information.