Legal information
Privacy policy
This policy explains how Spaade Pakkumised OÜ ("Stay at Spa") collects and uses your personal data when you search for accommodation, create an account, and make or manage a booking on this website.
Data controller and contact
The data controller is Spaade Pakkumised OÜ (registry code 16392545), Hariduse tn 11-10, Kesklinna linnaosa, 10119 Tallinn, Harju maakond, Estonia. For any question about this policy or your personal data, contact us at info@stayatspa.com.
Personal data we collect and why
We collect only the data needed to run the booking service: Account data — when you create an account we process your email address and login credentials through our authentication provider, to create and secure your account. Booking and guest data — to process a reservation we collect the lead guest's first and last name, email address, phone number, country, any special requests, and the details of the stay (property, dates, room, rate and price). Payment data — card and bank details are entered directly with our payment service provider and processed by them; we receive only the payment result and a reference, not your full card number. Communications — messages you send us and the booking emails we send you, including confirmations and, if you cancel, a one-time verification code. Technical data — limited information needed to operate the site securely; see our Cookie policy for details. We process this data to perform your booking and account contract, to meet legal obligations such as accounting, and for our legitimate interest in keeping the service secure and preventing fraud. Where the law requires consent, such as for non-essential cookies, we rely on your consent.
Who we share data with and international transfers
To fulfil a reservation we share the booking and guest details needed for your stay with the accommodation provider (the property) and with the third-party partner through which that accommodation is made available to us. We also use service providers that process data on our behalf and only on our instructions: cloud hosting and database providers, our payment service provider, and an email delivery provider. Many properties are located outside the European Economic Area. When you book such a property, the details needed for that stay are transferred to the property, and to our supply partner, in the relevant country so the reservation can be completed. Where required, such transfers rely on appropriate safeguards or on the transfer being necessary to perform your booking. We do not sell your personal data.
How long we keep data and your rights
We keep booking and transaction records for as long as needed to provide the service and to meet legal obligations — for example, Estonian accounting law requires records of business transactions to be kept for seven years. Account data is kept until you delete your account or ask us to remove it, unless part of it must be retained by law. Under the GDPR you have the right to access your data and to request its correction, deletion, restriction or portability, to object to certain processing, and to withdraw consent where processing relies on it. To exercise these rights, email info@stayatspa.com. You can also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the supervisory authority where you live.
Cookies and updates to this policy
We use cookies and similar technologies to operate the site and, with your consent, for optional purposes; our Cookie policy explains these and how to manage them. We may update this policy as the service or the law changes. The version published on this page is always the current one.
Questions about this policy or a booking can be sent to info@stayatspa.com