PRIVACY POLICY
Nobody loves legal jargon, so we’ve kept this clear and short. The short version: we use your details to plan and run your tour, share them only with the services that help us do that, and never sell them. You stay in control, and the rights below show you how.
1. Who We Are
Tallinn InSight is the trading name of UnScripted OÜ (registry code 17021041), Sadama 2, Haapsalu 90502, Estonia. We run private tours in Estonia and decide how your data is used, which makes us the data controller.
Contact: connect@tallinninsight.com
2. What Information We Collect
When You Book a Tour:
-
Name and contact details (email, phone)
-
Payment information (processed securely by our payment provider)
-
Tour preferences and special requests
-
Health, mobility or dietary needs, only if you choose to share them
-
Details you give us about other guests in your group
-
Photos if we take any on the tour
When You Use Our Website:
-
Device info (browser, IP address, operating system)
-
Usage data (pages visited); statistics cookies only with your consent (see Section 7)
-
Cookies and similar technologies (see Section 7)
When You Contact Us:
-
What you send us by email, contact forms, WhatsApp, or by phone
We may also receive your details from your booking platform (Viator, GetYourGuide) or from the person who arranged your tour. Basic booking and contact details are needed to arrange your tour; everything else is optional. We never sell your data.
3. How We Use Your Information
-
To confirm and manage your booking
-
To communicate with you before, during and after your tour
-
To send you your photos from your tour if any were taken
-
To improve our website (statistics cookies only with your consent)
-
To work with hotels, agencies and other business partners (work contact details only)
-
To meet legal and accounting obligations
We don’t send promotional offers to tour guests, and we don’t make solely automated decisions that have legal or similarly significant effects on you.
4. Legal Bases for Processing
-
Contract: to handle your inquiry and your booking (GDPR Art. 6(1)(b))
-
Legal obligation: invoices and accounting (Art. 6(1)(c))
-
Legitimate interests: running the tour for everyone in your group, sending you photos, asking for a review, business contacts, website security and spam protection, and using IT and AI tools to run a small business efficiently (Art. 6(1)(f)). You can object to these at any time.
-
Consent: health, mobility or dietary details (your explicit consent, Art. 9(2)(a)), website statistics, and publishing any photo of you. You can withdraw consent at any time; this doesn’t affect what we did before.
5. Who We May Share Your Information With
-
Booking platforms (Viator, GetYourGuide), which handle your data under their own privacy policies
-
Payment and accounting: our payment provider, bank and accounting software
-
Our tour guides, only what your tour needs
-
IT service providers that help run our business (website, email, calendar, messaging, photo storage, document and AI tools); some handle data under their own privacy policies
-
Legal authorities, if required by law
We never share your data with advertisers or third-party marketers. If we’d ever like to publish a photo of you, we’ll ask first.
6. Your Privacy Rights
You have the right to:
-
Obtain a copy of your personal data
-
Correct inaccurate or incomplete data
-
Request deletion of your data under certain conditions
-
Restrict how we process your data
-
Receive your data in a portable format
-
Object to processing based on legitimate interests
-
Withdraw consent at any time
These rights apply subject to legal conditions. Contact us at connect@tallinninsight.com. We reply within one month, or up to two more months for complex requests (we’ll tell you), and may first check that the request comes from you. You can also complain to the Estonian Data Protection Inspectorate (www.aki.ee) or the data protection authority in your own EU country.
7. Cookies & Tracking
-
Essential: our website platform, spam protection for our forms, web fonts, and our consent tool (the banner lists each service)
-
Analytics: a web analytics service, only with your consent. If you deny, it sets no cookies.
-
Marketing: we don’t use advertising cookies.
Manage your choice in the cookie banner, or later with the fingerprint icon in the bottom-left corner. The banner’s settings list each service and how long it stores information.
8. How Long We Keep Your Data
-
Booking details and tour photos: 3 years after your tour, to handle questions and legal claims
-
Health, mobility or dietary details: 18 months after your tour
-
Inquiries that don’t become a booking: 18 months
-
Invoices and accounting records: 7 years from the end of the financial year, as Estonian law requires
-
Business contacts: 3 years after our last contact
-
Website statistics: user and event data are kept for 14 months; aggregated reports may be kept longer
-
Published photos: while in use, or until you withdraw your permission
We delete data at our yearly review once these periods have passed.
9. Data Security
We limit who can see your information and use access controls and secure connections.
10. International Transfers
Some providers, such as our website and analytics services, may process data outside the EU. They rely on an EU adequacy decision, the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. Contact us for details or a copy of the safeguards.
11. Children’s Privacy
Tours are booked by adults, and children are welcome under adult supervision. We collect only what the booking adult tells us about them (usually name and age) and may photograph the group. Just tell us if you’d rather we didn’t.
12. Updates to This Policy
We may update this policy for legal or business reasons. Changes are posted on this page.