Privacy Policy
Effective as of: August 1, 2026
This Privacy Policy explains how Kupee OÜ processes the personal data of customers of the kupee.ee website.
1. Data Controller
- Company: Kupee OÜ
- Registration Number: 17531138
- Address: 1a Kesk Street, Mõisaküla, Mulgi Municipality, Viljandi County
- Email: hei@kupee.ee
- Phone: +372 60000 60
2. What personal data do we process?
During the booking process and the provision of services, we process the following data:
- first name and last name;
- email address and phone number;
- reservation details (selected compartment, dates, additional services, reservation total);
- Data transmitted during communication (e.g., emails, inquiries).
Payment data (bank and card information) is processed by the payment service provider Maksekeskus AS — Kupee OÜ does not collect or store this data (see section 4).
3. Purpose and Legal Basis for the Processing of Personal Data
| Objective | Legal Basis |
|---|---|
| Fulfilling a Reservation and Providing a Service | Performance of the Contract |
| Customer Communication and Support | Performance of the Contract / Legitimate Interest |
| Accounting and Compliance with Legal Obligations | Legal Obligation |
4. Payment Processing and the Role of Maksekeskus AS
To process payments made on the website, the information required to complete the payment (e.g., the customer’s name, email address, and payment amount) to the payment service provider Maksekeskus AS (trademark MakeCommerce), registration code 12268475, address Liivalaia 45, Tallinn 10145.
The payment is processed in Maksekeskus AS’s secure payment environment outside the kupee.ee website. Maksekeskus AS is the independent data controller responsible for processing payments and processes personal data in accordance with its privacy policy, which is available on the makecommerce.net website.
Card payments may also be processed through the service provider Stripe (WooPayments). Stripe is also an independent data processor responsible for processing payments and processes personal data in accordance with its privacy policy, which is available on the website stripe.com.
Kupee OÜ does not collect or store customers’ bank or card information.
5. Disclosure of Data to Third Parties
Personal data may be disclosed only to the extent necessary for the provision of the service to the following parties, who act as authorized processors of Kupee OÜ and process data in accordance with Kupee OÜ’s instructions:
- payment service provider Maksekeskus AS;
- Nebro OÜ, which provides Kupee OÜ with a reservation and customer management system and whose databases store reservation and customer data;
- Anweb OÜ, which provides customer service, cleaning, and maintenance for Kupee OÜ and has access to booking data to the extent necessary for these purposes;
- an email and SMS service provider (for sending booking confirmations and PIN codes);
- accounting service provider;
- if necessary, government agencies to fulfill their legal obligations.
Personal data will not be disclosed to third parties for marketing purposes without the customer’s consent.
6. Retention of Personal Data
Personal data is retained for as long as necessary to fulfill the purpose of processing. Source documents for accounting purposes are retained for 7 years in accordance with the Accounting Act. Data for which there is no legal basis for retention will be deleted.
7. Cookies
This website uses cookies to ensure the site functions properly and to improve the user experience. Users can manage cookie settings in their browser settings.
8. Customer Rights
The customer has the right to:
- access the personal data collected about him or her;
- request the correction of inaccurate data;
- request the deletion of data if there is no legal basis for retaining it;
- to restrict or object to the processing of data;
- request the transfer of data.
To exercise your rights, please contact us at hei@kupee.ee.
9. Complaints
If a customer believes that their rights have been violated in connection with the processing of their personal data, they have the right to contact the Data Protection Inspectorate (aki.ee).