Privacy policy
This policy explains how Tallinn, Aiandi tn 7 korteriühistu processes personal data on the website aiandi7.ee and in the resident portal, which cookies we use and what rights you have.
1.Controller and contact
The controller of personal data is Tallinn, Aiandi tn 7 korteriühistu (registry code 80610014), address Aiandi tn 7, Mustamäe linnaosa, Tallinn, 12918.
For questions and requests about personal data, contact the association's board by e-mail at juhatus@aiandi7.ee. The association is not required to appoint a data protection officer; the board is responsible for data protection.
2.What this policy covers
This policy applies to the public pages of aiandi7.ee, the resident portal (cabinet), the board's management area, the web forms and e-mails sent through the website.
The association also processes personal data outside the website (e.g. accounting, general meetings, the list of members) under the Apartment Ownership and Apartment Associations Act, the Accounting Act and the association's articles. Recording and storing CCTV footage of the building is governed by the association's video surveillance rules; the website only processes requests to view recordings and their log.
3.What data we process and why
Resident portal account and login
- Whose data
- Apartment owners and their representatives, board members and administrators.
- Data
- Name, e-mail address, phone (optional), apartment and ownership start date, roles, preferred language, notification settings, last login time. At login: a hash of the one-time code, the IP address that requested it, the session's IP address and browser identifier (user agent).
- Purpose
- Secure passwordless login (a code is valid for 15 minutes), access only to your own apartment's data, communication between the association and its members.
- Legal basis
- GDPR Art. 6(1)(b) and (c) – membership and the association's duties under the Apartment Ownership and Apartment Associations Act and its articles; for security logs Art. 6(1)(f) – legitimate interest in protecting accounts against misuse.
Requests to the board
- Whose data
- Residents and other people who write via the portal, via the contact form to the board, or to the association's e-mail address.
- Data
- Name, e-mail, phone (if given), apartment, subject, messages and attached files (e.g. photos), status and the board's replies. E-mails sent to the association's address (including attachments) are automatically turned into requests.
- Purpose
- Registering, handling and answering requests; notifying board members of new requests.
- Legal basis
- GDPR Art. 6(1)(b) and (c) (handling members' requests as part of the association's duties); for other senders Art. 6(1)(f) – legitimate interest in replying to messages received.
Contact form to the property manager
- Data
- Name, e-mail, phone (optional), subject and message.
- Purpose
- The message is e-mailed directly to the property manager (Olemar OÜ); it is not stored in the website's database.
- Legal basis
- GDPR Art. 6(1)(f) – legitimate interest in managing the building and answering enquiries.
Requests to view CCTV recordings
- Whose data
- The resident who submitted the request, board members handling it, people present at the viewing.
- Data
- Requested period, reason, whether the police were contacted and the case number, agreed viewing time, viewing result and attendees, board notes, handover of a copy to the police or an insurer (recipient, time, reference), log of events.
- Purpose
- Arranging and documenting viewings so that every viewing and handover is traceable. Copies of recordings are never given to residents.
- Legal basis
- GDPR Art. 6(1)(f) – legitimate interest in the safety of people and property and in controlling access to recordings; for handover to law enforcement Art. 6(1)(c).
Listings
- Whose data
- The resident or non-logged-in guest who submitted the listing.
- Data
- Listing content and photos, the contact details you choose to publish (e-mail, phone, WhatsApp, Telegram); for guests also name, e-mail, phone and the IP address of the submission.
- Purpose
- Publishing listings on the building's board, review of guest listings by the board, notifying the submitter and preventing spam.
- Legal basis
- GDPR Art. 6(1)(b) – providing the service at your request; for the IP address Art. 6(1)(f) – legitimate interest in preventing abuse.
New owner application
- Whose data
- New apartment owners and company representatives.
- Data
- Apartment number, ownership start date, owners' names, e-mails and phones, share, company name and registry code, representative details, land register extract (file), notes, time of consent, IP address of the submission, the board's decision and reason.
- Purpose
- Verifying the change of ownership, keeping the list of members up to date and giving new owners access to the portal.
- Legal basis
- GDPR Art. 6(1)(c) – the duty to keep records of members under the Apartment Ownership and Apartment Associations Act; Art. 6(1)(b) – membership.
E-mail notifications
- Data
- Name, e-mail, preferred language, notification settings and the identifier of your one-click unsubscribe link.
- Purpose
- Notices of new documents, news and listings, status changes of your requests and applications, login codes.
- Legal basis
- Service e-mails (login code, reply to your request) – GDPR Art. 6(1)(b). Notifications of new documents, news and listings – Art. 6(1)(f); you can opt out at any time via the link at the end of every e-mail or in your profile settings.
Documents and news
Association documents published in the portal (e.g. meeting minutes, reports) may contain personal data. Unless stated otherwise, they are available only to logged-in members. Basis: GDPR Art. 6(1)(c) (informing members under the law and the articles).
Site preview access
When the site is password-protected, a cookie remembers that the correct password was entered. It contains neither the password nor personal data.
Security and technical logs
The web server keeps technical logs (IP address, time, requested address, browser identifier) to keep the service running and to detect attacks. Basis: GDPR Art. 6(1)(f) – legitimate interest in information security.
5.External content and links
- YouTube (Google Ireland Ltd): the video is loaded from the privacy-enhanced youtube-nocookie.com domain and only with your consent. When it loads, Google receives your IP address and may store cookies; see Google's privacy policy.
- Maps and directions: links on the area page open Google Maps or OpenStreetMap only when you click them. Travel times are calculated by our server; none of your data is sent.
- Images: news and listing images are normally stored on our server. If an image was added with an external address, it is loaded directly from that server, which sees your IP address.
- WhatsApp, Telegram, e-mail and phone: contact buttons in listings open the respective app only when you click them.
6.Recipients and processors
Board members and administrators have access to personal data to the extent needed for their tasks. Data is never sold or shared with third parties for marketing.
- Hosting and e-mail service providers in the European Union – servers, database, backups and sending e-mails (processors).
- ITABIKS (itabiks.ee) – developer and technical maintainer of the website (processor), who may have access to data during maintenance.
- Property manager Olemar OÜ – contact form messages addressed to the manager and maintenance-related requests.
- Police and insurers – a copy of a CCTV recording and related data only in proceedings or an insurance case.
- Public authorities, courts, auditors – where required by law.
Processors act only on the association's instructions under a contract that obliges them to keep the data confidential and secure.
7.Transfers outside the European Economic Area
We do not knowingly transfer personal data outside the EEA. An exception may be loading a YouTube video with your consent – Google's data transfer terms then apply (including the EU–US Data Privacy Framework and standard contractual clauses).
8.How long we keep data
We keep data only as long as needed for the purpose or required by law. After that it is deleted or anonymised.
| Data | Retention |
|---|---|
| Login code | Valid for 15 minutes; the code record (hash, IP address, time) up to 12 months |
| Login session | Cookie up to 30 days; session record (IP address, browser) up to 12 months |
| Resident account and profile | While the membership / ownership lasts; afterwards the account is closed and data deleted within 12 months, except data needed for a legal obligation or claim |
| Requests and their files | 3 years after the request is closed |
| Contact form to the property manager | Not stored on the website; the e-mail stays in the manager's mailbox under the manager's terms |
| CCTV viewing requests and log | 1 year after the request is closed; if a copy was handed to the police or an insurer, until the proceedings end. The recordings themselves are kept under the video surveillance rules |
| Listings | Until the listing is removed; removed or rejected listings together with a guest's contact details and IP address up to 6 months |
| New owner application and land register extract | Up to 3 months after the board's decision; approved owners' details are entered in the list of members and kept while the ownership lasts |
| Unsubscribe identifier and notification settings | Until the account is deleted |
| Server technical logs | Up to 90 days |
| Association documents | As required by law and the articles (e.g. accounting source documents 7 years) |
| Cookies | See the cookie table |
9.Your rights
Under the General Data Protection Regulation you have the right to:
- get information about and a copy of the data we process about you;
- have inaccurate data corrected (you can also change your name, phone, language and notifications yourself in your portal profile);
- have data erased when there is no longer a basis for processing it;
- restrict processing;
- object to processing based on legitimate interest, including opting out of notification e-mails;
- receive the data you provided in a machine-readable format (data portability);
- withdraw consent at any time (e.g. in cookie settings) – this does not affect the lawfulness of earlier processing.
These rights are not absolute: for example, we cannot erase data we must keep by law or that is needed to establish or defend legal claims.
10.How to exercise your rights
Send your request by e-mail at juhatus@aiandi7.ee. We reply within one month; for complex requests this may be extended by up to two months, in which case we will let you know. Before disclosing data we may ask you to verify your identity (e.g. by replying from the e-mail address linked to your portal account, or with a digitally signed request).
11.Complaints
If you believe your rights have been violated, please contact the board first – we will try to resolve the matter quickly.
You always have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): Tatari 39, 10134 Tallinn, e-mail info@aki.ee, www.aki.ee, or to go to court.
12.Automated decision-making
We do not make automated decisions or profile people. Decisions on listings and new owner applications are always made by a board member.
13.Security measures
- Connections are encrypted (HTTPS); session cookies are HttpOnly and Secure.
- Passwordless login with a one-time code, with limited attempts and requests; codes and session tokens are stored only as hashes.
- Role-based access: residents see only their own apartment's data; board data is available only to board members.
- Land register extracts are stored outside the public web folder and are available only to the board.
- Viewings and handovers of CCTV recordings are logged.
- Regular backups and software updates.
14.Changes to this policy
We may update this policy when our processing or the law changes. The current version is always on this page, with its date shown at the top. We will notify portal users of significant changes by e-mail.