Privacy policy

Who processes your data

The data controller is Jan-Erik Joost, an estate agent working in Tallinn and Harjumaa.

• Email: jan@joostkv.com
• Phone: +372 5697 7660
• Website: joostkv.com

That means I am personally responsible for your data. Any question about privacy can go straight to the email address above.

What data I collect

I only collect the data you give me yourself. The site does not build a profile of you and does not buy data from anywhere.

From the contact form I receive:

• name
• email address
• phone number, if you add one
• the topic you choose
• the content of your message
• the language and the page the enquiry was sent from

From the valuation form I also receive:

• property type, city or municipality, district and address
• floor area, number of rooms, year built and condition
• the photos you upload of the property
• any further details you write in your own words
• your name, phone number and email address

Please do not put data into the forms or the photos that I do not need in order to give a valuation — for example a personal identification code, photos of documents or health data.

The server also records the usual technical logs (IP address, request time and browser type). I use those only to keep the site running and secure, not to track you.

The legal basis for processing

Under Article 6 of the General Data Protection Regulation (GDPR), my legal bases are these:

• Your consent — you give it when you tick the consent box in a form and send the enquiry. You can withdraw consent at any time.
• Steps prior to a contract — if your enquiry grows into working together, I process the data in order to provide the service and reach a deal.
• Legitimate interest — site security, spam protection and keeping a record of enquiries.
• Legal obligation — accounting and anti-money-laundering requirements, once a deal actually takes place.

What I use the data for

I use the data only for what you sent it for:

• answering your enquiry and asking follow-up questions
• preparing a valuation for a property
• providing the agreed service through to the end of the deal
• meeting obligations that come from the law

I do not send you a newsletter or marketing messages without your separate consent, and I do not sell or trade your data with anyone.

How long data is kept

• Contact form enquiries — up to 2 years from our last exchange, so the conversation can be picked up again later.
• Valuation requests and uploaded photos — up to 12 months if no work follows. I keep the photos separately; they are not publicly accessible and they never reach a listing without your separate permission.
• Documents relating to a deal — for as long as the law requires. The Accounting Act sets that at 7 years.
• Technical server logs — for a short period, usually up to 6 months.

If you ask for your data to be deleted sooner, I do it as soon as no legal obligation stands in the way.

Who the data is shared with

I keep the circle as small as possible. The data may reach only these parties:

• Uus Maa — the office I work under as an estate agent, where this is needed to provide the service.
• A notary — to prepare and certify a deal, and only if a deal is actually reached.
• Web hosting and email providers — the servers are located in the European Union and they process the data only on my instructions.
• State authorities — only where the law requires it.

I do not transfer your data outside the European Economic Area.

Cookies

This site is deliberately modest about cookies. There is no analytics, there are no advertising pixels and there are no third-party trackers here.

• Session cookie — remembers your visit and the language you chose. Without it the forms do not work.
• CSRF cookie — a security cookie that protects the forms from misuse.

Both are strictly necessary cookies and both expire on their own. In addition, closing the contact window leaves a single marker in your browser session memory so that the window is not shown again — that disappears when you close the browser.

If you block cookies in your browser settings you can still read the site, but sending a form may not work.

Data security

The site runs over an encrypted HTTPS connection. The forms have technical protections against spam and the number of requests is limited. Uploaded photos are stored in a private folder on the server that is not reachable through a public link.

No system is unbreakable. Should a breach occur that seriously threatens your rights, I will tell you about it and notify the Data Protection Inspectorate in the manner the law prescribes.

Your rights

You have the following rights over your data:

• Access — ask for a copy of everything I hold about you.
• Rectification — if something is wrong or out of date, tell me and I will correct it.
• Erasure — ask for the data to be deleted, where the law does not require me to keep it.
• Restriction of processing — ask me to stop using the data for a while.
• Objection — to processing based on legitimate interest.
• Portability — receive the data in a machine-readable form and pass it to another controller.
• Withdrawal of consent — at any time and without giving a reason. It does not make the earlier processing unlawful.

Write to jan@joostkv.com and I will answer within a month at the latest, usually considerably sooner. I may ask for clarification to be sure the request really came from you.

Making a complaint

If you think I have handled your data wrongly, tell me first — most things can be put right quickly.

You always have the right to turn to the supervisory authority as well:

• Estonian Data Protection Inspectorate
• Tatari 39, 10134 Tallinn
• Email: info@aki.ee
• Web: www.aki.ee

Changes to this policy

If the way the site works or the way I work changes, I will update this policy too. Changes take effect when they are published, and the date of the last update is always shown at the top of the page. If a change is substantive, I will let existing clients know separately.