Privacy Policy

Last updated: 3 September 2026

1. Controller

The controller of personal data is KROOTUSE INVEST OÜ, registry code 12392258, VAT number EE102003918, Mahtra tn 50a, Lasnamäe linnaosa, 13812 Tallinn, Harju maakond, Estonia. For data-protection questions, contact lks.apartments@gmail.com, +372 5982 3288, or +372 5553 8424.

2. Data we process and why

• name, telephone number, email address, date, time, selected services, booking amount and notes — to create, confirm and amend a booking and provide the service;
• payment amount, currency, order or booking reference, payment method, status and transaction reference — to initiate and confirm payments, administer refunds and maintain accounts;
• communications — to answer enquiries and complaints and evidence agreements;
• IP address, browser and device information, and technical and security logs — to operate and secure the website and prevent misuse;
• cookie identifiers and website-use information — only where consent is given for the relevant optional category.

3. Legal bases

Booking and contact data are processed to perform the contract or take pre-contractual steps requested by the customer. Accounting and other mandatory records are processed to comply with legal obligations. Security, service reliability, protection of legal claims and displaying the location map needed for directions are based on the provider's legitimate interests. The TravelLine functional widget, analytics and marketing cookies and related services are based on consent, which can be withdrawn at any time through cookie settings.

4. Montonio and payment data

Bank and card payments are processed through the Montonio payment solution. Information required to initiate and confirm the transaction is shared with Montonio and the selected bank or card-service provider, such as the amount, currency, order or booking reference and, where required, contact and booking details. When providing regulated payment services, Montonio may act as a separate controller under its own terms and privacy policy; details are available on Montonio's legal information page.

The LKS Sauna website receives the payment status and transaction reference needed to match the payment to the booking. The website does not collect or retain the customer's full card number, card security code or online-banking authentication credentials.

5. Service providers and recipients

Data may be processed to the necessary extent by Montonio and the selected payment institution, Zone (hosting and technical infrastructure), and other IT providers and professional advisers needed to provide the service. The Google Maps location map loads for every visitor to show the sauna's location and directions; Google may receive the IP address and device, network and usage information. With consent, data may be processed by Google Analytics (analytics), Meta Pixel (marketing measurement) and TravelLine (accommodation booking widget). Data may be disclosed to public authorities where required by law.

Use of Google, Meta or another international provider may involve a transfer outside the European Economic Area. Where that occurs, we rely on the relevant provider's published transfer mechanism under Chapter V GDPR, such as an adequacy decision or the European Commission's Standard Contractual Clauses.

6. Retention

Accounting source documents and related information are generally retained for 7 years to the extent required by law. Booking, communication and complaint data are retained as long as necessary to provide the service and resolve or defend potential claims. Security-log retention depends on technical need and the provider's reasonable security interest. The cookie preference is retained for up to 12 months; optional-service cookie periods are described in the Cookie Policy.

7. Your rights

Subject to applicable conditions, you may request access to and a copy of your data, rectification or erasure, restriction of processing, object to processing, receive data in a portable format, and withdraw consent. To exercise a right, email the controller. We may request reasonable information to verify identity before fulfilling a request.

If you believe processing is unlawful, you may lodge a complaint with the Estonian Data Protection Inspectorate or the competent supervisory authority where you live.

8. Security and changes

We apply appropriate technical and organisational measures and restrict access to people who need it for their work. This policy may change when the services or legal requirements change; the current version is published on this page with its update date.