Privacy policy

2.1. For clarity, the data controller is Stay Larsen OÜ, located at Liivalaia tn 36, 10132 Tallinn, Estonia (company registry code: 14858838).

2.2. Questions, comments and requests concerning the processing of personal data may be sent to info@thediplomat.ee.

3.1. We collect and process your personal data for the following purposes:

3.1.1. Providing the Services to you, which includes communicating with you;

3.1.2. Providing the Services to you in the future, at your request, including communicating with you;

3.1.3. Protecting you, other customers using the accommodation facilities and our staff; protecting our property; and ensuring compliance with the accommodation rules;

3.1.4. Sending you news, special offers and general information about the Services, unless you have opted out from receiving such information;

3.1.5. Improving the Services;

3.1.6. Ensuring the functionality of the Website if you have accepted the respective cookies;

3.1.7. Analysing use of the Website where you have accepted the respective cookies;

3.1.8. displaying personalised advertisements if you have accepted the respective cookies;

3.1.9. Enforcing and defending our legal rights;

3.1.10. Complying with legal obligations and requests, including the obligations established for the accommodation service providers.

3.2. We collect and process the following personal data:

3.2.1. For the purposes stated in sections 3.1.1 and 3.1.2: your name, e-mail address, personal identification code (if you have one), phone number, nationality, gender, date of birth, name of the school you will be studying in during your stay (if applicable and relevant), apartment type, date of any requested apartment viewing before the accommodation period, dates of moving in and out, any add-on services (if any), emergency contact phone number, emergency contact’s name and relationship to you, other comments including questions or special requests (which you may provide voluntarily), payment data;

3.2.2. For the purpose stated in section 3.1.3: video surveillance recordings and personal data identifiable from the recordings, door logs (generated by a digital locking system) and personal data identifiable from the logs;

3.2.3. For the purpose stated in section 3.1.4: your name, e-mail address, data regarding your usage of the Services;

3.2.4. For the purpose stated in section 3.1.5: any of the categories of personal data listed above, depending on the specific improvement work carried out in relation to the Services, including any feedback received from you. Personal data is usually pseudonymised for such improvement work;

3.2.5. For the purpose stated in section 3.1.6: we process data collected via cookies, such as information about the device used to visit the Website;

3.2.6. For the purpose stated in section 3.1.7: we process data collected via cookies, such as IP address, information about the device used to visit the Website and data about the use of the Website;

3.2.7. For the purpose stated in section 3.1.8: we process data collected via cookies, such as browsing history, information about visits to the Website and IP address;

3.2.8. For the purpose stated in section 3.1.9: any of the categories of personal data listed above, as determined case by case according to the legal rights we are enforcing and defending;

3.2.9. For the purpose stated in section 3.1.10: any of the categories of personal data listed above (determined case-by-case according to the legal obligation we are subject to), and the following personal data for fulfilling the legal obligations applicable to accommodation service providers:

a) the period during which the Services are provided; a copy of your identity document; your name, date of birth, citizenship and address; and the name, date of birth and citizenship of any spouse or minor accommodated with you.

b) If you are not a citizen of Estonia, another Member State of the European Economic Area or Switzerland, or a foreign national residing in Estonia on the basis of a residence permit or right of residence, we also process the following personal data: the type and number of your (and your spouse’s or minor’s, if accommodated together with you) travel document and the country that issued it.

3.3. Most of the personal data processed by us is collected directly from you. Other data is generated by us, such as video surveillance recordings and door logs, or collected by us automatically (e.g., by using cookies to understand how the Website is used).

3.4. Typically, providing the personal data listed above (except for your gender, nationality, and name of the school you will be studying in during your stay) is mandatory for entering into a contract for the provision of Services. If the data is not provided, the contract cannot be concluded. If the entry of personal data has not been made mandatory and the submission of personal data is not required from you in any other way, the submission of personal data is voluntary and failure to provide it will not have any direct adverse consequences for you. However, failure to provide some personal data may limit the use of the Services.

4.1. We process your personal data to provide the Services to you because it is necessary for the performance of a contract concluded between you and us (see section 3.1.1). The legal basis for this processing is the contract between you and us.

4.2. We process your personal data to take steps at your request prior to entering into a contract (see section 3.1.2). The legal basis is that the processing is necessary in order to take steps at your request before entering into a contract.

4.3. We process your personal data on the basis of our legitimate interests in order to protect you, other data subjects using the accommodation facilities and our staff; protect our property; and ensure compliance with the accommodation rules (see section 3.1.3). We have a legitimate interest to ensure that: i) persons staying in accommodation premises are protected; ii) property located in the accommodation premises is protected; and iii) the accommodation rules are observed. In this regard, video surveillance and door logs allow for the identification of possible violations of the law and thereby the protection and exercise of relevant rights.

4.4. We process your personal data to send you news, special offers and general information about the Services (see section 3.1.4). We have a legitimate interest to keep you informed about information, developments and offers relating to the Services. You always have the possibility to opt-out from receiving such communications (e.g., unsubscribe button below each e-mail). If you opt-out, we will no longer send such information to you.

4.5. We process your personal data to improve our Services (see section 3.1.5). We have a legitimate interest to improve and develop the functions of the Services and their quality. We cannot provide the best and most modern Services without carrying out improvement work.

4.6. We process your personal data through cookies to ensure the functionality of the Website, analyse use of the Website and display personalised advertisements (see sections 3.1.6, 3.1.7 and 3.1.8 above). The legal basis for processing personal data for each of these purposes is your consent. If you do not give consent or if you withdraw consent, we will no longer process your personal data for these purposes.

4.7. We process your personal data for enforcing and defending our legal rights on the basis of our legitimate interests (see section 3.1.9). We have a legitimate interest to enforce and defend our legal rights where necessary (e.g. to file a claim against you if you have infringed the contract concluded for the provision of Services).

4.8. We process your personal data to comply with legal obligations (including obligations for accommodation service providers) because the processing is necessary for compliance with a legal obligation to which we are subject (see section 3.1.10).

5.1. To ensure security, we use video surveillance and door-access logs.

5.1.1. Video surveillance is used inside the buildings in all common areas and corridors, as well as on the exterior of the buildings. The cameras do not record sound or monitor a specific person, but only a specific area and what is happening there – the common areas and corridors and the areas surrounding the buildings. Video surveillance areas are marked with appropriate signs. There are no cameras in the accommodation rooms, nor are they aimed in such a way that the interior of an accommodation room can be recorded.

5.1.2. The door-access system also records logs relating to your use of the accommodation facilities through unique access codes. The door logs are pseudonymised.

5.2. As already explained above (see section 3.1.3), the purpose of processing personal data in this way is to protect you and other data subjects using the Services or visiting the accommodation facilities, and our staff, as well as to protect our property, and to ensure compliance with the accommodation rules. Video recordings and/or door logs may be used to identify the circumstances related to violations. The legal basis for processing personal

data using video recordings and/or door logs is set out in section 4.3 (legitimate interest) of the Privacy Policy.

5.3. Video recordings are stored for a maximum of 30 days. After the retention period has expired, the recordings are deleted – e.g., by overwriting the data. If there is reason to believe that a violation of the law is visible in a video recording, the recording may be stored for a longer period.

5.4. Door logs are stored no longer than 3 months, but as a general practice until the arrival of a new client to the same accommodation facility – that is, if you leave the accommodation, then at the moment when a new client moves in and their unique access code is created for them, the previous client’s (your) log is no longer stored. After the retention period has expired, the logs are deleted. If there is reason to believe that a door log can be used to investigate a violation of the law, the log may be stored for a longer period.

5.5. If your image has been captured on a video recording, you have the right to access your data and receive a copy of the video recording. When submitting a request, you must provide information to identify yourself and explain the period during which you believe you were recorded and be able to describe your appearance on the recording. Please note that access to the recording and the right to receive a copy must not prejudice the rights and freedoms of other persons in the recordings, which is why we may need to edit the recording or render third parties in the recording unidentifiable. In a situation where the processing of recordings is necessary in connection with the fulfilment of legal obligations, including the investigation of possible violations of the law, we may disclose recordings to institutions/persons with the appropriate legal competence (such as the Police and Border Guard Board).

6.1. We will not transfer your personal data to third parties, except:

6.1.1. to companies that provide us with cloud-computing services in which we store and process personal data (e.g. Microsoft Corporation, established in the US). Microsoft Corporation has joined the EU-US Data Privacy Framework which ensures a level of protection for personal data equivalent to that provided in the European Union (for more detailed information see: https://www.microsoft.com/en-us/privacy/privacystatement);

6.1.2. to companies that provide us with software-development services, processing the personal data submitted via our website (e.g. Hmmm OÜ, established in Estonia);

6.1.3. to companies that generate contracts to provide the Services to you, processing the personal data contained in such a contract (e.g. Dokobit, UAB, established in Lithuania and PandaDoc Inc., established in the US). PandaDoc has joined the EU-US Data Privacy Framework which ensures a level of protection for personal data equivalent to that provided in the European Union;

6.1.4. to companies that provide us with data-collection platform services, processing the personal data which you submit to us via our website (e.g. TYPEFORM S.L., established in Spain);

6.1.5. to companies that provide us with customer-management tools, processing the personal data you submit to us (e.g. Pipedrive OÜ, established in Estonia);

6.1.6. to companies that provide us with calendar-management tools and process personal data associated with appointments when you want to see the apartment (e.g. Calendly LLC, established in the US). Calendly LLC has joined the EU-US Data Privacy Framework which ensures a level of protection for personal data equivalent to that provided in the European Union (for more detailed information see: https://calendly.com/pages/dpa);

6.1.7. to companies that provide us with door-access control systems, processing the personal data necessary for operating such system (e.g. Salto Systems, S.L., established in Spain and Telia Eesti AS, established in Estonia);

6.1.8. to companies that provide us with e-mail server services and process personal data transmitted by e-mail (e.g. Microsoft Corporation, established in the US). Microsoft Corporation has joined the EU-US Data Privacy Framework which ensures a level of protection for personal data equivalent to that provided in the European Union (for more detailed information see: https://www.microsoft.com/en-us/privacy/privacystatement);

6.1.9. to companies that help us generate invoices, processing your personal data included in the invoices (e.g. AS Merit Tarkvara, established in Estonia);

6.1.10. to companies that provide us with security-deposit guarantee services, processing the personal data you provide in connection with the security deposit (e.g. Bailsman Group OÜ, established in Estonia);

6.1.11. to companies that provide us with debt-collection services, processing your personal data for debt collection proceedings and procedures (the service provider will be selected if the service is procured – until then, no data is transferred to any third party);

6.1.12. to companies that provide us with accounting services, processing accounting documents and the personal data contained therein (e.g. AS Merit Tarkvara and Destra Finants OÜ, both established in Estonia);

6.1.13. to companies that provide us with integration services (including integrations between Typeform and Pipedrive; e.g. Zapier, Inc., established in the US). Zapier, Inc. has joined the EU-US Data Privacy Framework which ensures a level of protection for personal data equivalent to that provided in the European Union;

6.1.14. to a relevant institution requiring your personal data, if we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation or request;

6.1.15. to companies that provide us with payment services (e.g. Maksekeskus AS).

6.2. We take steps to verify that processors that we appoint to process personal data on our behalf will protect that personal data as required under data protection legislation.

7.1. We only process and store your personal data for as long as it is necessary to fulfil the purpose for which it is processed – once the purpose has ceased, your personal data will be erased or anonymised.

7.2. Your personal data will be stored:

7.2.1. up to 3 years after the end of provision of Services to you where we process your personal data to provide the Services to you (see section 3.1.1);

7.2.2. up to 3 years after the last pre-contractual communication with you where we process your personal data for providing the Services to you in the future (see section 3.1.2);

7.2.3. up to 30 days after the end of provision of Services to you or until opt-out (whichever happens earlier) where we process personal data for the purpose of sending you news, special offers and general information about the Services (see section 3.1.4);

7.2.4. up to 30 days after the end of provision of Services to you where we process personal data to improve the Services (see section 3.1.5);

7.2.5. determined case-by-case according to the applicable limitation period for any claim which we may submit or the claim which may be submitted against us but in any event for no longer than 10 years from the date on which the limitation period begins, where we process your personal data for enforcing and defending our legal rights (see section 3.1.9);

7.2.6. determined case-by-case according to the legal obligation that we are subject to but no longer than 10 years from the occurrence of the event giving rise to the legal obligation (unless a longer period is required under law), where we process your personal data regarding fulfilment of obligations established under law (see section 3.1.10). Personal data which we are obliged to process as an accommodation service provider is retained for 2 years.

7.3. Personal data contained in any accounting documents (e.g. invoices) shall be stored for 7 years from the end of the last financial year they relate to.

7.4. Video surveillance recordings are stored as set out in section 5.3 above.

7.5. Door logs are stored as set out in section 5.4 above.

7.6. Cookies containing personal data are retained as described in section 9 of the Privacy Policy.

8.1. You have the right to contact us at to exercise your rights concerning processing of personal data. These rights include:

8.1.1. right to request access to personal data;

8.1.2. right to request rectification of personal data;

8.1.3. right to request erasure of personal data;

8.1.4. right to request restriction of processing of personal data;

8.1.5. right to object to processing of personal data;

8.1.6. right to request portability of personal data;

8.1.7. right not to be subject to decisions based solely on automated decision-making;

8.1.8. right to withdraw consent;

8.1.9. right to lodge a complaint with a supervisory authority (for further information see: https://www.aki.ee/en; supervisory authority’s e-mail address: ).

9.1. We use cookies on the Website. Cookies are small text files that are stored in your web browser or device when visiting the Website. Some cookies are first-party cookies and are linked to the Website, but third-party cookies are also used.

9.2. Cookies are generally used to make your experience on the Website as smooth and convenient as possible and to collect statistical data about Website visits. More specifically, the following cookies are used:

9.2.1. Strictly Necessary Cookies – cookies that are essential to be able to use the Website. Such cookies are used, for example, to protect the Website from unauthorised commands from malicious websites, to enable secure HTTPS connections, etc. Without them, the Website would not function. As a general rule, such cookies are kept for 1 week. These cookies do not generally collect any personal data.

9.2.2. Analytical cookies – cookies used to analyse the visit and use of the Website. As a general rule, such cookies are kept for 1 year and 1 month or, if such cookies contain your personal data, then until you withdraw your consent (whichever happens earlier).

9.2.3. Functionality cookies – cookies that enable the Website to function as intended. For example, we use session cookies that allow us to remember choices a user makes (e.g., cookie acceptance) and to

recognise a user between sessions. Such cookies are usually stored until the end of the session of the website visit.

9.2.4. Targeting cookies – cookies used for the purpose of displaying personalised advertisements. As a general rule, such cookies are kept for 2 months and 4 weeks or until you withdraw your consent (whichever happens earlier).

9.3. In relation to cookies, you have the right to:

9.3.1. refuse the use of cookies by not giving consent or by withdrawing consent;

9.3.2. refuse the use of cookies by selecting the appropriate settings in the browser;

9.3.3. delete cookies already stored on your device.

9.4. However, strictly necessary cookies will be used in any case without your consent, as without them the use of the Website is not possible. It is possible to use the Website without the use of other cookies, but in this case the Website may not be able to function fully and as intended.

10.1. We have the right to unilaterally amend and supplement the Privacy Policy. The amended Privacy Policy will be sent to you by e-mail or published on our Website. We recommend periodically visiting our Website to review the Privacy Policy and remain informed of any updates or changes.