PRIVACY POLICY

1.1. The controller of personal data is Avatud OÜ, registry code 12443197, address Harju county, Tallinn, Kesklinna district, Viru väljak 2, 10111 (Avatud).

1.2. Data protection inquiries: hello@avatud.ee.

1.3. You have the right to lodge a complaint with the Estonian Data Protection Inspectorate: www.aki.ee.

1.4. This policy applies to users of the web platform avatud.ee (the Platform): both Clients who book services and Service Providers who offer them.

2.1. All users (Clients):

• Identity data: first and last name, personal identification code, date of birth — obtained when you sign in with Smart-ID or Mobile-ID.
• Contact data: e-mail address (confirmed on the Platform); phone number if you add it.
• Preferences: selected languages, Platform language.
• Bookings: service, Service Provider, date and time, price, status, Activation Code, your notes to the Service Provider.
• Payment data: payment amount, status and Stripe payment identifier. Card details are entered in Stripe's form and never reach Avatud.
• Activity on the Platform: reviews, favourites, page reports ("Report this page"), correspondence with support, notifications.
• Technical data: IP address, browser and device information, logs, cookies (see the Cookie Policy).

2.2. Service Providers, in addition:

• Public profile: display name, profession, introduction, photos and videos, service descriptions, prices, service location, portfolio. This data is public (clause 4.4).
• Contact details for Clients: contact e-mail and phone shown to a Client after purchase.
• Social media: Instagram and Facebook username if you add it (Free plan extension by tagging Avatud).
• Company data: registry code, business name, address, VAT number — verified against the Estonian Business Register.
• Payout data: bank account number (IBAN) if you provide it on the Platform; data linked to your Stripe account (identity document, address, date of birth) is submitted by you directly to Stripe, and Avatud sees only the verification status.
• Tax reporting data (DAC7): tax residency, personal identification code or registry code, income earned, payouts.
• Sales data: orders, payouts, Stripe fees, reviews about you, plan and subscription status.

2.3. Sources of data: you; the authentication service eID Easy (Smart-ID and Mobile-ID, operated by SK ID Solutions AS — name, personal identification code, date of birth); the Estonian Business Register (company data); Stripe (payment and payout status, verification result).

2.4. You are responsible for the accuracy of the data you provide. Avatud is not liable for damage resulting from the submission of false data.

3.1. Performance of a contract (GDPR art 6(1)(b)): creating and managing the account, booking services, processing payments and refunds, Activation Codes, booking-related notices (confirmations, reminders, status changes), payouts to Service Providers, the Paid plan subscription, reviews, customer support.

3.2. Legal obligation (GDPR art 6(1)(c)):

• DAC7 (EU Directive 2021/514): Avatud reports Service Providers' income and identity data to the Estonian Tax and Customs Board (EMTA) once a year.
• Accounting Act: retention of transaction data for 7 years.
• Money Laundering and Terrorist Financing Prevention Act: identity verification of Service Providers for payouts, performed by Stripe.
• Consumer protection: handling complaints and withdrawal notices.

3.3. Legitimate interest (GDPR art 6(1)(f)): preventing fraud and misuse, Platform security and logs, content checks (including automated AI checks), AI-assisted search and matching, review summaries, service improvement, establishing and defending legal claims. You have the right to object to such processing.

3.4. Consent (GDPR art 6(1)(a)): marketing e-mails and non-essential cookies — only with your prior consent, which you can withdraw at any time.

3.5. Artificial intelligence: to understand search queries, match services and Service Providers, check new service descriptions and summarise reviews, the relevant texts (query, service description, review text) are sent to OpenAI. Your name, personal identification code and payment data are not sent for this purpose. The Platform makes no solely automated decisions about you with legal effect; a decision to remove content is made by a person.

4.1. With other users: the Service Provider sees the Client's name, booking details, the Client's notes and contact e-mail for a booking; after purchase the Client sees the Service Provider's contact e-mail and phone. The Service Provider may use this data only to provide the service.

4.2. Processors that process data on Avatud's behalf under a contract:

• Stripe Payments Europe, Ltd. (Ireland) — payments, refunds, payouts to Service Providers and identity verification (Stripe Connect).
• eID Easy OÜ (Estonia) — Smart-ID and Mobile-ID authentication.
• Supabase, Inc. (USA) — database and user account management.
• Vercel, Inc. (USA) — hosting of the web application.
• Resend, Inc. (USA) — sending e-mails.
• BunnyWay d.o.o. (Slovenia) — storage and streaming of photos and videos.
• OpenAI, L.L.C. (USA) — AI processing (clause 3.5); OpenAI does not use data sent via its API to train its models.
• OpenStreetMap Nominatim — converting a service location address into coordinates (only the address is sent).
• Chatplace — detecting Instagram and Facebook tags for Free plan extension (the social media username is processed).
• Avatud's internal administration tools (including Retool) — customer support and administration.

4.3. Public authorities: the Estonian Tax and Customs Board (DAC7 reporting); the Police and Border Guard Board, the Consumer Protection and Technical Regulatory Authority, courts — in cases provided by law.

4.4. Public data: a published Service Provider's profile, services, portfolio and reviews are public and available to search engines and AI assistants (avatud.ee/llms.txt, MCP interface, Schema.org data). Clients' data is not public; a review shows the reviewer's name.

4.5. Transfers outside the European Economic Area: some processors (Stripe, Vercel, Resend, OpenAI, Supabase) may also process data in the USA. Transfers are based on certification under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

• Access your data and obtain a copy.
• Request correction of inaccurate data (you can edit your profile and contact details yourself in the dashboard).
• Request erasure — you can delete your account in the dashboard (Profile); data required by law is retained in anonymised form.
• Request restriction of processing.
• Object to processing based on legitimate interest.
• Withdraw consent at any time (marketing messages, cookies).
• Data portability in a machine-readable format.

To exercise your rights, write to hello@avatud.ee from the e-mail address on your account or send a digitally signed request. We reply within 30 days at the latest.

Avatud implements appropriate organisational and technical measures to protect personal data (GDPR art 32): sign-in only via eID (no passwords are stored), encrypted connection (HTTPS), row-level access restrictions in the database, card data processed only by Stripe (PCI DSS), Service Providers' documents submitted directly to Stripe, access to the administration environment limited to authorised persons.

8.1. This policy has been prepared in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Estonian Personal Data Protection Act and other applicable legislation.

8.2. Avatud may amend this policy. The new version is published on the Platform with its effective date; users are notified of material changes by e-mail.

8.3. The policy is published in Estonian, English and Russian. In case of discrepancy, the Estonian text prevails.