Vlaesto OÜ · Kunstikoda

Privacy Policy

Processing of personal data on kunstikoda.ee

In force from 1 October 2026 to 30 September 2027. Version 1.

This translation is provided for convenience. In case of discrepancy, the Estonian version prevails.

1. Controller

Vlaesto OÜ (trade name Kunstikoda; “Kunstikoda”), registry code 11785091, address Väike-Sõjamäe tn 3e, Lasnamäe linnaosa, 11415 Tallinn, Harju County, Estonia.

E-mail: info@kunstikoda.ee · Telephone: +372 5839 4841 · Website: kunstikoda.ee

Data protection enquiries may be addressed to the e-mail address above.

2. Data processed and purposes

2.1.User account and auction participation. Given name and surname, e-mail address, telephone number, address, username; for legal persons also business name and registry code. Purpose: to enable bidding, identify the participant and perform the contract of sale. Legal basis: entering into and performing a contract.

2.2.Bids and purchases. Bids and automatic bids placed, works purchased, prices and bid logs. Purpose: conduct of the auction, evidence of transactions and fraud prevention. Legal basis: performance of a contract and legitimate interest. The bidding history of a lot is shown to other Website users with a partially masked username; names are not published.

2.3.Identity verification and anti-money laundering. Personal identification code, identity document details, beneficial owner details and, where necessary, information on the source of funds. Purpose: identifying the Bidder and complying with statutory obligations. Legal basis: legal obligation (transactions of EUR 10,000 or more) and legitimate interest (fraud prevention in other cases).

2.4.Invoicing and accounting. Invoice and payment data. Legal basis: compliance with a legal obligation.

2.5.Debt collection and defaulters. Data on unpaid obligations and an internal list of persons who have failed to complete a purchase or breached the auction terms. Purpose: recovery of claims and protection of the auction and other participants. Legal basis: legitimate interest.

2.6.Newsletter and auction notifications. E-mail address and name. Legal basis: consent. A customer whose e-mail address Kunstikoda obtained in connection with a purchase may receive information about similar works on the basis of legitimate interest and may opt out at any time.

2.7.Website usage statistics. IP address, device and browser data and pages visited. Legal basis: legitimate interest and, for cookies, consent.

2.8.Correspondence. Content of e-mails and enquiries. Legal basis: legitimate interest in responding to enquiries.

2.9.Legal claims. The data listed in clauses 2.1–2.8 may be used to establish, exercise or defend legal claims. Legal basis: legitimate interest.

2.10.Providing the data referred to in clauses 2.1, 2.3 and 2.4 is a prerequisite for entering into a contract. Without it, it is not possible to bid at auction or purchase a work.

3. Recipients

3.1.Data may be disclosed to the following processors: web hosting provider, payment service provider, identity verification provider, parcel and courier services, accounting service provider, e-mail and newsletter platform provider and web analytics provider. A more detailed list of processors is available on request.

3.2.Data may be disclosed to legal and accounting advisers and auditors to the extent necessary for their services.

3.3.Data may be disclosed to public authorities where required by law.

3.4.Where invoices remain unpaid, data may be disclosed to a debt collection agency and a payment default register.

3.5.In the event of a transfer of the business or part of it, data may be disclosed to the successor.

3.6.Data are not sold or disclosed to third parties for their marketing purposes.

4. Transfers outside the EEA

4.1.Where a service provider is located outside the European Economic Area, transfers take place only on the basis of a European Commission adequacy decision (including the EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses.

5. Retention periods

5.1.User account data are retained for the life of the account and for three years after its closure or last activity.

5.2.Accounting source documents are retained for seven years in accordance with the Accounting Act.

5.3.Auction results and transaction records are retained for ten years, so that claims arising from transactions can be resolved and the provenance of a work evidenced.

5.4.Data collected for anti-money laundering purposes are retained for the period prescribed by law.

5.5.Data referred to in clause 2.5 are retained until the claim is satisfied, and internal list data for three years from the breach.

5.6.Newsletter data are retained until consent is withdrawn or the recipient opts out.

5.7.Website logs are retained for up to twelve months and correspondence for up to three years.

5.8.On expiry of the retention period data are deleted or anonymised.

6. Rights of the data subject

6.1.The right to access the data held about them.

6.2.The right to rectification of inaccurate data.

6.3.The right to erasure where there is no legal basis for continued processing.

6.4.The right to restriction of processing and to object to processing based on legitimate interest.

6.5.The right to data portability in a machine-readable format.

6.6.The right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out beforehand.

6.7.Requests should be sent to info@kunstikoda.ee. Kunstikoda may verify the requester’s identity before acting on a request. A response is provided within one month; for complex or numerous requests this may be extended by two months, of which the requester will be informed. Where requests are manifestly unfounded or excessive, Kunstikoda may charge a reasonable fee or refuse to act.

6.8.The right to lodge a complaint with the Estonian Data Protection Inspectorate (Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee).

7. Automated decisions

7.1.Kunstikoda does not take decisions based solely on automated processing that produce legal or similarly significant effects for a person. The automatic bidding function merely executes the Bidder’s own instruction.

8. Cookies

8.1.The Website uses necessary cookies that enable the site to function, including login, bidding and the shopping cart. These cannot be disabled.

8.2.Statistics and marketing cookies are used only with the User’s consent.

8.3.Cookie preferences may be changed via the cookie notice on the Website or in the browser settings.

9. Security

9.1.Kunstikoda applies reasonable technical and organisational measures to protect data, including encrypted connections and access restrictions. However, complete security of data transmitted over the internet cannot be guaranteed.

9.2.Access to personal data is limited to persons who require it to perform their duties.

9.3.Kunstikoda does not store payment card details. Payments are processed in the payment service provider’s environment.

10. Minors

10.1.Only persons aged 18 or over may take part in auctions. Kunstikoda does not knowingly collect personal data of minors.

11. Amendments and validity

11.1.Kunstikoda may amend this privacy policy. The current version is published on the Website together with the date of amendment.

11.2.This privacy policy is in force from 1 October 2026 to 30 September 2027. If no new version has been published by then, it remains in force until a new version is published.