Effective 28 September 2026. This is the only current privacy policy for estiq.ee; the earlier "Estiq Value" privacy notice has been replaced. Amended 13 October 2026: paid valuation report purchases (section 2) and Stripe (section 5) added. Amended 14 October 2026: accuracy guarantee claims (section 2) added. Amended 16 October 2026: buyer IP address and browser for paid reports (section 2). Amended 21 October 2026: Estiq Radar follow alerts and developer portal (section 2) and Radar register data (section 3) added.
1. Controller
The controller is WELDME OÜ (trading as Estiq), Estonian registry code 14086560, Tartu mnt 50-4, 10115 Tallinn, Estonia. Email: [email protected] (subject "Data protection" for privacy requests), phone +372 5808 5617. We have not appointed a data protection officer because the law does not require us to; the contact above answers all questions.
2. What we process, why, on what basis and for how long
| Purpose | Data | Legal basis (GDPR) | Retention | Recipients |
|---|---|---|---|---|
| Automated valuation (AVM) | Address, floor area, rooms, floor, year built and condition you enter | Art 6(1)(b) – service you request | Stored without data identifying you and used only in aggregate statistics; individual queries are not published | Hosting provider |
| Broker consultation request | Name, phone, email, property address, message, consent text and time | Art 6(1)(a) – consent to share; (b) – answering the request | 12 months | The partner broker named on the form (an independent controller); hosting and email providers |
| Bank appraisal order | Name, phone, email, property address, city, bank | Art 6(1)(b); sharing with the appraiser Art 6(1)(a) | 12 months | Estiq. We pass your details to a certified appraiser only after telling you the appraiser's name and receiving your agreement |
| Paid valuation report purchase and invoice | Email, name, company name and VAT number (if you enter them), billing address, address and parameters of the purchased report, payment ID and amount; at the time of purchase your IP address and browser (to prevent fraud and disputed payments). Card details are processed only by Stripe and never reach us | Art 6(1)(b) – contract; Art 6(1)(c) – accounting obligation; IP address and browser: Art 6(1)(f) – preventing fraud and payment disputes | 7 years (Estonian Accounting Act § 12); the report link works for 180 days; IP address and browser 18 months | Stripe Payments Europe Ltd (Ireland) – payment processing; email and hosting providers |
| Accuracy guarantee claim | Your email, report number, the valuation report you send (PDF) and the figures taken from it: market value, valuation date, valuer and valuer company, certificate number, condition, floor area | Art 6(1)(b) – checking the claim and refunding; Art 6(1)(f) – keeping the figures to measure and improve our model's accuracy (you may object, see section 6) | PDF: deleted within 30 days of our decision; figures without your name or personal ID code: up to 5 years; refund records: 7 years (Estonian Accounting Act § 12) | Estiq; Stripe for the refund. The valuation report and its figures are never published |
| Contact form and emails | Name, email, phone, message, source page; IP address and browser | Art 6(1)(b) (answering you); (f) (abuse prevention) | 12 months; IP address and browser 30 days | Hosting and email providers |
| Live chat (Tawk.to) – only with consent | Chat content, name and email if you enter them, IP address, device | Art 6(1)(a) | 12 months | tawk.to inc. (USA) |
| Web analytics (Google Analytics 4) – only with consent | Pseudonymous cookie ID, pages visited, events (e.g. form submitted, referring AI service), device type, approximate location. Google does not store IP addresses in Analytics | Art 6(1)(a); cookie rule of the Electronic Communications Act | Cookie 13 months, analytics data up to 14 months | Google Ireland Ltd, Google LLC (USA) |
| AI virtual staging (once the service is opened to you) | The room photo you upload and the chosen style | Art 6(1)(b) | Photo deleted after processing, at the latest after 30 days | Google (Gemini API) |
| Saving a floor plan | The plan and its name; a salted hash of the IP address | Art 6(1)(b); the hash Art 6(1)(f) (abuse limits) | 24 months after the last change | Hosting provider |
| Estiq Radar follow alerts (a project, developer or municipality) | Email, what you follow, consent text and time, time of confirmation and of the last email | Art 6(1)(a) – consent, confirmed by the link in our email | Unconfirmed requests are deleted after 3 days; confirmed ones until you stop following. The link at the end of every email stops following and deletes your email address immediately | Hosting and email providers |
| Estiq Radar developer portal | Email, company name and registry code, consent text and time, sign-in times, the changes and images you submit, our decision and note. Sign-in links are stored only as a hash | Art 6(1)(b) – using the portal at your request; (f) – checking that the account belongs to the company | Unconfirmed accounts 3 days; rejected accounts 30 days; decided change requests 90 days; approved accounts until you ask us to close them or 24 months after the last sign-in. Approved project information (name, website, description, images with credit) is published on the project page and stays there after the account is closed. Images are stored re-encoded, without file metadata | Estiq; hosting and email providers |
| Security and server logs | IP address, browser, request time and URL | Art 6(1)(f) – preventing attacks and fraud | 30 days | Cloudflare, Inc. (USA); hosting provider |
| Maps and technical libraries | IP address and browser (needed to deliver map images and scripts) | Art 6(1)(f) – making the site work | Per the provider's log policy | CARTO (map tiles), Esri (aerial imagery), jsDelivr, cdnjs, unpkg (open-source libraries) |
We do not sell personal data, do not send newsletters or marketing emails, and do not use your data for ad targeting. We send Estiq Radar emails only when you have requested and confirmed a follow yourself. Giving contact details is voluntary, but without them we cannot answer your request.
3. Published property estimates and owners' data
Estiq publishes estimated market values of buildings and apartments. They are based on Land and Spatial Development Board transaction statistics, the Building Register and Statistics Estonia. We do not collect or publish owners' names or personal ID codes. Because an owner may be identifiable from an address, we treat this data as personal data. We process it on the basis of legitimate interest (Art 6(1)(f)): making the property market more transparent. As an owner you may object and ask us to remove the estimate for your apartment or hide it from search engines. Write to [email protected]; we handle requests within one month.
Estiq Radar (estiq.ee/radar) shows development projects and the construction and renovation history of buildings, based on public registers: the Building Register, the Land and Spatial Development Board's planning data (PLANK) and the Tallinn planning register. As developers, designers and builders we show only companies (name and registry code). We do not store or show private owners, applicants or other natural persons named in register documents. An owner may still be identifiable from the address of a private house, so we treat a building's history (document types, dates and declared works) as personal data too. We process this public data on the basis of legitimate interest (Art 6(1)(f)): making development and construction activity in the area transparent. You may object or report an error at [email protected]; we correct or remove the data within one month.
4. Automated estimate
The estimate is calculated by a statistical model. It is informational and has no legal or similarly significant effect on you within the meaning of GDPR Art 22. On request we explain the logic of an estimate and correct wrongly entered data.
5. Transfers outside the European Economic Area
Google LLC, Cloudflare, Inc. and tawk.to inc. may process data in the United States. Transfers rely on the EU–US Data Privacy Framework where the recipient is certified under it. Otherwise we use the European Commission's Standard Contractual Clauses (Decision 2021/914). You can get a copy of the safeguards from [email protected]. Our payment processor Stripe may transfer data to Stripe, Inc. (USA) on the same basis.
6. Your rights
- to access your data and receive a copy;
- to have inaccurate data corrected;
- to have your data erased;
- to restrict processing;
- to receive the data you provided in a machine-readable format (data portability);
- to withdraw consent at any time. This does not affect the lawfulness of earlier processing. You can change your cookie choice via "Manage cookies" in the footer.
Send requests to [email protected]. We reply without undue delay and at the latest within one month. For complex requests the deadline may be extended by two months; we will tell you in advance if so.
7. Complaints
You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): Tatari 39, 10134 Tallinn, [email protected], www.aki.ee, or with the supervisory authority of your EU country of residence.
8. Changes
We announce material changes on this page and update the effective date.