Privacy policy

STAY LARSEN PRIVACY POLICY

Last modified on 2^nd of July, 2026

1. SCOPE OF PRIVACY POLICY

This privacy policy (hereinafter: Privacy Policy) applies to all cases where Stay Larsen OÜ (hereinafter: we or us) processes personal data of natural persons (hereinafter: you) as a controller when offering or providing accommodation services (hereinafter: Services). This Privacy policy also applies to all cases where we process your personal data as a controller when you are using our website larsen.ee (hereinafter: Website).

We are committed to protecting and respecting your privacy. Please read the Privacy Policy carefully to understand our rules and practices regarding processing your personal data.

The Privacy Policy is effective as of the date set forth above. The Privacy Policy is an integral part of our general terms and conditions (which you can read at larsen.ee ) as well as any specific accommodation agreement that may be concluded between you and us.

We adhere to the General Data Protection Regulation (GDPR) of the European Union and other applicable data protection laws in force in the Republic of Estonia. For the purposes of this Privacy Policy, terms such as ‘controller,’ ‘personal data,’ ‘processing,’ and others are used as defined in the GDPR.

2. DATA CONTROLLER

For the purpose of clarity, the data controller is Stay Larsen OÜ, located at Liivalaia tn 36, 10132, Tallinn,Estonia (company registry code: 14858838).

All questions, comments and requests regarding data processing are welcome and should be addressed at info@larsen.ee.

3. WHAT CATEGORIES OF PERSONAL DATA DO WE PROCESS AND WHY

We collect and process your personal data for the following purposes:

Providing you Services, which includes communicating with you;

If you have requested it, then providing you Services in the future, which also includes communicating with you;

Protecting you and other customers using the accommodation facilities, and our staff, as well as to protect our property, and to ensure compliance with the accommodation rules;

Sending you news, special offers and general information about the Services, unless you have opted-out from receiving such information;

Improving the Services;

to ensure the functionality of the Website if you have accepted the respective cookies;

to analyse the use of the Website where you have accepted the respective cookies;

displaying personalised advertisements if you have accepted the respective cookies;

Enforcing and defending our legal rights;

Complying with legal obligations and requests, including the obligations established for the accommodation service providers.

We collect and process the following personal data:

For the purposes stated in sections 1.1 and 3.1.2: your name, e-mail address, ID number (if you have one), phone number, nationality, gender, date of birth, name of the school you will be studying in during your stay (if applicable and relevant), apartment type, date of visiting the apartment (if you wish to see the apartment before the accommodation period), dates of moving in and out, any add-on services (if any), emergency contact phone number, emergency contact name and relation, other comments including questions or special requests (which you may provide voluntarily), payment data;

For the purpose stated in section 1.3: video surveillance recordings and personal data identifiable from the recordings, door logs (generated by a digital locking system) and personal data identifiable from the logs;

For the purpose stated in section 1.4: your name, e-mail address, data regarding your usage of the Services;

For the purpose stated in section 1.5: any of the categories of personal data listed above, depending on the exact improvement works done for the Services, including any feedback received from you. Usually, the personal data is pseudonymised for such improvement works;

For the purpose stated in section 1.6: we process data collected via cookies, such as information about the device used to visit the Website;

For the purpose stated in section 1.7: we process data collected via cookies, such as IP address, information about the device used to visit the Website and data about the use of the Website;

For the purpose stated in section 1.8: we process data collected via cookies, such as the history of web browsing, information about the visit to the Website and IP address;

For the purpose stated in section 1.6: any of the categories of personal data listed above (determined case-by-case according to the legal rights we are enforcing and defending);

For the purpose stated in section 1.10: any of the categories of personal data listed above (determined case-by-case according to the legal obligation we are subject to), but also the following personal data for fulling the legal obligations applicable to accommodation service providers:

The period of provision of the Services, a copy of your identity document, name, date of birth, citizenship and address. Also, the name, date of birth and citizenship of your spouse or a minor if accommodated together with you.

Also the following personal data if you are not a citizen of Estonia, another Member State of the European Economic Area or Switzerland or an alien residing in Estonia on the basis of a residence permit or right of residence: the type and number of your (and your spouse’s or minor’s, if accommodated together with you) travel document and the state which issued it.

Most of the personal data processed by us is collected directly from you. Other data is generated by us, such as video surveillance recordings and door logs, or collected by us automatically (e.g., by using cookies to understand how the Website is used).

Typically, submitting the above listed personal data (except for your gender, nationality, and name of the school you will be studying in during your stay) is obligatory to enter into a contract for the provision of Services. If the data is not provided, the contract cannot be concluded. If the entry of personal data has not been made mandatory and the submission of personal data is not required from you in any other way, the submission of personal data is voluntary and non-submission does not have any direct adverse consequences for you. However, failure to provide some personal data may limit the use of the Services.

4. LEGAL BASIS FOR PROCESSING PERSONAL DATA

We process your personal data for providing you Services because it is necessary for the fulfilment of a contract which is concluded between you and us (see section 1.1). In such a case the legal basis for processing data is the contract concluded between you and us.

We process your personal data for taking steps at your request prior to entering into a contract (see section 1.2). In such a case the legal basis for processing data is your request prior to entering into a contract.

We process your personal data for protecting you and other data subjects using the accommodation facilities, as well as our staff, as well as to protect our property, and to ensure compliance with the accommodation rules under legitimate interest pursued by us (see section 1.3). It is our legitimate interest to ensure that: i) persons staying in accommodation grounds are protected; ii) property located in the accommodation grounds is protected; and iii) the accommodation rules are observed. In this regard, video surveillance and door logs allow for the identification of committed violations of the law and thereby the protection and exercise of relevant rights.

We process your personal data for sending you news, special offers and general information about the Services (see section 1.4). It is our legitimate interest to keep you in loop of any information, advancements or offers available regarding the Services. You always have the possibility to opt-out from receiving such data (e.g., unsubscribe button below each e-mail). If you opt-out, we will no longer send such information to you.

We process your personal data for improving our Services (see section 1.5). It is our legitimate interest to improve and develop the functions of the Services and their quality. We cannot provide the best and most modern Services without doing any improvement works.

We process your personal data via cookies for the purposes of ensuring the functionality of the website, analysing the usage of the website and displaying personalised advertisements (see the purposes above in sections 1.6, 3.1.7 and 3.1.8), the legal basis for the processing of personal data for each purpose is your consent. If you do not give consent or if you withdraw consent, we will no longer process your personal data for these purposes.

We process your personal data for enforcing and defending our legal rights under legitimate interest pursued by us (see section 1.6). It is our legitimate interest to enforce and defend our legal rights if we see it as necessary (e.g. to file a claim against you if you have infringed the contract concluded for the provision of Services).

We process your personal data for complying with legal obligations (including obligations for accommodation service providers) as the processing is necessary for compliance with the legal obligation to which we are subject (see section 1.10).

5. SECURITY CAMERAS & DOOR LOGS

To ensure security, we video surveillance and door logs.

Video surveillance is used inside the buildings in all common areas and corridors, as well as on the facade of the buildings. The cameras do not record sound or monitor a specific person, but only a specific area and what is happening there – the general area of the common areas and corridors and the surroundings of the buildings. Video surveillance areas are marked with appropriate signs. There are no cameras in the accommodation rooms, nor are they aimed in such a way that the inside of a accommodation room can be recorded.

Door logs of your usage of the accommodation facilities though unique access codes are also stored. The door logs are pseudonymised.

As already explained above (see section 1.3), the purpose of processing personal data in this way is to protect you and other data subjects using the Services or visiting the accommodation facilities, and our staff, as well as to protect our property, and to ensure compliance with the accommodation rules. Video recordings and/or door logs may be used to identify the circumstances related to violations. The legal basis for processing personal data using video recordings and/or door logs is set out in section 4.3 (legitimate interest) of the Privacy Policy.

Video recordings are stored for a maximum of 30 days. After the deadline has passed, the recordings are deleted – e.g., by overwriting the data. If there is reason to believe that a violation of the law is visible in a video recording, the recording may be stored for a longer period.

Door logs are stored no longer than 3 months, but as a general practice until the arrival of a new client to the same accommodation facility – that is, if you leave the accommodation, then at the moment when a new client moves in and their unique access code is created for them, the previous client’s (your) log is no longer stored. After the deadline has passed, the logs are deleted. If there is reason to believe that a door log can be used to investigate a violation of the law, the log may be stored for a longer period.

If your image has been captured on a video recording, you have the right to access your data and receive a copy of the video recording. When submitting a request, you must provide information to identify yourself and explain the period during which you believe you were recorded and be able to describe your appearance on the recording. It must be borne in mind that access to the recording and the right to receive a copy must not prejudice the rights and freedoms of other persons in the recordings, which is why we may need to cut the recording or make third parties unidentifiable on the recording. In a situation where the processing of recordings is necessary in connection with the fulfilment of legal obligations, including but not limited to the investigation of possible violations of the law, we may release recordings to institutions/persons with the appropriate legal competence (such as the Police and Border Guard Board).

6. DISCLOSING YOUR PERSONAL DATA

We will not transfer your personal data to third parties, except:

to companies which provide us cloud server computing services in which we store and process personal data (e.g. Microsoft Corporation, established in the US). Microsoft Corporation has joined the EU-US Data Privacy Framework which ensures the same level protection for personal data as set in the European Union (for more detailed information see:

https://www.microsoft.com/en-us/privacy/privacystatement);

to companies which provide us software development, processing the personal data submitted via our website (e.g. Hmmm OÜ, established in Estonia);

to companies which generate contracts for providing you Services, processing the personal data contained in such a contract (e.g. Dokobit, UAB, established in Lithuania and PandaDoc Inc., established in the US). Pandadoc has joined the EU-US Data Privacy Framework which ensures the same level protection for personal data as set in the European Union;

to companies which provide us data collection platform service, processing the personal data which you submit to us via our website (e.g. TYPEFORM S.L., established in Spain);

to companies which provide us customer management tool, processing the personal data you submit to us (e.g. Pipedrive OÜ, established in Estonia);

to companies which provide us calendar management tool, processing the personal data of calendar appointment when you want to see the apartment (e.g. Calendly LLC, established in the US). Calendly LLC has joined the EU-US Data Privacy Framework which ensures the same level protection for personal data as set in the European Union (for more detailed information see: https://calendly.com/pages/dpa);

to companies which provide us door access control system, processing the personal data necessary for operating such system (e.g. Salto Systems, S.L., established in Spain and Telia Eesti AS, established in Estonia);

to companies which provide to us e-mail server services, where we use e-mails for transferring personal data (e.g. Microsoft Corporation, established in the US). Microsoft Corporation has joined the EU-US Data Privacy Framework which ensures the same level protection for personal data as set in the European Union (for more detailed information see:

https://www.microsoft.com/en-us/privacy/privacystatement);

to companies which help us to generate invoices, processing your personal data included in the invoices (e.g. AS Merit Tarkvara, established in Estonia);

to companies which provide us security deposit guarantee services, processing the personal data you provide for providing the security deposit (e.g. Bailsman Group OÜ, established in Estonia);

to companies which provide us debt collection services, processing your personal data for debt collection proceedings and procedures (service provider will be determined when service is purchased – until then, no data is transferred to any third party);

to companies which provide us accounting services, processing accounting documents and the personal data contained therein (e.g. AS Merit Tarkvara and Destra Finants OÜ, both established in Estonia);

to companies which provide us integration services (including but not limited to between Typeform and Pipedrive; e.g. Zapier, Inc., established in the US). Zapier, Inc. has joined the EU-US Data Privacy Framework which ensures the same level protection for personal data as set in the European Union;

to a relevant institution requiring your personal data, if we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation or request.;

to companies which provide us payment services (e.g. Maksekeskus AS).

We take steps to verify that processors who we appoint to process personal data on our behalf will protect that personal data as required under data protection legislation.

7. HOW LONG DO WE STORE YOUR PERSONAL DATA

We only process and store your personal data for as long as it is necessary to fulfil the purpose for which it is processed – once the purpose has ceased, your personal data will be erased or anonymised.

Your personal data will be stored:

up to 3 years after the end of provision of Services to you where we process your personal data for providing Services to you (see section 1.1);

up to 3 years after the last pre-contractual communication with you where we process your personal data for providing you Services in the future (see section 1.2);

up to 30 days after the end of provision of Services to you or until opt-out (whichever happens earlier) where we process personal data for the purpose of sending you news, special offers and general information about the Services (see section 1.4);

up to 30 days after the end of provision of Services to you where we process personal data for the improving the Services (see section 1.5);

determined case-by-case according to the expiry date of the claim which we may submit or the claim which may be submitted against us but no longer than 10 years from the moment when the limitation period for the claim started, where we process your personal data for enforcing and defending our legal rights (see section 1.6);

determined case-by-case according to the legal obligation that we are subject to but no longer than 10 years from the circumstance which creates the legal obligation to us (unless a longer period is required under law), where we process your personal data regarding fulfilment of obligations established under law (see section 1.10). Personal data which we are obliged to process as a accommodation service provider is retained for 2 years.

Personal data contained in any accounting documents (e.g. invoices) shall be stored for 7 years from the end of the last financial year they relate to.

Video surveillance recordings are stored as set out in section 3 above.

Door logs are stored as set out in section 4 above.

Cookies containing personal data are retained as described in section 9 of the Privacy policy.

8. YOUR RIGHTS

You have the right to contact us at info@larsen.ee to exercise your rights concerning processing of personal data. Such rights include the:

right to request access of personal data;

right to request rectification of personal data;

right to request erasure of personal data;

right to request restriction of processing of personal data;

right to object to processing of personal data;

right to request portability of personal data;

right that decisions are not taken concerning you which are based on automated decision-making;

right to withdraw a consent;

right to lodge a complaint with a supervisory authority (for further information see: https://www.aki.ee/en; supervisory authority’s e-mail address: aki@info.ee).

9. COOKIES

We use cookies on the Website. Cookies are small blocks of textual data that are stored in your web browser or device when visiting the Website. Some cookies are first-party cookies and are linked to the Website, but third-party cookies are also used.

Cookies are generally used to make the your experience on the Website as smooth and convenient as possible and to collect statistical data about Website visits. More specifically, the following cookies are used:

Strictly Necessary Cookies – cookies that are essential to be able to use the Website. Such cookies are used, for example, to protect the Website from unauthorised commands from malicious websites, to enable secure https connections, etc. Without them, the Website would not function. As a general rule, such cookies are kept for 1 week. These cookies do not generally collect any personal data.

Analytical cookies – cookies used to analyse the visit and use of the Website. As a general rule, such cookies are kept for 1 year and 1 month or, if such cookies contain your personal data, then until you withdraw your consent (whichever happens earlier).

Functionality cookies – cookies that enable the Website to function as intended. For example, we use session cookies that allow us to remember choices a user makes (e.g., cookie acceptance) and to recognize a user between sessions. Such cookies are usually stored until the end of the session of the website visit.

Targeting cookies – cookies used for the purpose of displaying personalised advertisements. As a general rule, such cookies are kept for 2 months and 4 weeks or until you withdraw your consent (whichever happens earlier).

In relation to cookies, the you have the right to:

refuse the use of cookies by not giving consent or by withdrawing consent;

refuse the use of cookies by selecting the appropriate settings in the browser;

delete cookies already stored on your device.

However, strictly necessary cookies will be used in any case without your consent, as without them the use of the Website is not possible. It is possible to use the Website without the use of other cookies, but in this case the Website may not be able to function fully and as intended.

10. CHANGES TO THE PRIVACY POLICY

We have the right to unilaterally amend and supplement the Privacy Policy. The amended Privacy Policy shall be sent to you by e-mail or is uploaded to our website. We recommend periodically visiting our website to review the Privacy Policy to stay informed about any updates or changes.