GDPR & Data Protection
Last updated: February 26, 2026
Data Controller
Company: Vermare OÜ
Address: Tallinn, Estonia
Email: privacy@vermare.io
Registry Code: 16XXXXXX
Data We Collect
Identity Data
Full name, date of birth, nationality, ID document number (for guest registration compliance)
Contact Data
Email address, phone number, postal address
Booking Data
Stay dates, property details, payment records, guest preferences
Usage Data
Login times, feature usage, device information (anonymized via Plausible)
Legal Basis for Processing
- •Contract Performance: Processing necessary to fulfill booking and property management services you requested.
- •Legitimate Interest: Service improvement, fraud prevention, and security monitoring.
- •Legal Obligation: Compliance with tax laws, guest registration (Estonian § 24, Spanish SES, Italian Alloggiati), and EU regulations.
- •Consent: Marketing communications — you can withdraw consent at any time.
Your Rights Under GDPR
Right to Access
Request a copy of all personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your personal data ('right to be forgotten').
Right to Restrict
Request limitation of processing in certain circumstances.
Right to Portability
Receive your data in a structured, machine-readable format.
Right to Object
Object to processing based on legitimate interests or for marketing purposes.
Data Retention
We retain your data only as long as necessary for the purposes outlined, or as required by law:
- •Booking records: retained for 7 years for tax compliance
- •Account data: deleted within 30 days of account closure
- •Legal compliance data: retained as required by local law (e.g., guest registration records)
Third-Party Processors
We use the following third-party services to process data on our behalf. All processors are GDPR-compliant and bound by data processing agreements.
| Provider | Purpose | Location |
|---|---|---|
| DigitalOcean | Cloud infrastructure & hosting (EU region) | EU |
| Montonio | Payment processing (bank links, cards) | Estonia |
| Stripe | Subscription billing & wallet payments | EU/USA |
| Resend | Transactional email delivery (EU region) | EU |
| Plausible | Privacy-focused analytics (no cookies) | EU |
Contact Us
For any GDPR-related inquiries or to exercise your data protection rights, contact us:
privacy@vermare.io