Privacy Policy
1. Controller
1.1. The website digimaja.ee and the service provided through it (the Service) are operated by Digimaja OÜ, registry code 12886842, e-mail info@digimaja.ee (Digimaja or we).
1.2. This privacy policy describes what personal data we collect, why we process it, to whom we disclose it and what rights data subjects have. We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.
2. Whose data and what data we process
2.1. Users (persons with an account in the Service): first and last name, e-mail address, phone number, personal identification code (when logging in with an ID card), hashed password, language preference, time of last login, IP address and technical logs. For this data Digimaja is the controller.
2.2. Data entered by Customers (members of apartment associations, apartment owners, residents, suppliers, employees): name, personal identification code, contact details, apartment data, meter readings, invoices, payments, bank account details from payment imports, votes, documents and accounting data. The controller of this data is the apartment association using the Service (the Customer). Digimaja is the processor and processes this data only on the Customer's instructions in order to provide the Service.
2.3. Website visitors: cookies and usage statistics (see section 6).
2.4. Correspondence: if you contact us by e-mail or phone, we keep the enquiry and our reply.
3. Purposes and legal basis
3.1. Performance of a contract (GDPR art. 6(1)(b)): creating an account, logging in, providing the Service, invoicing, user support.
3.2. Legal obligation (art. 6(1)(c)): retention of accounting and tax documents.
3.3. Legitimate interest (art. 6(1)(f)): securing the Service, preventing misuse, keeping logs, developing the Service and anonymous usage statistics.
3.4. Consent (art. 6(1)(a)): non-essential cookies, where you have given consent. Consent can be withdrawn at any time.
4. To whom we disclose data
4.1. We do not sell personal data. We disclose data only to the extent necessary to provide the Service, to the following recipients:
- e-invoice operators (Finbite/e-arvetekeskus, Omniva) – to send and receive e-invoices at the Customer's request;
- banks – to exchange payment files and incoming payments at the Customer's request;
- state information systems – the Estonian Centre of Registers and Information Systems (submission of annual reports), SK ID Solutions (ID card authentication and digital signing);
- hosting and e-mail delivery providers, acting as our processors and contractually bound to protect the data;
- Google – Google Analytics, Google Ads, reCAPTCHA and Google Fonts (see section 6);
- public authorities – where required by law.
4.2. Data is stored on servers located in the European Union. Where a service provider (for example Google) processes data outside the European Economic Area, the transfer is based on a European Commission adequacy decision or standard contractual clauses.
5. Retention
5.1. We retain User account data for the life of the account and for up to 3 months after the agreement ends, so that the Customer can export the data.
5.2. We retain accounting source documents and invoices for 7 years in accordance with the Estonian Accounting Act.
5.3. We retain technical logs for up to 12 months.
5.4. Retention periods for data entered by the Customer are determined by the Customer as controller, taking into account its legal obligations.
6. Cookies and analytics
6.1. Essential cookies: a session cookie that keeps the User logged in, and a language preference cookie. The Service does not work without them. The session cookie lasts until logout or for up to 1 year.
6.2. Google reCAPTCHA: we use Google reCAPTCHA on login and registration forms to prevent automated abuse. It transmits technical data (IP address, browser data) to Google.
6.3. Google Analytics: we use it to collect usage statistics about the Service. The data is processed in aggregate form and is not linked to a specific person.
6.4. Google Ads: the front page contains a Google Ads tag used to measure the performance of advertising campaigns.
6.5. Google Fonts: the website's fonts are loaded from Google's servers, which transmits your IP address to Google.
6.6. You can block and delete cookies in your browser settings. To opt out of Google Analytics you can use the Google Analytics opt-out browser add-on. Blocking essential cookies may prevent the Service from working.
7. Security
7.1. Data is transmitted over an encrypted connection (HTTPS). Passwords are stored only in hashed form. Access to data is limited by role-based permissions. Regular backups are made.
7.2. In the event of a personal data breach we notify the Customer and, where required, the Estonian Data Protection Inspectorate in accordance with the law.
8. Your rights
8.1. You have the right to access your data, to request its rectification or erasure, to restrict processing, to object to processing, to receive your data in a machine-readable format and to withdraw consent.
8.2. If your data was entered into the Service by an apartment association, please first contact the association as the controller to exercise your rights. We help the association respond to your request.
8.3. Please send requests to info@digimaja.ee. We reply within 30 days at the latest.
8.4. You have the right to lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee).
9. Changes
9.1. We may update this privacy policy. The current version is always published on this page. We notify you of material changes through the Service or by e-mail.
10. Contact
Digimaja OÜ
Registry code 12886842
E-mail: info@digimaja.ee
Phone: +372 55915249