Privacy notice

Last updated: 28 October 2026.

Who processes your data?

The controller is Illuste Mõis OÜ (registry code 12667943), Paatsalu, Pärnu County 88204, Estonia. For privacy enquiries, email info@illuste.ee or call +372 5309 8405.

Enquiries and bookings

When you send a form or email, we process your name, email address, optional phone number, visit dates, group size, selected services and message. We use this information to answer your enquiry, prepare a quote and arrange the booking and service. The basis is taking steps at your request before entering into a contract and performing the contract (GDPR Article 6(1)(b)).

Without contact details we cannot answer your enquiry. Dates and group size help us assess availability and prepare a quote. Do not include health information, personal identification numbers or other sensitive data in your message; contact us first about specific needs. Sending an enquiry does not subscribe you to marketing.

Website security

The web server and security software may process your IP address, technical browser information, request time and security events to operate the website and prevent abuse. The basis is our legitimate interest in protecting the website and communications (GDPR Article 6(1)(f)). The enquiry form uses a hidden bot trap, a signed timing token, rate limits and duplicate checks. Temporary rate-limit records use hashes of the IP address and email address; these records generally expire after 10 minutes.

How long do we keep data?

We keep enquiries that do not result in a booking for up to 12 months after the last communication. For bookings, we keep information needed to provide the service until the service is completed and related questions are resolved. If a dispute arises, we keep the relevant information until the claim is resolved or the applicable limitation period expires.

We retain accounting source documents and business records needed to evidence transactions for seven years from the end of the relevant financial year, under section 12 of the Estonian Accounting Act. The basis is a legal obligation (GDPR Article 6(1)(c)). Security logs are kept for the time needed to detect and resolve security incidents; temporary form limits expire separately as described above.

Who receives the data?

Your enquiry is sent to Illuste Manor by email. Access is limited to authorised people handling enquiries and bookings and, as necessary, our web hosting, email and IT service providers. Accounting records may be processed by an accounting service provider. We disclose information to authorities only where there is a legal basis. We do not sell your data.

Cookies, analytics and external services

The website uses technical features needed for operation, including cookies associated with language preferences and administrator login and security. You can manage cookies in your browser settings; blocking them may affect language selection or login. Visitors do not need to create an account and comments are not enabled.

At the time this notice was published, Google Analytics and Plausible visitor measurement were not connected on the new website. If we add analytics, we will update this notice before enabling it and obtain consent where required.

Fonts are loaded from Google Fonts. This connection gives Google technical data, including your IP address; data may also be processed outside the European Economic Area. See Google’s privacy policy. Facebook and map links open an external website only when clicked; that service’s own terms then apply.

Your rights

You may ask about the processing of your data and request access, correction, erasure and restriction under the conditions set by law. You may have a right to portability for data processed automatically on a contractual basis. You may object to processing based on legitimate interests on grounds relating to your situation. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. We do not make automated decisions about you or carry out profiling.

To exercise your rights, email info@illuste.ee. We generally respond within one month and may request information needed to verify your identity. If you believe your data is processed unlawfully, you may complain to the Estonian Data Protection Inspectorate or seek a judicial remedy.