Privacy notice

1. Who is responsible

The controller for personal data processed on cultureconathome.com is OST Consulting OÜ, Paepargi tn 39-11, 11417 Tallinn, Harju County, Estonia, registry code 12359479, VAT number EE102834705. For anything to do with your data, email privacy@cultureconathome.com or write to the address above.

Because the operator is established in Estonia, this website is subject to the EU General Data Protection Regulation (GDPR) and Estonian data protection law.

2. Reading the website

When you open a page, our hosting server automatically processes technical data needed to deliver it: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. This is necessary to show the site and keep it secure (Article 6(1)(f) GDPR, legitimate interests). Server logs are kept for a short period, normally no longer than 30 days, unless needed to investigate a security incident.

All fonts and images are served from our own server. Pages do not load fonts, scripts or images from third-party services before you make a cookie choice.

3. Cookies and similar storage

We store your cookie choice (“Accept all” or “Essential only”) in your browser’s local storage so that the banner does not reappear on every page. If you arrive through a link carrying campaign parameters (for example utm_source or a click identifier), these are kept in your browser’s session storage for the visit and added to the newsletter form, so we can see which link a sign-up came from. Session storage is cleared when you close the browser tab.

No advertising or measurement tag is active on this site at present. The site is built so that, if a measurement tag from an advertising platform (such as Taboola or Outbrain) is added in future to measure which advertisements bring readers here, it will load only after you choose “Accept all”, and never on the imprint, privacy, terms, contact or thank-you pages. In that case the platform would receive data such as your IP address, browser details and the page visited, and this notice would be updated to name it. Details are on the cookies page, where you can also reset your choice.

4. Newsletter

If you sign up for the Sunday Letter, we process your email address and the time of sign-up, plus any campaign parameters described above, to send you the newsletter. The legal basis is your consent (Article 6(1)(a) GDPR), which you give by ticking the box. We use a double opt-in procedure: you first receive an email asking you to confirm, and you are only added to the list once you do. We keep a record of your consent to be able to demonstrate it.

You can withdraw consent at any time through the unsubscribe link in every issue or by emailing privacy@cultureconathome.com. We then delete your address from the mailing list, keeping only what is needed to show that you unsubscribed. The newsletter may be sent using an email service provider acting as our processor under a data processing agreement.

5. Contacting us

If you email or call us, we process the details you give us to answer your enquiry (Article 6(1)(f) GDPR, or Article 6(1)(b) where it relates to a contract). We delete correspondence when it is no longer needed, normally within two years, unless the law requires us to keep it longer.

6. Recipients and transfers

We do not sell personal data. Data is shared only with service providers who help us run the site, such as our hosting provider and, for the newsletter, an email service provider, and only as far as necessary. If a provider processes data outside the European Economic Area, we make sure appropriate safeguards are in place, such as an adequacy decision or the European Commission’s standard contractual clauses.

7. Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting processing carried out before withdrawal. To use these rights, email privacy@cultureconathome.com.

You also have the right to complain to a data protection authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee. Readers in the United Kingdom may also contact the UK’s data protection regulator, the Information Commissioner’s Office, at ico.org.uk.

8. Security and changes

The site is served over an encrypted connection (HTTPS). We may update this notice when the website or the law changes; the date at the top shows the latest version.