The Privacy Policy and Cookie Rules

Privacy Policy

The following Privacy Policy explains the principles of personal data processing on the websites visitestonia.com and puhkaeestis.ee (hereinafter the Website), operated by the Tourism Department of the Estonian Business and Innovation Agency (hereinafter referred to as Agency). The Estonian Business and Innovation Agency (registration code 90006012, address Sepise 7, 11415 Tallinn, e-mail: eis@eis.ee) is the controller of personal data.

For more information on the Agency’s organization-wide data protection conditions, please refer to the Agency’s general data protection terms. To review data or materials, please submit an information request to info@visitestonia.com or eis@eis.ee.

For any questions related to the processing of personal data, please contact the Agency’s Data Protection Officer at andmekaitse@eis.ee.

This Privacy Policy does not apply to legal entities and the processing of data concerning them. If you contact us on behalf of a legal entity or institution, please use your professional contact details rather than your personal ones.

Please note: our Website may contain links to third-party websites. We are not responsible for the content or the data protection practices of these websites. We recommend reviewing the privacy policies of any third-party websites before submitting personal data.

Your Data is Secure with Us

Identification data

We may process your personal data with your consent, for example, when you contact us or use Visit Estonia services. Personal data may be collected in several ways, including, but not limited to, when you visit the Website, register on the Website, complete a form or survey, or use other services, features or resources available on the Website. You may be asked to provide your name, e-mail address and telephone number. However, you may also use our Website anonymously. We only collect your personal data if you transmit them to us voluntarily.

We may collect anonymous and statistical data about you at any time during your use of our Website. This may include the name of your web browser, the type of computer you are using and technical data on your connection to our Website, such as data on your operating system and Internet service provider and other similar data.

How We Use Collected Personal Data

The Agency may collect and use your personal data for the following purposes:

• To operate and manage the Website (e.g. correct display of content).
• To improve customer service and respond to inquiries.
• To personalize user experience through aggregated and anonymized analysis.
• To improve the Website and services based on user feedback.
• To organize advertising, competitions, surveys, and other Website functions.
• To send information (with your consent) that may be of interest to you.
• To send regular e-mails and newsletters. Newsletter lists are updated regularly; if you unsubscribe, your contact is automatically deleted.
• To conduct campaigns that require personal data processing (e.g. contacting winners, prize draws, delivery of prizes).

How We Protect Your Personal Data

We follow and take appropriate data collection, retention and processing practices and security measures in order to protect your personal data, username, password and other data saved on our Website from unauthorised access, modification, disclosure or destruction.

We take organisational, physical and information technology measures in order to ensure the security of data processing. Appropriate guidelines and rules have been established, and our employees only process your personal data to the extent necessary to perform their duties. Should we involve a processor, we require them to ensure at least the same level of security.

Your rights and access to data

• request access to your personal data;
• request the rectification of your personal data by informing us and sending us accurate data;
• request the erasure of your personal data. Said right does not apply if the personal data you are requesting be erased are processed on another legal basis or if the obligation to retain the data derives from law;
• request the restriction of the processing of your personal data;
• request the forwarding of your personal data;
• withdraw your consent for the processing of your personal data;
• lodge a complaint with a supervisory authority (the Estonian Data Protection Inspectorate, info@aki.ee, +372 627 4135);
• withdraw your consent at any time, including opting out of receiving the newsletter. Withdrawing consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

Retention of Personal Data

We retain your data only as long as necessary for the purposes for which they were collected, for compliance with legal obligations, or for preparing, filing, and defending legal claims. For example, correspondence is stored for five (5) years, while campaign-related personal data are stored until the end of the campaign. Expired documents and information are securely destroyed.

Electronic Newsletters

If you subscribe to newsletters, you will receive updates, news and information related to Visit Estonia services. Instructions on how to unsubscribe are provided in every email. We may use third-party service providers for sending newsletters and surveys, but only with your consent and under strict data protection obligations.

References to Other Websites

You may find advertisements and other content on our Website that direct you (via links) to the websites and services of our partners, suppliers, advertisers, sponsors, licensors and other third parties. The content and links displayed on such websites are outside of our control, and we are not responsible for the practices of websites linked from our own Website (or linking to our Website). Additionally, such websites or services, including their content and links, may constantly change. Such websites may have their own distinctive privacy and customer service policies, and they are therefore not subject to our Privacy Policy. Browsing and communication on any other website, including websites containing a link to our Website, are regulated by the policies of that website.

Amendments to Privacy Policy

The Agency reserves the right to update this Privacy Policy at any time. Updates will be published on the Website. We recommend reviewing this page regularly.

Cookie Policy

What Are Cookies?

Like most professional websites, our Website uses cookies – small data files stored on your device via your browser – to improve user experience and ensure Website functionality. On this page, we describe what information the cookies collect, how we use it and why it is necessary to occasionally save these cookies. We also explain how you can decline to save cookies, although this may restrict or impede the performance of certain functions of the Website.

Consent

We only place cookies that are strictly necessary for the Website to function without your consent. For all other types of cookies, we will request your explicit consent. Upon your first visit, a cookie banner will appear, allowing you to accept all cookies or customize your preferences.

We use a modern consent management platform (Cookiebot by Usercentrics) that allows you to change your preferences or withdraw consent at any time. For this purpose, you can use the “paperclip-shaped” button located in the lower left corner of the page. For each cookie, the following information is available: name, purpose, provider (with link to its privacy policy), duration, and category.

The use of cookies can also be restricted or disabled in your browser settings. More detailed instructions can be found in the “Help” or “Support” section of your browser. Please note that disabling cookies may affect the functionality of the Website – for example, login, language selection or the display of personalized content may not work. If you are not sure whether to allow or disable cookies, it is recommended to allow all cookies, as they are used to provide the service you have chosen.

Categories of Cookies

We use cookies on the Website to provide functionality, analyze user behavior, and support marketing activities. All cookies that are not strictly necessary are loaded only if you have given your consent.

1.      Strictly Necessary Cookies

These cookies are essential for the proper functioning of the Website and cannot be disabled. For example, they are used to manage user sessions, enable login (via TARA or Google), and remember security settings. These cookies are removed after you log out and do not store your preferences.

2.      Functional Cookies

These cookies allow the Website to remember the choices you have made (e.g. language and region preferences) and provide personalized features. They may also support newsletter subscription functions by temporarily storing data you have entered — for example, remembering whether you have already registered and whether to display certain notices that may apply only to subscribed or unsubscribed users.

From time to time, we may offer you questionnaires to collect useful feedback in order to implement better tools in the future or gain a clearer understanding of Website users. Cookies may be used in connection with these questionnaires to remember who has already completed them and to display accurate results when you move on to the next page.

If you submit information through a form located on the contact page or in the comments section, cookies may be used to retain your user data for future correspondence.         

3.      Statistical (Analytical) Cookies

We use, for example, Google Analytics, which is one of the most widely used and trusted analytics solutions on the web. It helps us understand how users interact with our Website and how we can improve their experience. Data is collected anonymously and used to improve the Website’s performance. These cookies may track the time spent on pages, navigation between pages, and interactions, in order to provide more relevant content and improve the Website’s structure.

The Website may also contain direct links to third-party websites for purchasing products or services. Since it is important for us to understand which products and services to display and how many of our Website visitors use such direct links, we use cookies to track how many people click on these links.

We also use social media buttons and/or plugins on the Website, which allow you to connect with your social networks in various ways. For these to function, many social media platforms set cookies through our Website. These cookies may be used to enhance your profile on their platform or to supplement the data they have already collected in accordance with their own privacy policies. Such social media platforms include, for example, Facebook, Instagram, X (formerly Twitter), Pinterest, LinkedIn and others.

In addition, we use Microsoft Clarity and Microsoft Advertising services to understand how you interact with our Website. For this purpose, we analyze your behavior using behavioral analytics, heatmaps, and session replay technologies. We also use this information to improve the Website, to combat fraud and ensure security, and to deliver advertising.

4.      Marketing Cookies

We use, for example, Microsoft Advertising, Google Ads, Meta (Facebook, Instagram), and LinkedIn cookies to display personalized advertisements and to measure the effectiveness of campaigns.

AI-based Chatbot

The Websites visitestonia.com and puhkaeestis.ee use an AI-powered chatbot to provide quick and context-based information about Estonia as a tourist destination.

The AI assistant is based on OpenAI’s language model (GPT) and uses the n8n.io platform for automation and system integration. Conversation inputs may technically be processed through third parties (including OpenAI) in accordance with their respective privacy policies, which are available on their official websites in the OpenAI privacy policy and the n8n.io privacy policy.

Processing of Personal Data, Conversation Storage and Use

• The chatbot is not intended for processing personal data (such as name, e-mail address, location, etc.). We also do not collect, store, or process IP addresses or other identifiers that could directly identify a user. Users are requested not to enter personal data or other sensitive information into the chat. If such information is nevertheless provided, it will not be processed outside the chat session or for any purposes not specified in this policy.
• Conversations are stored anonymously solely for the purpose of improving the service (e.g. for evaluating the quality of responses) and are retained for a maximum of six (6) months. After this period, they are permanently deleted. Access to logs is restricted to authorized personnel only.
• The use of the AI chatbot is voluntary and based entirely on the user’s decision to use the service.
• The chatbot does not permanently save conversations – once the user leaves the Website, the previous conversation is no longer visible. Each new session starts with a fresh conversation.
• The chatbot only responds to tourism-related questions and does not provide answers on other topics, including visas, work or residence permits, place of residence, or e-residency. In such cases, users are directed to official sources.

Personal data breach

In the event of a personal data breach that constitutes a likely threat to your rights and freedoms, we will prepare any relevant documents thereon. We will definitely take measures to bring the breach to an immediate end.

If the breach results in a potentially serious threat to your rights and freedoms, we will also notify you of this. The purpose of the notice is to enable you to take the necessary precautions to mitigate the situation.

Contacting us

If you have any questions about this Privacy Policy or personal data, the practices of this Website or other topics related to the use of the Website, please do not hesitate to contact us.

If you have any questions about the Website, please e-mail us at info@visitestonia.com.
If you have any questions about personal data, please e-mail the Data Protection Specialist of Estonian Business and Innovation Agency at andmekaitse@eis.ee.

The Privacy Policy and Cookie Rules are effective as of 18 August 2025.