The controller for the processing of personal data through this website is AquaVesto Foundation. Identification and contact details are set out in the Legal Notice.
a) Contact form / e-mail
Data: name, e-mail address, the content of your message.
Purpose: answering your enquiry.
Legal basis: Art. 6(1)(b) GDPR where your message concerns a pre-contractual step, otherwise Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries).
Retention: 24 months after your enquiry has been handled.
b) Donations
Data: handled by the external payment provider; the Foundation receives the information necessary to acknowledge and account for the donation.
Purpose: processing and documenting the donation.
Legal basis: Art. 6(1)(b) and Art. 6(1)(c) GDPR (contract and legal accounting obligations).
Retention: as required by applicable accounting law, currently seven years under the Estonian Accounting Act.
c) Server log files
Data: IP address, date and time of request, requested resource, referrer, browser and operating system information.
Purpose: delivering the site, security, and troubleshooting.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website).
Retention: 30 days.
d) Web fonts and embedded media
This site loads fonts and images from external sources. When a page is opened, your browser connects to those providers and transmits your IP address to them.
Legal basis: Art. 6(1)(f) GDPR.
Providers: Google Fonts, Cloudinary, Amazon Web Services (image storage of our scheduling tool Buffer, used for the Instagram preview) and the media sources credited on the page.
This site does not set cookies for advertising or cross-site tracking. Technically necessary storage may be used to remember your language selection. If analytics or any non-essential technology is introduced, it will only be activated after your consent (Art. 6(1)(a) GDPR), and this policy will be updated accordingly. The embedded donation form of Donorbox may use its own cookies or similar technologies, which are governed by the privacy policies of Donorbox and Stripe.
Personal data may be made accessible to service providers acting on our instructions, in particular the hosting provider, the payment service provider and, where applicable, e-mail and analytics providers. These providers are bound by data processing agreements under Art. 28 GDPR. Current list: Cloudflare, Inc. (hosting and content delivery), Resend, Inc. (delivery of contact-form e-mails), Donorbox (donation platform) and Stripe (payment processing) and Cloudinary (image delivery).
Where a provider processes data outside the European Economic Area, the transfer is based on an adequacy decision of the European Commission or on Standard Contractual Clauses together with any additional measures required. Details: Cloudflare, Inc., Resend, Inc., Donorbox, Stripe, Cloudinary and Amazon Web Services may process data in the United States. Such transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on Standard Contractual Clauses.
Links to our Instagram profile are plain hyperlinks. The latest Instagram posts shown on this site are loaded from our own feed service (hosted on Cloudflare) and their preview images from the image storage of our scheduling tool Buffer (Amazon Web Services); your IP address is therefore transmitted to these providers when the page is opened. No data is transmitted to Instagram until you click a link and open the platform. Once there, the platform’s own privacy policy applies.
Under the GDPR you have the right to request access to your personal data, rectification, erasure, restriction of processing, and data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time with effect for the future.
To exercise these rights, contact us at info@aquavesto.com.
You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work, or of the alleged infringement. Competent authorities include the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) and, for activity in Spain, the Spanish Data Protection Agency (Agencia Española de Protección de Datos).
You are not obliged to provide personal data. If you do not provide the data requested in the contact form, we may be unable to answer your enquiry.
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place on this website.
This policy may be updated to reflect changes in the site or in legal requirements. The version published here applies.