Last updated: 23 October 2026
1. Data controller
The data controller for sandstrom.ee is Sandshine OÜ, registry code 16823637, Kärneri 6/1, Tallinn 13521, Estonia. For data-protection matters: aleksandra@sandstrom.ee.
2. Scope
This policy applies to website visitors, people contacting us through forms, e-mail, messaging services or consultation bookings, and clients or other transaction participants where data are processed for an agreed service.
3. Data we may process
- name, e-mail address, telephone number and contact preference;
- the content of enquiries and requests;
- property information voluntarily provided, including location, address, listing link, characteristics, price, photos or documents;
- information needed for a proposal, consultation, contract or transaction support;
- technical data, such as IP address, device and browser information, language, cookies, security logs and usage statistics.
4. Sources and purposes
We normally receive data from you. For real-estate services, data may also come from your representative, another transaction participant, a client, public registers, listings or other lawful sources where necessary for the task. We use data to respond to requests, arrange and provide services, support transactions, meet legal, accounting and tax duties, secure the website, and improve it through analytics with your consent.
5. Legal bases
Depending on the situation, processing is based on steps requested before a contract, performance of a contract, legal obligations, legitimate interests or consent. We do not use data for automated decisions producing legal or similarly significant effects.
6. Anonymous Q&A
We publish a question or answer only with separate consent. Before publication, we remove or alter names, addresses, property numbers, contact details, exact amounts and other identifying details. Consent can be withdrawn by e-mail.
7. Recipients and transfers
We do not sell personal data or disclose it to third parties for their own advertising. Access is limited to authorised Sandshine OÜ personnel, website hosting, support and storage providers, Zoho (e-mail), Smaily (helpful emails — only if you have subscribed to them), Calendly (booking and payment of consultations), and professionals involved in an agreed task, such as a notary, lawyer, valuer, bank, accountant, construction expert or building manager. We may also disclose data where required by law.
Some providers may process data outside the EEA. In that case, we use legally recognised transfer safeguards; information about them is available on request.
8. Cookies and external services
The website uses necessary technical cookies. Analytics cookies are used only after consent. Calendly, YouTube and Google Maps may process technical data and use cookies under their own privacy notices. YouTube videos load only after you press the play button. The reviews block loads reviews and profile photos from the servers of Trustindex (Trustindex Kft., Hungary) and Google, and property photos load from the servers of the kinnisvara24.ee portal; these services receive your device’s IP address when this happens. The legal basis is our legitimate interest in showing reviews and properties. Cookie preferences can be changed through the footer link.
Google Analytics. To understand which pages and content are useful to visitors, the website uses Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Analytics cookies (_ga, _ga_*) are set only after you click “Allow” in the banner and are kept for up to 2 years. With your consent, Google receives information about the pages you view, where you came from, your approximate location (country, city), device type and browser. Google Analytics 4 does not store IP addresses. Until you consent, or if you decline, the Google Analytics script is not loaded and no data is sent to Google. Detailed data is kept in Google Analytics for 2 months, after which only aggregated reports remain. Google may process data in the United States; such transfers rely on the EU-U.S. Data Privacy Framework and standard contractual clauses. The legal basis is your consent, which you can withdraw or change at any time via the “Cookie settings” link at the bottom of the page.
View counter. The website also keeps its own view counter for articles and listings. It stores only the total number of views of a page, with no data about the visitor, and does not use cookies. To avoid counting one view several times, the server keeps an anonymous hash for 30 minutes, after which it is deleted.
Property enquiries and service requests. If you send the form on a property page or on the services page, I receive your name, email, phone number (if provided), message and the options you selected. A copy of your enquiry is sent automatically to your email. Files attached to a request are forwarded to me by email and are not stored on the website server. This data is used only to reply, arrange a viewing or prepare an offer.
Property alerts. If you subscribe to new properties that match your criteria, I store your email address, name (if you entered it), language and the criteria you chose: type of deal and property, area, price and number of rooms. The subscription only starts after you confirm it via the link in the email. This data is used only to send you matching properties and is kept until you unsubscribe; every email contains an unsubscribe link.
Cost calculator. The numbers you enter in the calculator are stored only in your browser so the calculation is not lost when you reload the page; addresses and contact details are not stored. The “Share” link contains the calculation parameters in the link itself and is not sent to the server. If you enter a property address, address suggestions are loaded from the address system of the Estonian Land and Spatial Board (Maa- ja Ruumiamet). Emailing the calculation and consultation requests are handled like other enquiries on the website.
“Recently viewed”. To show you recently viewed properties, the website saves a list of them (page address, title, price and photo) in your browser’s storage. This data is not sent to the server or to third parties, and you can delete it by clearing the site data in your browser.
9. Retention
- enquiries and requests without a contract: up to 24 months after the last substantive contact;
- consultation booking data: up to 24 months, unless longer retention is needed for a contract or legal claims;
- contracts, invoices, payments and accounting records: at least 7 years or longer where required by law;
- anonymous Q&A: until consent is withdrawn or content is no longer relevant.
10. Your rights
Where provided by law, you may request access, rectification, erasure, restriction, portability, object to processing based on legitimate interests, or withdraw consent. Contact aleksandra@sandstrom.ee. We normally reply within one month and may request proof of identity. You may lodge a complaint with Andmekaitse Inspektsioon.
11. Security and updates
We use reasonable technical and organisational safeguards, although internet transmission and electronic storage cannot guarantee absolute security. We may update this policy when the website, services, processing practices or legal requirements change.