Privacy policy
The data controller is Hingamises OÜ (registry code 16856275), Sõle 14c, 10611 Tallinn, email info@hingamiskeskus.ee, phone +372 5669 5898.
This policy explains what data we collect, why we use it, who we share it with and what your rights are. We process data in line with the General Data Protection Regulation and Estonian law.
For what purposes do we collect and process personal data?
- Taking and confirming bookings, sending reminders and providing the service (performance of a contract).
- Fulfilling online shop orders, issuing gift cards and shipping goods (performance of a contract).
- Taking payments and making refunds (performance of a contract).
- Issuing invoices and bookkeeping (legal obligation).
- Customer support and answering questions (performance of a contract and legitimate interest).
- Website security, attack prevention and visit statistics (legitimate interest).
- Measuring advertising results with Google and Meta (only with your consent).
What data do we collect?
- Contact details: first and last name, email address, phone number.
- Booking details: service, date and time, payment method, packages and gift cards used, cancellations.
- Shop order details: products, quantities, amount, delivery method and parcel locker, gift card recipient name if given.
- Payment details from the payment provider: amount, time and payment method. We never see or store your bank card or online banking details.
- Details on our bank statement: payer name, amount and payment description.
- Technical data: a hash of your IP address in the security log (we do not store the raw IP address), browser type, pages visited.
- With your consent, advertising cookie identifiers (see the cookies section).
When do we ask for your consent?
We ask for consent only to measure advertising results. If you click “Accept” on the cookie bar or tick the measurement box in the booking form or checkout, we load Google Analytics, Google Ads and the Meta pixel and send a purchase or booking event to Google and Meta. In that case your email address and phone number are also passed to them in hashed form, together with the purchase amount.
If you choose “Only necessary”, no advertising script is loaded and neither Google nor Meta learns about your visit.
You can withdraw your consent at any time via the “Cookie settings” link in the footer or by writing to info@hingamiskeskus.ee.
Cookies and browser storage
Necessary cookies and browser storage work without consent, because booking and buying do not work without them. Advertising cookies are set only with consent.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
| hk_consent | Hingamiskeskus | Your cookie choice | 180 days |
| hk_bk_dev | Hingamiskeskus | Device confirmation so you can use packages without entering a code every time | 90 days |
| hk_cart, hk_bk_contact | Hingamiskeskus (browser storage) | Shopping cart and form details if you choose “remember me” | until you delete it |
| hk_vid | Hingamiskeskus (browser storage) | Visit counter, never shared | until you delete it |
| _ga, _ga_* | Google Analytics | Visit statistics (with consent) | up to 2 years |
| _gcl_au | Google Ads | Advertising measurement (with consent) | 90 days |
| _fbp, _fbc | Meta | Advertising measurement (with consent) | 90 days |
Who has access to your data?
Our staff and therapists have access within the scope of their work. We also use service providers who process data on our behalf under a contract:
- web hosting and database (the database is in the European Union, in Frankfurt);
- email sending and receiving service (Estonia);
- payment providers for bank links, card payments and membership fees;
- accounting software and our accountant;
- parcel locker services for shop deliveries (DPD, Omniva);
- an internal staff notification service for new bookings and orders;
- Google and Meta, only with your consent, for advertising measurement.
Some service providers are located outside the European Union, mainly in the United States. In that case transfers rely on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. We share data with public authorities only where the law requires it.
How long do we keep data?
- Invoices and payment records: 7 years under the Estonian Accounting Act.
- Booking and customer records: up to 3 years after your last visit or purchase.
- Cookie consent log: 2 years.
- Security log (IP address hash): 12 months.
What are your rights?
- to know what data we process about you and receive a copy of it;
- to have inaccurate data corrected;
- to have data erased when we no longer have a legal basis to keep it;
- to restrict processing or object to processing based on legitimate interest;
- to withdraw consent at any time, which does not affect the lawfulness of earlier processing;
- to lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee) if you believe your rights have been violated.
To exercise your rights, write to info@hingamiskeskus.ee. We reply within 30 days.
Changes to this policy
If our processing changes, we update this page and note the new date here. This policy applies from 17.09.2026.