Privacy Policy
Version of 30 October 2026
This policy explains how Story Spot processes the personal data of visitors to www.storyspot.ee, users of the app.storyspot.ee booking system and coworking residents.
1. Who is responsible for your data
The controller (vastutav töötleja) is OÜ JBSPOT, registry code 16187035, VAT number EE102530452, coworking address: Vesivärava 50, 10152 Tallinn. For data questions: info@storyspot.ee.
OÜ JBSPOT also develops the Eigin booking platform (eigin.io). The booking system sends Eigin the resident's ID and booking times. Eigin stores this data only if the resident is connected to Eigin. Eigin sends nothing back to Story Spot (see section 2).
Resident masters work independently. Each master, not Story Spot, is responsible for their own clients' data (appointments, contacts, photos of work).
2. What data we collect and why
| Whose data | What data | Purpose | Legal basis (GDPR, Art. 6) |
|---|---|---|---|
| Visitor who submits the website form | Name, email, phone, specialisation, message text | To answer the enquiry and offer a workspace | Steps taken at the person's request before entering into a contract (Art. 6(1)(b)) |
| Website visitor | IP address and technical browser data | Protecting the form from spam, website operation and security | Legitimate interest (Art. 6(1)(f)) |
| Resident | Name, personal ID code or registry code, address, email, phone, bank details, rate plan | To conclude and perform the coworking agreement | Contract (Art. 6(1)(b)) |
| Resident | app.storyspot.ee account, bookings, actual working time, invoices | Workspace booking and settlements | Contract (Art. 6(1)(b)) |
| Resident | Invoices and payment data | Accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Resident | User ID and booking time | Syncing the calendar in Eigin; stored only if the resident is connected | Eigin terms of use accepted by the resident on connecting (Art. 6(1)(b)) |
| Everyone on the premises | CCTV images | Safety of people and property | Legitimate interest (Art. 6(1)(f)) |
| Resident who has given consent | Photos and videos | Advertising Story Spot on the website and social media | Consent (Art. 6(1)(a)) |
Residents must provide the data needed for the agreement and invoices: without it the agreement cannot be concluded. Consent to promotional filming is voluntary. We do not use automated decision-making or profiling.
3. Video surveillance
Cameras operate on the coworking premises, as indicated by signs at the entrance. There are no cameras in toilets or changing rooms. Recordings are kept for 30 days and then automatically overwritten. They may be viewed only by a member of the management board of OÜ JBSPOT and only in the event of an incident: damage to property, theft, a claim or a police request. A recording needed for an investigation is kept until the investigation ends.
4. Promotional photos and videos
A resident may appear in Story Spot advertising only with their separate consent, given in the agreement (clause 8.3). Refusing does not affect the agreement. Consent can be withdrawn by writing to info@storyspot.ee. We will then remove the materials from our channels within 14 days. Materials already printed and reposts by others cannot be recalled.
5. Retention periods
| Data | How long we keep it |
|---|---|
| Website enquiries that did not lead to an agreement | 12 months |
| Resident's agreement, account and bookings | The term of the agreement and 3 years after it ends (limitation period for contractual claims) |
| Invoices and accounting documents | 7 years (Accounting Act, Raamatupidamise seadus) |
| Camera recordings | 30 days |
| Promotional photos and videos | Until consent is withdrawn |
6. Who receives your data
We do not sell data. It is received only by the services the website and booking cannot run without. They act as our processors (volitatud töötleja).
| Recipient | Purpose | Data location |
|---|---|---|
| Vercel Inc. | Hosting of the website and app.storyspot.ee | USA, servers in the EU (Dublin) |
| Supabase Inc. | Booking system database | Ireland (EU) |
| Resend Inc. | Delivering website enquiries and booking system emails | USA |
| Telegram | Notifying the administrator of registrations and bookings (name, email, phone, company, booking time) | United Arab Emirates |
| Cloudflare Inc. | DNS and form spam protection (Turnstile) | USA |
| Map on the website, only if the visitor opens it | USA | |
| Sanity AS | Storing website texts and photos, including promotional photos of residents with their consent | Norway (EEA) |
| Elkdata OÜ | Mail server for info@storyspot.ee | Estonia |
| Accounting firm | Accounting and tax returns | Estonia |
| Swedbank AS | Bank account and card terminal | EU |
On a lawful request we may disclose data to public authorities, such as the police or the Estonian Tax and Customs Board (EMTA).
7. Transfers outside the EU
Vercel, Supabase, Resend, Cloudflare and Google are US companies, so data may be accessed from the USA. Such transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses set out in these companies' data processing agreements (DPAs). Telegram operates from the United Arab Emirates, for which the European Commission has not adopted an adequacy decision. Transfers to it rely on standard contractual clauses or, where there are none, on being necessary to perform the contract with the resident (GDPR, Art. 49(1)(b)).
8. Your rights
You may at any time:
- find out what data we hold about you and get a copy;
- have inaccurate data corrected;
- ask us to erase data we are not legally required to keep;
- restrict or object to processing based on our legitimate interest;
- receive your data in a machine-readable format;
- withdraw your consent to promotional filming.
Write to info@storyspot.ee. We reply within one month. If you believe your rights have been infringed, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee.
9. Cookies
The storyspot.ee website does not use analytics or advertising cookies. It sets one functional cookie, NEXT_LOCALE, to remember your chosen language. The Google map loads only when clicked: until then Google does not receive your IP address or set cookies. The app.storyspot.ee booking system uses only strictly necessary cookies for signing in to your account.
10. Changes to this policy
We notify residents of material changes by email in advance. The date of the current version is shown at the top of this document.