How we protect
your data

1. Data controller

• Data controller: MJD Expert OÜ, registry code 16076554, address Mustamäe tee 50, Tallinn, e-mail info@lohesaba.eu.
• Contact: for data protection questions, write to info@lohesaba.eu or call +372 51 934 834.
• Children’s data: we receive the child’s name and age from the parent or another person who books the party. We use them to organise the party and for the birthday reminder described in section 2.

2. What data we process, why and for how long

Below, for each situation, you will find what data we collect, what we use it for, on what legal basis and how long we keep it.

• Booking: when you book a party room or Hubane nurk, we collect your first and last name, phone number and e-mail address, the child’s name and age, the services and food you choose, your notes, your language, and your payment and discount details. If you want an invoice to a company, we also ask for the company name, registry code, VAT number and address. We use the data to organise the booking and the party, communicate with you, receive payments and issue invoices. We send you e-mails about the booking, payments and changes; copies of the e-mails we send are kept with the booking. Legal basis: performance of the contract and, for invoices and accounting, a legal obligation. We keep booking, payment and invoice data for 7 years, because the Estonian Accounting Act requires accounting source documents to be kept for 7 years.
• Perekaart and the discount for a child with a disability: to get the Perekaart (family card) discount, you can upload a photo of the card when booking or on the “My booking” page, or show the card on site. The photo is saved on our server in a closed folder under a random file name and is seen only by staff who check the discount. If a photo is uploaded but no booking is made, it is deleted automatically within 48 hours. A photo linked to a booking is kept with the booking. To get the discount for a child with a disability, you tell us when booking or at the cash desk that the child has a disability. This is health-related information: we use it only to give the discount and process it with your consent, which you give by sharing the information.
• Payments: you can pay via Montonio (bank link or card) or by bank transfer. We do not see or store your bank card details. To match a received payment to a booking, we read the amount, reference number, payment description, payer’s name and account number from the incoming payments on our bank account. For Montonio payments, we keep the payer’s name and the last digits of the account number for 30 days to recognise the same payment on the bank statement. Legal basis: performance of the contract and the accounting obligation. We keep payment data for 7 years.
• “My booking”: after booking you receive a personal link to the “My booking” page. There you can view the booking, pay, order extra services, change the date and send us a message, which arrives in our mailbox. If you ordered a disco, you can also message our partner DJ there. The conversation with the DJ is deleted automatically 1 year after the party date.
• Reminders and feedback: if the room is confirmed but no food has been ordered, we send one reminder about ordering food a few days before the party. You can opt out using the link in the e-mail. After the party we ask for feedback by e-mail: a rating, a comment and, if you wish, a link to your social media post. You receive a gift for the feedback. The feedback is kept with the booking. Legal basis: our legitimate interest in offering a good service and improving it.
• Newsletter and birthday reminder: if you tick when booking or on the tablet at the cash desk that you want offers, we may send you information about events and special offers a few times a year. Legal basis: your consent, which you can withdraw at any time. If you have celebrated a child’s birthday with us, a few weeks before the anniversary of the party we send an e-mail that reminds you of the next birthday and includes a discount code. This e-mail is not sent if more than 2 years have passed since the last party or if you already have a new booking. Legal basis: our legitimate interest in offering similar services to our customers. Every such e-mail has an unsubscribe link.
• Feedback at the cash desk and gift exchange: on the tablet at the cash desk you can give a rating and write your opinion. To send you a gift, we ask for your e-mail address. We keep the address so that each address gets the gift only once. We exchange gifts with our partner NOVA Family Space: we pass your e-mail address to them so that they can give you their own gift code, which we send in the same e-mail. In the same way, we receive the e-mail address and name of a partner’s visitor when we issue them a Lohesaba gift ticket code. Legal basis: giving you the gift at your request and our legitimate interest.
• AI chat assistant: in the chat window on our website, an assistant based on artificial intelligence answers your questions. To prepare the answer, we send your message, the latest messages of the conversation and any attached image to OpenAI. If you give your booking details in the chat (for example your e-mail address and booking number), we also send the booking details needed for the answer (date, time, room, child’s name and age, orders, payment status). We keep the chat log for 90 days to check the quality of the answers; we also use OpenAI for this. In the log, e-mail addresses and phone numbers in your messages are replaced with a placeholder. Answers we have rated to improve quality may be kept longer. Images attached in the chat are saved on our server and are seen only by staff. If you ask us to contact you, we send your contact details and the latest messages of the conversation to our mailbox; the contact details also stay in the chat log. Please do not share sensitive data in the chat. Legal basis: answering your request and our legitimate interest.
• Other enquiries: when you write to us by e-mail, call us or write via Facebook Messenger or Instagram, we use your data to answer you. The text of Messenger and Instagram messages also arrives in our mailbox automatically. The data from the whole-centre rental enquiry form (name, e-mail, phone, preferred date, number of guests, message) is sent to our mailbox and saved in the log of sent e-mails. Legal basis: answering your enquiry. We keep the correspondence for as long as needed to resolve your question.
• Birthday invitations: in the invitation builder (/en/sunnipaevakutsed) you can send the invitation to your guests’ e-mail addresses. We send the e-mail at your request, and the guests’ replies go directly to you. The invitation details are contained in the invitation link; we do not save the guests’ e-mail addresses in a database.
• Job applications: the data from the application form on /en/toole (name, phone, e-mail, age, languages, work experience, suitable working hours, start date, motivation) is sent to our mailbox and is not saved in the website database. We use it only to choose an employee. Legal basis: steps taken at your request before entering into a contract. We keep the application while the recruitment is ongoing. If you want us to delete it sooner, write to us.
• Ordering in the café: when you order in the café via the QR code (/laud), we save the order, your phone number if you collect the order yourself and, if you want a receipt, your e-mail address. The phone number and IP address are deleted after 90 days; the rest of the order data stays in the sales history. Legal basis: performance of the contract.
• Video surveillance: there is video surveillance at the cash desk. We use it for security and to organise service at the cash desk. Legal basis: our legitimate interest. The recordings are viewed only by authorised persons; in case of an incident we may hand them over to law enforcement authorities.
• Google reviews: on our website we show a selection of public Google reviews with the author’s name, as published on Google. If you want us to remove your review from our site, write to us.

3. Sharing data with third parties

We do not sell personal data. We share it only with those who help us provide our services and with the partners named below:

• Zone Media OÜ (Estonia): server of the website and the booking system, database and backups, sending e-mail and the mailbox.
• Google (Google Ireland Limited and Google LLC): e-mails to our address info@lohesaba.eu are forwarded to Gmail; bookings are kept in Google Calendar (name, phone, e-mail, child’s name and age, notes, orders); our Swedbank connection service runs on a Google Cloud server in Finland; in addition Google Analytics, Google Ads and Google Maps (see sections 5 and 6).
• OpenAI: the AI chat assistant (see section 2).
• Anthropic: an artificial intelligence tool that helps us draft replies to customer e-mails. A person always checks and sends the reply.
• Montonio Finance UAB (Lithuania): when paying by bank link or card, the payment data is processed by Montonio’s system to ensure payment security. We do not store your bank card details.
• Swedbank AS: for bank transfers and Swedbank payment links, the payment data is processed by our bank. Data on incoming payments to our account also reaches our accounting software.
• Merit Tarkvara AS (Merit Aktiva): accounting and invoices. If we issue an invoice, it contains your name or company details, phone and e-mail; the invoice is sent to you by e-mail through Merit.
• Ektaco AS (CompuCash cash register system): a confirmed booking is transferred to the cash register as an order: name or company name, phone, e-mail and the ordered services.
• DJ (partner): if you order a disco, the DJ receives your name and phone number, the child’s name and age, the number of children, your notes and the time and room of the party.
• NOVA Family Space: gift exchange (see section 2).
• Meta Platforms Ireland Limited: Meta Pixel (see section 6). If you write to us via Messenger or Instagram, Meta also processes your messages.
• Law enforcement authorities: in cases provided for by law, upon a justified request.

4. Transfers outside the European Union

Google, Meta, OpenAI and Anthropic may also process data outside the European Economic Area, mainly in the USA. In that case the transfer takes place in accordance with the GDPR, for example under the EU-US Data Privacy Framework or standard contractual clauses.

5. Cookies

Our website uses cookies and browser storage. Necessary cookies and settings (for example your cookie choice, language and the café shopping cart) are needed for the site to work and are always on. Analytics cookies (Google Analytics) and advertising cookies (Google Ads, Meta Pixel) are activated only with your consent. You can change your consent at any time via the “Cookie settings” link at the bottom of the page or in your browser settings.

The home page and the contact page show a Google Maps map. When the map is displayed, Google receives your IP address and may set its own cookies.

6. Advertising and analytics (Google and Meta)

To analyse how the website is used and to promote our services we use Google tools:

• Google Analytics: helps us understand how visitors use the site, including how many people start and complete a booking (pseudonymous statistics).
• Google Ads: advertising campaigns, conversion measurement and remarketing. After visiting our site, we may show you Lohesaba ads on other websites and Google services. For a completed booking we send Google Ads the booking number and the amount.

These tools may set cookies and collect pseudonymous identifiers (e.g. cookie ID, device and browser data, IP address). We use Google’s consent mode: until you give consent, Google’s tools do not store analytics or advertising cookies on your device, but Google may receive signals without cookies (e.g. that a page was viewed), which are used for aggregated measurement. We do not send your name, e-mail address or phone number from the website to Google or Meta. The data is processed by Google Ireland Limited and Google LLC, including outside the European Union (see section 4). You can turn off personalised advertising in Google’s ad settings (myadcenter.google.com) or in your browser settings.

Meta (Facebook and Instagram): since July 2026 we also use the Meta Pixel to measure the performance of our Facebook and Instagram ads and to show you more relevant advertising. The pixel activates only with your consent (advertising cookies) and sends Meta events such as page view, booking started and completed booking, together with pseudonymous identifiers (cookie ID, device and browser data, IP address). This data is also used to build advertising audiences (custom audiences) so that ads can be shown to people who have visited our site. The controller is Meta Platforms Ireland Limited (Ireland); for certain processing operations we act as joint controllers with Meta, and data may be transferred outside the European Union (see section 4). You can withdraw consent at any time via the cookie banner and manage ad preferences in your Facebook and Instagram account settings.

7. Data security and backups

The data is stored on our server in Estonia. Only our staff and partners have access to the booking system, and only to the extent they need (for example, the DJ sees only the parties where a disco has been ordered). A backup of the database is made every day and kept for 14 days; a backup of uploaded files (for example photos) is made once a week and the last 4 are kept. Before larger changes we also make a one-off backup. The backups are stored on the same server outside the public web folder. For security, the web server records technical logs (for example IP address and time of visit), and to prevent abuse we limit the number of requests per IP address.

8. Your rights (GDPR)

You have the right to access your data, correct it, delete it, restrict its processing and transfer it, as well as the right to object to its processing and to withdraw your consent. You can object to direct marketing at any time, including via the unsubscribe link in the e-mail. Withdrawing consent does not make earlier processing unlawful. Data that we must keep by law (for example accounting source documents) cannot be deleted before the end of that period. To exercise these rights, contact us at info@lohesaba.eu or by phone at +372 51 934 834. We will reply within one month at the latest.

9. Complaints

If you believe that your data protection rights have been violated, you can file a complaint with the Estonian Data Protection Inspectorate (AKI).

10. Changes to this policy

If our processing of personal data changes, we will update this page. The date of the last change is shown at the top of the page.