Privacy & cookies
Last updated 4 August 2026
Controller
arborae.com and the ARBO RAE practice are operated by Fotoreisid OÜ, registry code 16091281, Vana-Lõuna tn 39/1, 10134 Tallinn, Estonia.
For privacy questions or requests, contact hello@arborae.com.
Enquiries and correspondence
When you submit an enquiry through this site or contact me by email or WhatsApp, I process the information you choose to provide, such as your name, contact details, intended date and location, project details and subsequent correspondence.
This information is used to reply, understand your plans, check availability, prepare an offer and, where relevant, take steps towards a contract.
The legal basis for responding to an enquiry and preparing a requested offer is Article 6(1)(b) of the General Data Protection Regulation. Where that basis does not apply, necessary correspondence may be processed under Article 6(1)(f) for the legitimate interests of answering relevant business correspondence, managing client relationships and establishing, exercising or defending legal claims.
Providing enquiry information is voluntary. Without sufficient contact and project information, I may not be able to respond or prepare the requested offer.
The enquiry form is provided through Framer, and submissions are delivered to Google Sheets in the controller’s Google Workspace.
Bookings and business records
If an enquiry leads to a booking, Fotoreisid OÜ processes the information needed to enter into and perform the agreement, deliver the commissioned work, issue invoices, comply with legal obligations and manage possible legal claims.
Project-specific agreements may contain additional information about photographs, films, delivery and portfolio publication. Submitting an enquiry does not by itself grant permission to use personal material for unrelated marketing.
Site operation and Framer Analytics
Framer hosts and delivers this website and may process technical request, browser, device, network and anti-abuse information needed to operate and protect the site and its forms. This processing is based on the legitimate interest of providing a secure and reliable website.
Framer Analytics provides aggregate, cookie-free website statistics. Framer states that this service does not use cookies or persistent identifiers and does not identify individual visitors through its analytics data. Framer Analytics remains active independently of the optional choices below.
Optional Google Analytics
Google Analytics 4 loads only after you allow Analytics in Privacy choices.
It is used to measure page visits and the following limited actions: starting the enquiry form, a confirmed enquiry, an email-link click and a WhatsApp-link click.
No form value, name, email address, telephone number, recipient, contact destination or message is sent to Google Analytics. Google advertising storage, Google Signals and advertising personalisation remain disabled.
Google Analytics may process a pseudonymous browser identifier, page URL and title, referrer, device and browser information, approximate location and the measured action. Processing is based on your consent under Article 6(1)(a).
Analytics cookies are limited to 180 days and are not renewed on every page load. Event-level and user-level data in the Google Analytics property is retained for up to 14 months.
You can withdraw Analytics consent at any time through Cookie settings. Future measurement will stop. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
External media
YouTube films are not loaded when you first visit the site. Before consent, the site displays only a locally hosted image and local controls.
A film loads only after you allow External media and explicitly choose to play it. The player uses YouTube’s privacy-enhanced domain, youtube-nocookie.com.
When a film is loaded, Google and YouTube may receive network, device and interaction information and may use their own storage under their privacy terms. This processing is based on your consent.
Withdrawing External media consent removes active players from this site. The site cannot remove storage already created on Google or YouTube domains.
Google’s published information states that common YouTube-related storage may last from a browser session to 13 months, depending on its purpose. Google controls and may change those technologies.
Links to email, WhatsApp, Instagram and other external services do not transfer you to those services until you choose the link. Once followed, the external service’s own privacy terms apply.
Storage used on this site
arborae_consent_v1 is first-party local storage used to remember the schema version, policy version, saved time, Analytics choice and External media choice. It contains no visitor identifier or browsing history and expires after 180 days.
_ga and _ga_* are optional first-party Google Analytics cookies used for pseudonymous visit and session measurement. They are created only after Analytics consent and are limited to 180 days without rolling renewal.
YouTube may use its own cookies or similar storage only after External media consent and an explicit play action. Its storage is controlled by Google.
Reject all does not load Google Analytics or YouTube. You can reopen and change your choices at any time through Cookie settings.
Service providers and international processing
The principal service providers and recipients used for this website are:
Framer, for website hosting, delivery, forms, security and cookie-free analytics.
Google, for Workspace and Sheets, consented Google Analytics and consented YouTube media.
Access is limited to people and providers who need the information for these purposes. Information may also be disclosed to professional advisers or public authorities where this is necessary or legally required. Fotoreisid OÜ does not sell personal data.
These providers may use international infrastructure. Where personal data is transferred outside the European Economic Area, the transfer is made using an applicable mechanism such as an adequacy decision, including the EU–US Data Privacy Framework where applicable, or standard contractual clauses.
Retention
Ordinary enquiries that do not lead to a booking are retained for up to 24 months after the last substantive contact about the enquiry, unless they are no longer needed earlier or must be retained for the establishment, exercise or defence of a legal claim. Automated messages do not restart this period.
Contract-related correspondence may be retained for the applicable limitation period, normally three years, where necessary to establish, exercise or defend a legal claim.
Invoices, contracts and other records that form part of the company’s accounting documentation are retained for seven years from the end of the financial year in which the transaction was recorded, as required by Estonian law. This does not mean that every unsuccessful enquiry or complete client file is retained for seven years.
Technical security records are retained only for as long as reasonably necessary to operate, protect and troubleshoot the service. Analytics, consent and external-media storage periods are described above.
Your rights
Subject to the conditions of the GDPR, you may request access to, correction or deletion of your personal data, restriction of processing, data portability, or object to processing based on legitimate interests.
Where processing is based on consent, you may withdraw that consent at any time without affecting processing that was lawful before withdrawal.
To exercise a right, contact hello@arborae.com. I may need enough information to verify the request and protect another person’s data.
You may also lodge a complaint with the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, www.aki.ee, or another competent supervisory authority.
Automated decisions
Fotoreisid OÜ does not use the personal data described in this notice to make solely automated decisions that produce legal or similarly significant effects.
Changes to this notice
This notice may be updated when the site, services or legal requirements change. The current version and its update date will remain available on this page.