Privacy Policy

The Short Version

We run a guides website. We do not sell your data, we do not require accounts, and we collect as little as we can while still knowing which pages are useful. Since 27 August 2026 we also run Google Analytics, which does set a cookie — the section below says exactly what that means.

What we don't do:

• Sell or rent your personal data
• Require an account to read anything
• Ask for immigration or financial details to read a guide
• Track you across unrelated websites for advertising

Who We Are

HowToEstonia.com publishes guides for foreigners living in, moving to, or running a company in Estonia. For the purposes of the General Data Protection Regulation, the controller of any personal data collected through this site is the site's operator, reachable at hello@howtoestonia.com.

What We Collect

Analytics, and there are now two of them.

Vercel Web Analytics sets no cookies and stores no identifier on your device. We see that a page was read, roughly where from, and on what kind of device. We do not see who you are, and on its own it engages no consent requirement.

Google Analytics 4 was added on 27 August 2026 and is a different thing. It stores a _ga identifier in your browser so that two visits by the same device can be recognised as the same reader, which brings it inside ePrivacy Directive Article 5(3): consent is required before information is stored on or read from your device. Legitimate interests do not substitute for that consent, and the tag currently loads on page load without asking.

We do not run advertising. There is no ad network on this site, and therefore no advertising profile of you being built here.

Outbound Links

Links to banks, insurers, brokers and service providers go through a redirect on this domain — /go/… — rather than pointing straight out. The redirect records which partner and which page the click came from. It does not record who you are, and it sets nothing on your device.

None of those links currently earns us anything. We have no affiliate agreement in place, so every outbound link on this site today is a plain link to the provider. If that changes, the pages carrying commissioned links will say so on the page itself, not only here.

Referral Enquiries

Some pages carry a form offering to match you with an immigration specialist. That form is the only place we ask for personal details.

What happens to it:

• It is sent to us by email. We read every one.
• We pass it to a specialist only because you ticked the consent box asking us to, and only for the purpose named next to that box.
• The specialist becomes an independent controller of your data at that point, and their own privacy policy governs what they do with it. We are not able to answer for them.
• We do not add you to a mailing list. There is no mailing list.

Legal Basis

Under Article 6 of the GDPR:

• Legitimate interests for the cookieless analytics and for the outbound-link counts. Both are aggregate, neither identifies you, and running a site without knowing which pages are read is not realistically possible.
• Consent for the Google Analytics cookie — the gap described above. ePrivacy Article 5(3) asks separately what makes storing something on your device lawful, and only consent does; no amount of legitimate interest under Article 6 answers it. This basis is what we will have once the banner ships, not what we have today.
• Consent for passing your enquiry to a specialist. That is the tick box, it is not pre-ticked, and it is not bundled with anything else.
• Legitimate interests for holding your enquiry long enough to answer it.

You can withdraw consent at any time by writing to hello@howtoestonia.com. Withdrawal does not undo a referral already made, because we cannot un-send it — but we will tell you who received it.

Your Rights

If you are in the EU or the UK you have the right to ask us for a copy of what we hold about you, to correct it, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. Write to hello@howtoestonia.com.

In practice, for almost every reader the honest answer to "what do you hold about me?" is nothing — we have no record of you unless you sent us a form.

You can also complain to a supervisory authority. In Estonia that is the Data Protection Inspectorate (Andmekaitse Inspektsioon), and you may instead complain to the authority in your own country of residence.

Processors and Transfers

We use a small number of service providers who process data on our behalf:

• Vercel — hosting, and the cookieless analytics described above.
• Google (Google Analytics 4) — measurement, from 27 August 2026. This is the one that reaches furthest: the tag sends your IP address, the pages you view and the _ga identifier to Google, which processes it on infrastructure including servers in the United States.
• Resend — delivery of the emails our forms generate.

Where a processor operates outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses. For Google specifically, transfers to the United States additionally rely on the EU–US Data Privacy Framework: Google's own data-transfer page states that "Google LLC (and its wholly-owned US subsidiaries unless explicitly excluded) has certified that it adheres to the DPF Principles", effective 23 August 2025 — read 27 August 2026. We quote it rather than summarising because it is a claim about somebody else's legal position and you should be able to check it.

Security, Children and Other Sites

We do not hold accounts, passwords or payment details, which removes most of what there is to lose. Enquiries reach us by email and are not stored in any public-facing system.

This site is not directed at children, and we do not knowingly collect data from anyone under 16.

Once you follow a link away from this site — including through a /go/… redirect — you are on someone else's site under their policy, not ours.

Changes

If this policy changes in a way that affects what happens to your data, we will change the date below. This page was last reviewed in August 2026.