Privacy
valid from: 01.07.2026
Privacy Policy and Processing of Personal Data
This Privacy Policy explains how and for what purposes Taagzi TÜ, address Kastani 8, 50410 Tartu, registry code 14949340 (the operator of the service available at kingilist.ee and the data controller), collects, processes and shares personal data.
Personal data means any information relating to an identified or identifiable natural person, such as an email address, mobile phone number, and information about visits to kingilist.ee, social media channels, and the use of Taagzi TÜ services.
When using this service through any channel (website, mobile app, etc.) or creating a user account, these Privacy Terms apply to the user. Using the service or website does not automatically mean that consent has been given for all personal data processing operations. Where processing is based on consent, we ask for it separately and the user has the right to withdraw consent at any time. These terms also apply to communication that takes place on social media platforms such as Facebook, Instagram and LinkedIn.
-
Definitions
- Processing of personal data means any operation performed with the personal data of a website user (hereinafter the user), including collecting, processing, storing, correcting or deleting data.
- User means a person who visits the website, uses the services or provides information to Taagzi.
- Service means all free and paid products and services offered by Taagzi.
-
Legal Bases for Processing Personal Data
We process personal data only when there is a legal basis for doing so, and we apply the applicable laws of the European Union and the Republic of Estonia. Depending on the purpose of processing, the legal basis may be:
- performance of a contract - when processing is necessary to provide the Kingilist service, for example to manage a user account, wishlist or gift reservation;
- legitimate interest - when processing is necessary to ensure the security, operation, development, abuse prevention or customer support of the service;
- consent - for example when using certain cookies, analytics or marketing solutions, where consent is required by law;
- compliance with a legal obligation - for example when retaining accounting data or responding to a lawful request from an authority.
-
What Data We Process and Why
Purpose of processing Data processed Legal basis Retention Providing the Kingilist service name or display name, email address, wishlist content, wishes, descriptions, quantities and list settings performance of a contract until the user account or list is deleted, unless the law requires longer retention Selecting or reserving a gift giver's name, email address, selected wish, quantity and technical data related to the reservation performance of a contract or legitimate interest until the list is deleted or until the data is no longer needed to manage wishes Customer support and communication with the user name, email address, content of the request and communication history performance of a contract or legitimate interest until the request is resolved and thereafter for a reasonable period to handle possible disputes Managing payments and billing invoice data, payment-related information, order or premium-service data performance of a contract and compliance with a legal obligation for the period required by accounting law Website security and abuse prevention IP address, device and browser information, log data and activity timestamps legitimate interest for as long as necessary to ensure security or investigate possible violations Website analytics and improving user experience visit statistics, cookie identifiers, device and browser data consent or legitimate interest, depending on the solution used according to cookie settings or the retention period of the analytics service -
Public and Shared Wishlists
The nature of the Kingilist service is to allow users to create wishlists and share them with other people. When a user creates or shares a wishlist, the data included in that list may be available to people who have the list link or with whom the list has otherwise been shared. Search engines or other automated systems may also store and reproduce this information, which Taagzi cannot control.
A public list or a list shared by link may show, for example:
- the list creator's name or display name;
- wish titles, descriptions, images, links and quantities;
- additional list-related information entered by the user.
The user is responsible for not adding sensitive or excessive personal information to a list if they do not wish to share it with others. To protect a list from public viewing, the user must use a PIN code, which can be enabled in the wishlist settings.
If a list has been made publicly available, third parties may already have seen or saved it. We remove the list from our service based on the user's request or deletion action, but we cannot always control data that third parties have already copied or shared.
To protect your personal data and lists from unauthorized access, do not stay logged in to your account on public devices.
-
Processors and Third-Party Service Providers
We use trusted service providers to provide the service. These providers may process personal data on our behalf and according to our instructions. Such service providers may include, for example:
- web hosting and server infrastructure providers;
- email and notification sending services;
- payment and billing services;
- analytics and cookie-management solutions;
- accounting and administrative services;
- customer support or error-management tools.
Where necessary, we enter into data-processing agreements with service providers and require them to apply appropriate technical and organizational measures to protect personal data.
Our current cooperation partners are:
- OÜ Virtuaal.com
- SMTP2Go
- Luminor
- Fathom Analytics
- Google Analytics
- Cookiehub
-
Transfer of Personal Data Outside the European Economic Area
As a rule, we process personal data within the European Economic Area. If we use service providers through whom data may move outside the European Economic Area, we ensure that there is an appropriate legal basis and safeguard for such transfer.
Such safeguards may include, for example:
- an adequacy decision by the European Commission;
- the European Commission's standard contractual clauses;
- the service provider's participation in the EU-US Data Privacy Framework, where the provider is located in the United States and is certified under that framework;
- another safeguard permitted under the GDPR.
-
User Rights
The user has the following rights in relation to their personal data:
- the right to receive information about how their personal data is processed;
- the right to access the personal data processed about them;
- the right to request correction of inaccurate or incomplete data;
- the right to request deletion of personal data where there is no legal basis for further processing;
- the right to request restriction of personal data processing;
- the right to object to personal data processing where processing is based on legitimate interest;
- the right to receive the data they have provided in a structured, commonly used and machine-readable format, where applicable;
- the right to withdraw consent where processing is based on consent;
- the right to lodge a complaint with the Estonian Data Protection Inspectorate or another competent supervisory authority.
To exercise these rights, the user can contact us at kirjuta [at] kingilist.ee. We generally respond to requests within one month, unless the law allows or requires a longer period.
-
Data Retention
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, perform a contract, provide the service, resolve disputes or comply with legal obligations.
If a user deletes their account or wishlist, we delete or anonymize the related personal data within a reasonable time, unless we have a legal obligation or legitimate basis to retain the data for longer.
We retain accounting and billing-related data for the period required by law. We retain data related to security, logs and abuse prevention for a limited period necessary to protect the service and investigate possible violations.
-
Cookies and Analytics
Our website may use cookies and similar technologies to ensure website functionality, improve user experience, analyze service use and provide users with relevant features.
Types of cookies used on our website:- Technical cookies - necessary for the proper operation of the website and to enable access to its functions. Without these cookies, the website services cannot be used.
- Functional cookies - allow the website to remember user choices (for example language preferences) and provide enhanced features. These cookies improve navigation quality and the overall user experience.
- Analytics cookies - help perform statistical analysis of visitor behavior and other website parameters. Data collected through these cookies is usually anonymous and used only for statistical purposes.
- Targeting or advertising cookies - used to display content and advertising that may be of interest to the user.
- Social media cookies - necessary to enable website content to be displayed and shared on social media platforms.
Technical cookies are necessary for the technical operation of the website and service and cannot be fully disabled. We use analytics, preference or marketing cookies only where there is an appropriate legal basis, including consent where required by law.
The user can change cookie preferences through the cookie settings available on the website, using the Cookiehub service integrated with Kingilist.
-
Accessing, Correcting and Removing Personal Data
- Personal data can be accessed and corrected through the service's user profile or by contacting customer support by email at kirjuta[at]kingilist.ee.
- Account closure and removal of personal data can be initiated by contacting customer support by email at kirjuta[at]kingilist.ee.