Privacy policy

Last updated: 18 October 2026

1. Data controller

  • Controller: NORBA TRAVEL OÜ
  • Registry code: 17597060
  • Country of registration: Estonia
  • Address: Tornimäe tn 5, 10145 Tallinn, Kesklinna linnaosa, Harju maakond, Estonia
  • VAT number: EE103029739
  • Contact: [email protected]

2. What data we process, and why

We process only the data you give us through the contact form: name, email and, if you provide them, company, phone, the service you are interested in, a rough budget, a number of pages and the content of your message. We also record the IP address the form was sent from, to prevent abuse.

  • Purpose: to answer your enquiry, prepare a proposal and, if you accept it, manage the contract and the invoicing.
  • Legal basis: steps taken at your request before entering into a contract (art. 6.1.b GDPR) and, if you hire us, performance of the contract (art. 6.1.b) and the legal obligations around invoicing (art. 6.1.c). The IP address the form is sent from is processed in our legitimate interest in preventing abuse (art. 6.1.f) and is kept with your enquiry.
  • We make no automated decisions and build no profiles.

3. How your data reaches us

The form sends an email to our inbox and an acknowledgement to your address. We use Resend, operated by Plus Five Five, Inc. (San Francisco, United States), to send those emails, acting as a data processor. Resend stores its email records in the United States; the transfer rests on the EU–US Data Privacy Framework, under which Plus Five Five, Inc. is certified, with the standard contractual clauses approved by the European Commission as the fallback.

4. How long we keep it

If we do not end up working together, we keep your enquiry for at most 12 months. If you hire a service, the invoices and the data needed for them are kept for 7 years, as the Estonian Accounting Act (raamatupidamise seadus, § 12) requires.

5. Who else sees it

We do not pass your data to third parties except where the law requires it. The only providers that access it as processors are Resend (Plus Five Five, Inc.; email delivery, United States), Render Services, Inc. (website hosting in its Frankfurt region; a US company certified under the EU–US Data Privacy Framework) and the provider of our email inbox.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to the contact address above. You can also lodge a complaint with the Estonian supervisory authority (Andmekaitse Inspektsioon, www.aki.ee) or with the authority in your own EU country of residence — in Spain, the Agencia Española de Protección de Datos (www.aepd.es).

7. Cookies

This site uses technical storage only, to remember your cookie choice. See the cookie policy.