Privacy policy

1. GENERAL PROVISIONS

This privacy policy explains how Coldasana OÜ (registry code 17261271, hereinafter we) collects, uses, stores, discloses and protects personal data processed through the website gaetanloubrieu.ee and in the course of providing our services.

Wim Hof Method workshop facilitator and retreat organiser.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR), the Estonian Personal Data Protection Act, the Electronic Communications Act and other applicable Estonian legislation.

This policy applies to all website visitors, enquirers and clients. By using the website and providing us with your data, you confirm that you have read this policy.

2. DATA CONTROLLER AND CONTACT DETAILS

The controller of your personal data is:

Please direct any questions, requests or complaints regarding the processing of personal data to info@gaetanloubrieu.ee. We respond within one month of receiving a request.

We are not required to appoint a data protection officer, as we do not process personal data on a large scale or systematically. Data protection matters are handled by a company representative at the contact details above.

3. DEFINITIONS

• Personal data – any information relating to an identified or identifiable natural person, such as a name, email address, phone number, address, IP address or device identifier.
• Data subject – the natural person whose data is processed: a website visitor, enquirer, client or a representative of a business partner.
• Processing – any operation performed on personal data: collection, recording, use, transmission, storage, alteration and erasure.
• Controller – us, as we determine the purposes and means of processing personal data.
• Processor – a service provider that processes personal data on our behalf and on our instructions.
• Cookie – a small text file that a website stores on a visitor’s device.

4. WHAT DATA WE PROCESS, WHY AND ON WHAT BASIS

We process personal data only for specific and lawful purposes and only for as long as necessary. The table below sets out what data we process, for what purpose and on what legal basis.

Purpose | Data processed | Legal basis | Retention period
Responding to enquiries and preparing quotations | Name, email address, phone number, company name and registry code, content of the enquiry, time of the enquiry | Steps taken at your request prior to entering into a contract (GDPR Art. 6(1)(b)) | 3 years
Providing services and performing the contract | Name, contact details, order and communication history | Performance of a contract (GDPR Art. 6(1)(b)) | 3 years after the contract ends
Invoicing and accounting | Name, billing and contact details, transaction data | Compliance with a legal obligation (GDPR Art. 6(1)(c)), Estonian Accounting Act | 7 years from the end of the financial year
Sending newsletters and offers | Name, email address, email engagement statistics | Consent (GDPR Art. 6(1)(a)) | Until consent is withdrawn
Website usage statistics and improvement | Pages visited, time and duration of the visit, approximate location, device and browser data, truncated IP address | Consent to the use of cookies (GDPR Art. 6(1)(a)) | 14 months
Measuring advertising performance and targeted advertising | Device identifier, cookie ID, pages viewed and actions taken | Consent (GDPR Art. 6(1)(a)) | Up to 90 days (cookie lifetime); thereafter as governed by the advertising platform’s terms
Publishing comments | Name or username, email address, comment content, IP address | Consent (GDPR Art. 6(1)(a)) | Until the comment is deleted
Website security and fault detection | IP address, request time, browser used, server logs | Legitimate interest in protecting the website against misuse (GDPR Art. 6(1)(f)) | Up to 12 months
Establishing and defending legal claims | Communication and transaction data | Legitimate interest (GDPR Art. 6(1)(f)) | Until the claim becomes time-barred

Where we rely on legitimate interests, we have balanced our interest against your rights beforehand. You have the right to object to such processing at any time.

5. SOURCES OF PERSONAL DATA

We obtain personal data from the following sources:

• From you – when you complete a form on the website, email us, call us or enter into a contract with us.
• Automatically when you visit the website – technical data such as IP address, browser and device type, pages visited and the referring website.
• From advertising and social media platforms – aggregated statistics on advertising performance in which individuals are not identifiable.
• From the Estonian Business Register – representative and contact details of corporate clients.

Providing data is voluntary, but without contact details we cannot respond to your enquiry or provide the service.

6. COOKIES

A cookie is a small text file that a website stores on your computer, phone or other device. Cookies help the website function correctly, remember your choices and allow us to measure how the website is used.

Types of cookies

• Strictly necessary cookies – enable core website functions such as form submission, security and remembering your cookie choices. These are always active.
• Statistics cookies – help us understand how visitors use the website so we can improve it. We use these only with your consent.
• Marketing cookies – allow us to measure advertising performance and show you more relevant ads. We use these only with your consent.

By duration, cookies are either session cookies, which are deleted when you close the browser, or persistent cookies, which remain on the device for a set period.

Consent and its withdrawal

When you first visit the website we display a cookie notice. Strictly necessary cookies are always set. Statistics and marketing cookies are set only if you have given your consent. We use CookieAdmin to collect consent.

You may withdraw your consent at any time. To do so, open the cookie settings on the website and change your choices, or delete cookies in your browser settings. Withdrawal does not affect the lawfulness of processing carried out before it.

Cookies can also be managed and deleted in your browser settings (Chrome, Firefox, Safari, Edge). Note that blocking all cookies may prevent the website from working properly.

Cookies used on this website

This list is indicative. Cookie names and lifetimes may change as providers update their services. The current list is available in the website’s cookie settings.

We use Google Search Console to monitor the website’s search performance. This tool does not set cookies on visitors’ devices or collect personal data — we see only aggregated statistics on search queries and clicks.

The website loads fonts from Google Fonts. This transmits your IP address to Google. Fonts are loaded only after you have given consent.

7. WHO WE SHARE DATA WITH

Our staff and partners access personal data only to the extent necessary for their tasks. We use service providers (processors) with whom we have concluded data processing agreements and who may process data only on our instructions.

• Veebimajutus.ee (Radikaal OÜ) – website hosting (servers located in Estonia).
• Elementor Forms – web form handling; form data is stored in the website database and forwarded to our email.
• Google Ireland Limited – web analytics, tag management, advertising and embedded services.
• Meta Platforms Ireland Limited – advertising performance measurement and social media features.
• Mailerlite – sending newsletters and managing the mailing list.
• IT and web development provider – website maintenance and fault repair.
• Public authorities – only where disclosure is required by law.

We do not sell or rent your personal data to third parties and we do not use it for purposes we have not informed you about.

8. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

Some of the providers we use (such as Google and Meta) belong to international groups and may process data outside the European Economic Area, in particular in the United States.

In such cases the transfer is safeguarded by one or more of the following:

• an adequacy decision of the European Commission — for example the EU–U.S. Data Privacy Framework, to which the relevant providers have certified;
• standard contractual clauses (SCCs) approved by the European Commission, together with supplementary technical and organisational safeguards.

For more detail on a specific transfer and the safeguards applied, please contact us at info@gaetanloubrieu.ee.

9. DATA SECURITY AND RETENTION

We apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, alteration, disclosure or other misuse. Among other things:

• the website uses an encrypted connection (SSL/TLS);
• access to personal data is limited to those who need it to perform their duties;
• we use strong passwords and, where available, two-factor authentication;
• website software and plugins are kept up to date and backups are taken regularly;
• data processing agreements and confidentiality undertakings are in place with our partners.

We retain personal data only for as long as necessary to achieve the purpose of processing or to comply with a legal obligation. The periods are set out in the table above. When the basis for retention ceases, we erase the data or render it anonymous.

If a personal data breach is likely to result in a high risk to your rights, we notify the Estonian Data Protection Inspectorate within 72 hours and, where necessary, inform you directly.

10. YOUR RIGHTS

In relation to the processing of your personal data you have the following rights:

• Access – to obtain confirmation of whether we process your data and to receive a copy of it.
• Rectification – to have inaccurate or incomplete data corrected or completed.
• Erasure – to have data erased where it is no longer needed or where processing was based on consent that you have withdrawn. The right to erasure does not extend to data we are legally required to retain (for example accounting source documents).
• Restriction of processing – to have processing suspended temporarily, for example while the accuracy of the data is verified.
• Data portability – to receive the data you have provided in a machine-readable format or have it transmitted to another controller.
• Objection – to object to processing based on our legitimate interests, and to object at any time to the use of your data for direct marketing.
• Withdrawal of consent – to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, send a request to info@gaetanloubrieu.ee. We respond within one month. Where a request is complex, we may extend that period by up to two further months and will inform you beforehand. We may request additional information to verify your identity.

If you believe your rights have been infringed, you may lodge a complaint with the Estonian Data Protection Inspectorate (Tatari 39, 10134 Tallinn, email info@aki.ee, website www.aki.ee) or bring proceedings before a court.

11. DIRECT MARKETING

We send offers and newsletters by email only if you have given prior consent. Giving consent is voluntary and is not a condition of receiving our services.

Every message contains a link allowing you to unsubscribe. You may also withdraw consent by writing to info@gaetanloubrieu.ee.

We use open and click statistics to understand which content is of interest to recipients. We do not take decisions with legal effect on you on that basis.

12. AUTOMATED DECISION-MAKING AND PROFILING

We do not take decisions concerning you based solely on automated processing that would produce legal effects or similarly significantly affect you.

Advertising platforms may show you more relevant ads based on cookies used with your consent. This constitutes profiling for marketing purposes; it has no legal effect on you and you can stop it at any time by withdrawing cookie consent or changing your ad preferences on the platform.

13. EMBEDDED CONTENT AND LINKS TO OTHER WEBSITES

Our website may contain embedded content from other platforms, such as YouTube or Vimeo videos.

Embedded content behaves exactly as if you visited that website directly: the provider may collect data about you, use cookies and monitor your interaction with the content. We load such content only after you have given consent.

The website contains links to other websites whose content and privacy practices we are not responsible for. We recommend reviewing their privacy policies separately.

14. CHILDREN’S DATA

Our services and website are not directed at children under 13 and we do not knowingly collect their personal data. In Estonia the age of consent for information society services is 13.

If we learn that we have collected data from a child under 13 without the consent of a legal representative, we erase it as soon as possible. Please notify us at info@gaetanloubrieu.ee.

15. CHANGES TO THIS POLICY

We may amend this privacy policy from time to time, for example when our services, the tools we use or applicable law change. The current version is always available at gaetanloubrieu.ee.

We will notify you of material changes on the website or by email.

This privacy policy is effective from September 4, 2026.

16. CONTACT US

If you have questions about the processing of personal data or wish to exercise your rights, please contact us:

• Email: info@gaetanloubrieu.ee
• Phone: +372 5474 0344
• Address: Jahu tn 6/2-71 Tallinn Harjumaa 10415

We will respond as soon as possible and no later than within one month.