Privacy Policy
Last updated: June 2026
Cosmetic Peat Association MTÜ (CPA, "we", "us") operates the website cosmeticpeat.org. This policy explains what data we collect, why, and what rights you have under the General Data Protection Regulation (GDPR).
Who we are
Cosmetic Peat Association MTÜ
Registrikood: 80673322
Laulupeo tn 20a-2, 10128 Tallinn, Estonia
Contact: [email protected]
We are the data controller for personal data processed through this website.
What data we collect
Analytics (Google Analytics 4)
With your consent, we use Google Analytics 4 to understand how visitors use this site. This may collect:
- Pages visited and time spent
- Approximate geographic location (country/city level)
- Device and browser type
- Referral source (how you found the site)
This data is aggregated and anonymised. We do not collect names, email addresses, or other identifying information through analytics. Google Analytics data is processed by Google Ireland Limited under their own privacy policy. We have enabled IP anonymisation.
Legal basis: Consent (Article 6(1)(a) GDPR). Analytics cookies are only set after you give consent via the cookie banner.
Contact enquiries
If you contact us by email, we store your email address and message content to respond to your enquiry. We do not add you to any mailing list without explicit consent.
Legal basis: Legitimate interest in responding to enquiries (Article 6(1)(f) GDPR).
Cookies
We use the following cookies:
| Cookie | Purpose | Duration | Requires consent |
|---|---|---|---|
| cookie_consent | Stores your cookie preference | 1 year | No (functional) |
| _ga, _ga_* | Google Analytics — visitor statistics | 2 years | Yes |
You can withdraw consent at any time by clearing your browser's cookies and localStorage for this site, or by contacting us.
Third-party services
- Google Analytics 4 — analytics (consent required). Google Privacy Policy
- Google Fonts — font files loaded from Google's CDN. Google may log the request. No personal data is sent beyond a standard HTTP request.
- Cloudflare — our hosting provider. Cloudflare processes traffic logs for security and performance. See Cloudflare Privacy Policy.
Your rights under GDPR
As a data subject in the EU/EEA, you have the right to:
- Access — request a copy of personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data
- Restriction — ask us to limit processing of your data
- Objection — object to processing based on legitimate interest
- Portability — receive your data in a structured, machine-readable format
- Withdraw consent — withdraw analytics consent at any time without affecting past processing
To exercise any right, contact us at [email protected]. We will respond within 30 days. If you are unsatisfied with our response, you may lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee).
Data retention
Analytics data is retained for 14 months in Google Analytics, after which it is automatically deleted. Contact email correspondence is retained for as long as necessary to resolve the enquiry, then deleted.
Children
This website is not directed at children under 16. We do not knowingly collect data from children.
Changes to this policy
We may update this policy when our practices change. Material changes will be noted with an updated date at the top of this page.