Privacy Policy

1. Introduction & Data Controller

This Privacy Policy sets out how Vault Sprout Rank Media OÜ (“we”, “us”, “our”, or the “Company”), registered under Registry Code EE102489115 at Telliskivi Loomelinnak 60a/5, Põhja-Tallinna, 10412 Tallinn, Estonia, processes personal data of readers, visitors, and contributors to the culinary publication website hosted at vaultsproutrankltt.cfd.

As an independent Baltic culinary publication, we are committed to respecting your privacy in strict accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation or GDPR), the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus), and international consumer privacy frameworks including the California Consumer Privacy Act (CCPA/CPRA).

2. Personal Data We Collect

We may collect and process the following categories of personal data:

• Directly Provided Information: When you contact our editorial desk via our contact form or email, we collect your name, email address, message subject, and the contents of your communication.
• Technical & Browsing Data: Anonymized or pseudonymized IP addresses, browser vendor and version, operating system details, referring URL, time spent on culinary dossier pages, and timestamp records.
• Preference Data: Local storage selections regarding cookie consent, language preferences, and interactive map filtering states.

3. Legal Bases for Processing (GDPR Article 6)

We process your personal information under the following legal bases:

• Consent (Art. 6(1)(a)): When you provide clear consent for non-essential cookies and analytics trackers via our smart cookie preferences banner.
• Contractual Necessity / Inquiries (Art. 6(1)(b)): To review, process, and respond to editorial inquiries, partnership questions, or reader feedback.
• Legitimate Interests (Art. 6(1)(f)): To safeguard the integrity, cybersecurity, and operational functionality of our web server infrastructure and culinary atlas application.
• Legal Obligations (Art. 6(1)(c)): To maintain compliance with applicable European tax, accounting, and consumer protection reporting mandates.

4. Cookies & Tracking Technologies

Our web platform utilizes essential and optional cookies and client-side storage keys. Detailed categorizations, durations, and opt-out methodologies are comprehensively outlined in our standalone Cookie Policy. You retain the absolute right to modify or revoke cookie consent at any point in time.

5. Third-Party Service Providers & Data Transfers

We do not sell, rent, or lease your personal data. We only share data with trustworthy technical infrastructure processors bound by strict Data Processing Agreements (DPAs), including European-based cloud hosting providers, web analytics processors configured with IP anonymization, and security firewall vendors. All international data transfers comply with standard contractual clauses (SCCs) approved by the European Commission.

6. Data Retention Schedules

We retain personal data strictly for as long as necessary to fulfill the operational purposes described herein:

• Editorial Correspondence: Retained for a maximum period of twenty-four (24) months following resolution of your inquiry.
• Analytics Metrics: Stored in aggregated, anonymized form for thirty-six (36) months to gauge regional readership trends across Estonia, Latvia, and Lithuania.
• Cookie Consent State: Stored locally in your client device browser storage for up to twelve (12) months.

7. Your GDPR & CCPA/CPRA Privacy Rights

Under applicable European data protection legislation, you possess the following enforceable rights:

• Right of Access (GDPR Art. 15): Obtain confirmation as to whether your personal data is processed and request copies of records.
• Right to Rectification (GDPR Art. 16): Rectify inaccurate or incomplete personal records.
• Right to Erasure / “Right to be Forgotten” (GDPR Art. 17): Request deletion of your personal data where retention is no longer justified.
• Right to Restriction of Processing (GDPR Art. 18): Restrict processing under contested circumstances.
• Right to Data Portability (GDPR Art. 20): Receive your personal data in a structured, machine-readable format.
• Right to Object (GDPR Art. 21): Object to processing predicated on our legitimate interests.

8. Protection of Children’s Privacy

Our culinary publication and food guides are not directed toward children under the age of sixteen (16). We do not knowingly solicit or collect personally identifiable information from minors.

9. Data Protection Officer & Editorial Inquiries

To exercise your statutory privacy rights, submit a data subject access request (DSAR), or communicate with our designated Data Protection Officer, please contact our administrative desk:

You also hold the right to lodge a formal complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or your local European Union supervisory authority.