Privacy policy
In force from 27.08.2026.
Kodu is a real-estate listings portal, operated by Gravitational Wave OÜ (registry code 12475903, Tallinn, Estonia), who is the controller of the personal data described here. Write to us at info@comm.ee.
1. What we collect
Account. Your email address, username, and your name if you have added one. It is the same account you use for the other comm.ee services.
Listings. The address, price, floor area, number of rooms, condition, photographs and description — everything the advertiser types in themselves. A listing is public.
Enquiries. When you write to an advertiser we pass them your name, your email address and the text of your message. Without that they cannot answer you.
Usage. Which pages are opened, when, and from what kind of device. We use our own visitor counter for this — it keeps a random marker in a cookie and in localStorage, along with the IP address and the browser's description. We do not use Google Analytics or any other third-party tracker.
Payments. That a payment arrived, its amount, the payer's name and the reference. We never see or store card details — payment goes through the bank.
2. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Keeping an account and signing in | contract (GDPR art 6(1)(b)) |
| Publishing and searching listings | contract |
| Passing an enquiry to an advertiser | contract |
| Invoicing and bookkeeping | legal obligation |
| Checking the identity validation payment | legitimate interest — preventing fraud |
| Visitor statistics | legitimate interest — measuring and improving the service |
| Security and preventing abuse | legitimate interest |
3. How long we keep it
- Account — until you delete it. After that the account's data is removed.
- Listings — until the advertiser removes them; we keep no archive copy.
- Enquiries — 12 months, so that what was asked is visible if there is a dispute.
- Accounting records — 7 years, as Estonian accounting law requires.
- Visitor statistics — 24 months.
- Sign-in links and sessions — a link for 30 minutes, a session until you sign out.
4. Who we share it with
- The advertiser or agency whose listing you write to.
- The bank the payment goes through.
- Our server partners, who hold the data inside the European Union.
- Authorities, where the law obliges us.
We do not sell personal data and we do not pass it to third parties for marketing. Data is not transferred outside the European Economic Area.
5. Your rights
You have the right to:
- see what we hold about you;
- correct anything inaccurate;
- delete your account and data, unless the law requires us to keep it;
- restrict processing, or object to processing done on the basis of a legitimate interest;
- take your data with you in a machine-readable form;
- complain to the Estonian Data Protection Inspectorate (aki.ee).
Write to info@comm.ee — we answer within one month at the latest.
6. Security
Passwords and every token are stored hashed, never in readable form. The connection is encrypted. A sign-in link works once and expires in 30 minutes. An account can be given two-step verification.
No system is completely secure. If we learn of a breach likely to put your rights at risk, we will tell you and the Data Protection Inspectorate within the period the law sets.
7. Changes
If we change this policy materially we will say so in the portal before the change takes effect. The date above is when the present text started to apply.