Privacy notice
In short: I contact businesses at their public business email addresses to offer my service. I use only public information to do that, I delete it 60 days after our last exchange if you don't become a client, and you can stop all contact by replying "no".
1. Who is responsible
The controller of your personal data is Markus Kask, trading as Porter & Key, Koka, Ardla küla, Saaremaa vald, 94531 Saare maakond, Estonia. Email: markus@porterandkey.com. For any privacy question or request, write to that address.
2. If I contacted your business
What I collect: your business name and address, the business email address published on your website or listing, your company's registration details from public registers, the public reviews of your property and how many of them have replies, and our email exchange.
Where it comes from: your own website, public listings on review and booking platforms, and public company registers (such as Companies House in the UK and US state business registers). I record where each email address came from.
Why, and on what basis: to offer you a service that may be relevant to your business, by one-to-one email. The legal basis is my legitimate interest in offering my service to businesses (Article 6(1)(f) GDPR and UK GDPR). I contact businesses only at business addresses, send at most two messages, and keep only what that needs.
Sample replies: to show how I work, I may draft one example reply to one of your public reviews. Reviewer names are removed before the text is used, including in AI tools.
How long: if you don't become a client, I delete this information 60 days after our last message. If you ask me not to contact you again, I keep only your business name and email address on a do-not-contact list, so that I can respect your request.
3. If you are a client
What I collect: contact details of the people I deal with, the details of our agreement, the information you give me for replies (tone, facts, approvals), and payment and invoicing records.
Basis: performing our contract, and keeping records that accounting and tax law require.
How long: service data (drafts, notes, approvals) is deleted 30 days after the agreement ends. Payment and accounting records are kept as long as the law requires.
Your guests' data: when I handle guest reviews for you, I do so on your behalf as your processor, under our data-processing agreement. Your guests should contact you about their data.
4. This website
This site uses no cookies, no analytics and no tracking, and loads nothing from third parties. The hosting provider keeps short-term technical server logs (such as IP addresses) to run and protect the site.
5. Who else handles the data
I don't sell personal data or share it for anyone else's marketing. I use these service providers to run the business:
- Email: Zoho Mail, hosted in its EU data centre.
- Website hosting: Netlify.
- AI drafting: Anthropic (Claude). Client data is processed only under Anthropic's commercial terms.
- Payments: my bank and payment provider, for clients only.
Some of these providers are based in, or use servers in, the United States. Where data leaves the EU or UK, it is protected by the safeguards the law requires, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
6. Your rights
You can ask to see, correct or delete your data, to restrict how I use it, or to receive a copy. You can also object to my use of it at any time. If you object to being contacted, I stop immediately: just reply "no" to any email, or write to the address above. I reply to requests within one month.
You can also complain to a data protection authority. In Estonia that is the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). In the UK it is the Information Commissioner's Office (ico.org.uk). I'd be grateful for the chance to sort it out with you first.
7. Changes
If this notice changes, the new version will be posted here with a new date.