Privacy policy

Ondara OÜ ("Ondara", "we", "us", "our") operates the website ondara.now (the "Platform"). Ondara OÜ is a company registered in Estonia. This Privacy policy explains how we collect, use, disclose, and protect your personal data when you use our Platform. By accessing or using the Platform, you acknowledge that you have read and understood this Privacy policy.

1. Data controller

The data controller responsible for your personal data is:

Ondara OÜ
Registry code: 17490209
Registered address:
Tornimäe tn 5
Kesklinna linnaosa
10145 Tallinn
Harju maakond
Estonia
Email: hello@ondara.now

If you are located in the European Union, you also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.

2. Eligibility

The Platform is intended for individuals aged 18 years or older. We do not knowingly collect personal data from individuals under 18.

3. Personal data we collect

We collect personal data necessary to operate the Platform and provide services.

3.1 Information you provide

• Full name
• Email address
• Phone number (if provided)
• Account login details
• Offering registration details
• Messages sent via the Platform
• Information provided when contacting support

3.2 Payment information

Payments are processed by third-party payment providers. Ondara does not store full card details. We may receive limited transaction data such as:

• Payment status
• Transaction ID
• Amount
• Date

3.3 Information shared with facilitators

When you book an offering, we share necessary information with the facilitator, such as:

• Name
• Contact details
• Booking details

Facilitators act as independent data controllers regarding the services they provide.

3.4 Automatically collected information

When you use the Platform, we may collect:

• IP address
• Browser type
• Device information
• Pages visited
• Time spent on pages
• Cookies and usage data

4. Legal bases for processing

We process personal data on the following legal bases:

Contract performance

To:

• Create and manage user accounts
• Process bookings
• Facilitate payments
• Provide customer support

Legitimate interests

To:

• Improve the Platform
• Prevent fraud and misuse
• Ensure platform security
• Analyse usage patterns

We ensure our legitimate interests do not override your fundamental rights.

Consent

To:

• Send marketing communications (if opted in)
• Place non-essential cookies

You may withdraw consent at any time.

Legal obligations

To:

• Comply with accounting and tax laws
• Respond to lawful authority requests

5. How we use your information

We use your personal data to:

• Provide access to the Platform
• Facilitate bookings between participants and facilitators
• Collect payments as commercial agent for facilitators
• Communicate regarding bookings or updates
• Improve user experience
• Ensure compliance with legal requirements

6. Sharing of personal data

We do not sell your personal data. We may share your data with:

6.1 Facilitators

To enable offering participation and communication. Facilitators are independent controllers responsible for their own data processing practices.

6.2 Service providers (Processors)

We use trusted third-party providers to operate the Platform, including:

• Payment processors
• Hosting providers
• Email service providers
• Analytics providers

These providers process data on our behalf under data processing agreements.

6.3 Legal requirements

We may disclose data if required by law or to protect rights, safety, or property.

7. International transfers

If personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses
• Adequacy decisions
• Other lawful mechanisms under GDPR

8. Data retention

We retain personal data only as long as necessary for the purposes described above. Typical retention periods:

• Account data: retained while account is active
• Booking and transaction records: up to 7 years (for accounting compliance)
• Marketing data: until consent is withdrawn
• Support inquiries: up to 3 years

We may retain data longer where required by law or for dispute resolution.

9. Cookies

We use cookies and similar technologies. Cookies may include:

• Strictly necessary cookies (required for platform functionality)
• Analytics cookies (to improve services)
• Marketing cookies (if applicable)

Non-essential cookies are placed only with your consent, where required by law. You may manage cookie preferences through your browser settings or consent banner.

10. Data security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction acknowledging that no online system is completely secure.

11. Your rights under GDPR

If you are in the EU, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request deletion ("right to be forgotten")
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

To exercise your rights, contact: hello@ondara.now
We may request identity verification before fulfilling requests.

12. Third-party links

The Platform may contain links to third-party websites. We are not responsible for their privacy practices.

13. Changes to this Privacy policy

We may update this Privacy policy from time to time. If material changes are made, we will notify users where required. Continued use of the Platform after updates constitutes acceptance of the revised policy.