Privacy Policy
This policy explains how OM24.ee processes personal data when you use an account, publish listings and photos, communicate with other users, or contact support.
1. Data controller
The operator of OM24.ee and controller of personal data is Nedilko OÜ, registry code 17073523, Estonian Commercial Register (Äriregister), address Mustamäe tee 177-39, Mustamäe linnaosa, 12913 Tallinn, Harju maakond, Estonia. support@om24.ee.
2. Data we process
- account data: email address, user ID, and technical data related to account creation and sign-in;
- profile and contact data: display name, phone number and other information you choose to provide;
- listing data: title, description, price, location, category, condition, photos and other listing fields;
- communication data: OM24 messages, conversation participants, sent and read timestamps;
- usage and security data: request times, technical identifiers, IP address or a derived security key, listing-view and contact-reveal events, and logs needed to limit abuse;
- support requests and other information you send by email or through support channels;
- illegal-content notices: the reported URL, category, explanation, good-faith declaration, name and email where provided, and review and decision data.
3. Purposes and legal bases
- contract performance: providing accounts, listings, favourites, messaging and other core service functions;
- legitimate interests: service security, fraud and spam prevention, rate limiting, abuse investigation, troubleshooting and reliability;
- legal obligation: retaining or disclosing information where required by law, a competent authority, accounting obligations or the defence of legal claims;
- consent: only where we specifically request consent for a particular feature. Consent can be withdrawn for the future.
4. Public data
The content of an active listing, the seller’s display name and other information clearly intended for publication may be publicly visible. A phone number does not have to be displayed immediately on the page; the service may reveal it to a signed-in user through a separate contact function.
5. Service providers and recipients
We use processors and infrastructure providers for hosting, database, authentication, file storage, email delivery and abuse prevention. The current technical setup uses, among others, Beget, Supabase, Brevo and Cloudflare. They receive only the data needed to provide the relevant service. We do not sell personal data.
6. Transfers outside the EEA
Some providers may process data outside the European Economic Area. Where this occurs, we use transfer mechanisms and contractual safeguards permitted by applicable law. You can request information about a particular transfer and safeguard via our contact email.
7. Retention
- account and profile data are normally retained until account deletion, unless longer retention is required by law, a dispute or a security investigation;
- listings, images and related data are retained to operate the service and are removed under the listing and account deletion processes;
- conversations and messages are retained for as long as needed to provide messaging to the participants, resolve disputes and prevent abuse;
- security and rate-limit events are retained only for as long as needed for rate limiting, anti-fraud controls, security investigation or a legal claim;
- limited copies of deleted data may remain temporarily in backups or provider technical logs until the normal rotation cycle completes;
- illegal-content notices and decisions are retained for as long as needed to process the notice, demonstrate compliance with legal obligations, resolve disputes or defend legal claims, and are then deleted or anonymised when no further retention basis applies.
8. Cookies and local storage
OM24 uses cookies and browser storage necessary for sign-in sessions and security functions. Cloudflare Turnstile may use technical signals to prevent abuse. OM24 uses Google Analytics for aggregate traffic statistics. If analytics is declined, analytics cookies are not stored, but Google may receive limited cookieless measurement signals. If consent is granted, analytics cookies are enabled. Advertising storage and personalization remain disabled. The choice can be changed later through Analytics settings in the site footer.
9. Your rights
- obtain confirmation of processing and a copy of your personal data;
- have inaccurate data corrected;
- request erasure where a legal basis for erasure applies;
- request restriction or object to processing based on legitimate interests;
- receive data you provided in a machine-readable format where the right to portability applies;
- withdraw consent where processing is based on consent.
10. Account deletion
OM24 allows users to delete their accounts. Data linked to the account is removed in accordance with the service deletion process, including user-managed files, except where a separate legal basis requires retention or a limited technical backup period is unavoidable.
11. Security
We use access controls, private file storage, server-side image processing, security logging, abuse limits and other technical and organisational measures. No internet service can, however, guarantee absolute security.
12. Minors
The service is not directed to young children. Where a user does not have independent legal capacity under applicable law to enter into the agreement for use of the service, consent of a parent or other legal representative is required.
13. Complaints
If you are dissatisfied with our processing of personal data, please contact us first. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or another competent EEA supervisory authority.
14. Changes
We may update this policy when the service, applicable law or our processing practices change. The current version will be published on this page with its update date.