This Privacy & Cookie Policy explains how BeHumbo OÜ ("BeHumbo", "we", "us" or "our") collects, uses, stores and shares your personal data when you visit behumbo.co, apply to a retreat or workshop, subscribe to our newsletter, or otherwise interact with us. It also describes the cookies and similar technologies we use on our website.
We act as the data controller for the personal data described in this policy. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).
1. Who we are
- Legal entity: BeHumbo OÜ
- Registered in: Republic of Estonia
- Registered office: Tallinn, Estonia
- Contact for privacy matters: hello@behumbo.co
We have not appointed a statutory Data Protection Officer because we are not required to do so under Article 37 GDPR. You can reach our privacy contact at the email above for any data protection question.
2. Personal data we collect
We only collect personal data that we genuinely need. Depending on how you interact with us, this may include:
a) Information you provide
- Identification and contact details (full name, email address, phone number, country/city, company and role).
- Application and intake form responses for retreats and workshops (e.g. motivation, goals, professional background, language preference).
- Feedback, testimonial and survey responses.
- Scheduling information when you book a discovery call (via Cal.com or Google Calendar).
- Correspondence you send us (e.g. emails to hello@behumbo.co).
- Billing details for corporate invoicing (company name, VAT/registration number, billing address).
b) Information collected automatically
- Technical data such as IP address, device type, browser, operating system, language, referring URL and pages visited.
- Usage data such as interactions with our pages, buttons, forms and scheduling tools.
- Cookie identifiers and similar technologies — only as described in Section 7 and subject to your consent for non-essential cookies.
c) Information from third parties
- Information from our scheduling, payment and analytics providers (e.g. confirmation that a meeting was booked, aggregate analytics metrics).
We do not intentionally collect special categories of personal data (such as health, religion or political opinions). Please do not share such information with us through forms unless strictly necessary for your participation in a program.
3. Why we use your data and on what legal basis
We process your personal data for the following purposes, on the legal bases indicated:
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Processing applications, managing your participation in retreats and workshops, and communicating about them. | Performance of a contract / steps prior to entering a contract (Art. 6(1)(b)). |
| Responding to inquiries sent via email or contact forms. | Our legitimate interest in responding to you (Art. 6(1)(f)). |
| Sending newsletters and program updates. | Your consent (Art. 6(1)(a)); you can withdraw it at any time. |
| Issuing invoices and meeting accounting / tax obligations. | Legal obligation (Art. 6(1)(c)) under Estonian accounting and tax law. |
| Analytics, measuring marketing performance and improving our website. | Your consent for non-essential cookies (Art. 6(1)(a)). |
| Ensuring site security, preventing fraud and abuse. | Our legitimate interest in protecting our service (Art. 6(1)(f)). |
| Publishing testimonials with your name and role. | Your explicit consent at the moment of submission (Art. 6(1)(a)). |
4. Who we share your data with
We do not sell your personal data. We share it only with the following categories of recipients, and only to the extent necessary:
- Hosting & infrastructure: our hosting and backend provider stores form submissions and serves the website.
- Scheduling: Cal.com and Google Calendar for discovery and intro calls.
- Payments: Stripe processes payments for paid programs (where applicable). We do not store full card details on our servers.
- Analytics & tag management: Google Analytics 4 and Google Tag Manager, only when you consent to analytics cookies.
- Email & newsletter: our email service providers, including Substack for the newsletter.
- Professional advisors: accountants, lawyers and auditors, where strictly necessary.
- Authorities: public authorities when we are legally required to disclose information.
These recipients act as our processors or as independent controllers and are bound by appropriate data protection obligations.
5. International transfers
Some of our service providers are located outside the European Economic Area (EEA), in particular in the United States. When personal data is transferred outside the EEA, we rely on appropriate safeguards under GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy decision (e.g. the EU–US Data Privacy Framework, where applicable to the provider).
6. How long we keep your data
- Application and program data: kept for the duration of the program and up to 24 months afterwards, to support alumni communications and quality improvement.
- Inquiries and email correspondence: kept up to 24 months after the last interaction.
- Newsletter subscriptions: kept until you unsubscribe.
- Invoicing and accounting records: kept for 7 years, as required by Estonian accounting law.
- Analytics data: kept according to the retention period configured in Google Analytics 4 (up to 14 months).
- Cookie consent record: kept for 6 months and then re-requested.
When the retention period ends, we delete or anonymize the personal data, unless we are legally required to keep it longer.
7. Cookies and similar technologies
We use cookies and similar technologies to operate the site, remember your choices, analyze traffic and (with your consent) measure marketing performance. We group cookies into three categories:
- Essential cookies — required for the website to function and for us to remember your cookie preferences. Always active. They include our consent cookie
behumbo_cookie_consent(6-month retention). - Analytics cookies — set by Google Analytics 4 via Google Tag Manager to understand how visitors use the site (e.g. pages visited, buttons clicked, form completion). Active only with your consent.
- Marketing cookies — used to measure ad performance and personalize content. Active only with your consent.
We implement Google Consent Mode v2: until you make a choice, analytics and marketing storage are denied by default and Google services run in a consent-aware mode. Your choices are stored in a first-party cookie on your device and applied on subsequent visits.
You can change your cookie choices at any time using the button below, or by clearing the cookie in your browser settings.
8. Your rights under GDPR
Subject to the conditions of the GDPR, you have the right to:
- Access the personal data we hold about you and receive a copy of it.
- Request correction of inaccurate or incomplete data.
- Request deletion of your data ("right to be forgotten").
- Request restriction of processing in certain situations.
- Object to processing based on our legitimate interests.
- Receive your data in a structured, machine-readable format (data portability).
- Withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Not be subject to a decision based solely on automated processing that produces legal effects (we do not carry out such automated decision-making).
To exercise these rights, contact us at hello@behumbo.co. We will respond within 30 days. You also have the right to lodge a complaint with a data protection authority, in particular the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or with the supervisory authority of your country of residence.
9. Security
We apply reasonable technical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure, including encryption in transit (HTTPS), access controls, and use of reputable infrastructure providers. No method of transmission or storage is 100% secure, but we work to continuously improve our security posture.
10. Children
Our website and programs are not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Third-party links
Our website contains links to third-party websites (for example LinkedIn, Instagram, Substack, Cal.com, Google Calendar and Stripe). We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before providing them with personal data.
12. Changes to this policy
We may update this Privacy & Cookie Policy from time to time to reflect changes in our practices, technology, legal requirements or other reasons. The "Last updated" date at the top indicates when it was last revised. Material changes will be communicated through the website or by email where appropriate.
13. Contact us
For any questions about this policy or how we handle your personal data, please contact us at hello@behumbo.co.
BeHumbo OÜ · Tallinn, Estonia