about our privacy policy

Last updated: 29.09.2026

At gotoAndPlay, we take information security seriously. Here you can learn what personal data we collect, what we use it for, who can access it, how long we keep it and what rights you have.

Data controller:

  • Company: gotoAndPlay OÜ
  • Address: Emajõe 1b, 51008 Tartu, Estonia
  • Reg. code: 12156256
  • E-mail:
  • Phone: +372 5623 1321

Got a question about your data? Just drop us a line at info@play.ee.

What data we collect and why:

  • When you contact us. Through the contact form, e-mail or phone we get your name, e-mail, phone number, company and message, and we use them to answer you. Why? You asked us to get in touch before working together, or we simply have a legitimate interest in replying to your question. We keep them for 24 months after we last talked, unless we start working together.

  • When we work together. To provide our services, we use contact persons’ names, e-mails, phone numbers, job titles, our correspondence and invoicing details. Why? We need it to fulfil our contract, and the law requires some of it, for example for accounting. We keep them for the length of the contract plus 3 years, and accounting documents for 7 years, as the Estonian Accounting Act requires.

  • When you apply for a job. We use your CV, cover letter, contact details, portfolio links, interview notes and test task results to get to know you and decide on the role. Why? You asked us to consider you for a job. We keep them until the recruitment ends.

  • When you play the game on our homepage. If you choose to add your name to the leaderboard, we show it next to your time. Why? You’ve given us your consent. We keep entries until the leaderboard is reset, and remove yours sooner if you ask.

  • When you register for our events. We use your name, e-mail, company and any dietary needs you share to organise the event. Why? We need it to fulfil your registration. We keep them until the event is over.

  • When you browse our website (Google Analytics). Only if you accept analytics cookies, we collect a cookie ID, the pages you visit, time spent on the site, your device, browser and approximate location based on your IP address (Google Analytics doesn’t store the IP address itself). Why? You’ve said yes to analytics cookies. We keep this data for up to 14 months.

  • When you use the contact form (spam protection). The form is protected by Google reCAPTCHA, which looks at your IP address, browser and device data and how you interact with the page. Why? We have a legitimate interest in keeping spam and bots out. Google processes this data under its own terms.
  • Server logs. The server that hosts our website (play.ee) records queries made to it: IP address, access time, page opened, browser and device. This data is used only for technical purposes, to keep the website running smoothly and to investigate any incidents. Why? We have a legitimate interest in keeping our website secure and working. We keep logs for 30 days, and longer only while investigating an incident.

You don’t have to give us any personal data. Without it, though, we can’t answer you, consider your application or work together.

When we build or support websites and software for our clients, we sometimes handle personal data of their users. In that case we act on the client’s instructions as a processor, under a data processing agreement, and the client’s own privacy policy applies.

About legitimate interest:

Where we rely on legitimate interest, we’ve weighed our interest against your rights and use only the data we really need. You can object to it at any time (see “Your rights” below).

Who can access your data:

We never sell personal data. It can only be accessed by team members who need it for their work and by service providers who help us run things:

  • Veebimajutus – hosts our website and server logs (Estonia)
  • Google Workspace – e-mail and documents (EU/USA)
  • Google Ireland Ltd – Google Analytics and reCAPTCHA (EU, with transfers to the USA)
  • Merit – invoicing and bookkeeping (Estonia)
  • Notion – client projects and enquiries (EU)

We also share data with authorities when the law requires it.

gotoAndPlay is part of the Play & NOPE Alliance. When a project needs design, we may share your enquiry with our alliance partner NOPE OÜ.

Data leaving the EU:

Some providers, like Google, may transfer data to the United States. We only allow this when the recipient is certified under the EU–US Data Privacy Framework, or when standard contractual clauses approved by the European Commission are in place.

Your rights:

  • See your personal data and learn how we use it
  • Correct your personal data
  • Delete your personal data, unless the law requires us to keep it
  • Restrict how we use your data while a question or complaint is being sorted out
  • Get the data you gave us in a machine-readable format, or have it sent to another company
  • Object to processing based on our legitimate interest
  • Object to direct marketing at any time – we’ll stop right away
  • Withdraw your consent at any time, for example through “Cookie preferences” at the bottom of every page. This doesn’t affect what we did before you withdrew it.

You can exercise any of said rights by sending us an e-mail at info@play.ee. We’ll reply within one month and may ask you to confirm who you are.

If you think we’ve handled your data wrongly, please talk to us first – we’d like to put it right. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, , www.aki.ee, or to the data protection authority where you live or work.

About the cookies used on our website

Cookies are used on pretty much every website today. These are small files saved to your device that help a website work and let its owner understand how it’s used.

Cookies we use fall into the following categories:

  • Essential cookies. Needed to display our website, remember your language and cookie choices, and protect the contact form from spam. These don’t need your consent.
  • Analytics cookies. Our site uses Google Analytics (GA). GA helps us understand how you use our website – which pages you visit, how long you stay and what device you’re on – so we can improve your experience over time. We only turn these on if you say yes. Because they’re linked to your device, the data they collect counts as personal data.

We’d be happy if you allowed analytics cookies, but it’s entirely your call.

Manage cookie preferences

Cookies:

  • cc_cookie – provider: play.ee; purpose: remembers your cookie choices; type: essential; expires: 6 months

  • wp-wpml_current_language – provider: play.ee; purpose:

    Remembers your language (English or Estonian); type: essential; expires: 1 day

  • _GRECAPTCHA – provider: Google (reCAPTCHA); purpose:

    protects the contact form from spam and bots; type: essential; expires: 6 months

  • _ga – provider: Google Analytics; purpose: distinguishes visitors to count visits and page views; type: analytics (consent); expires: 2 years

Cookie Settings

You can change your cookie preferences any time by clicking the above button. This will let you revisit the cookie consent banner and change your preferences or withdraw your consent right away.

Automated decisions:

We don’t make decisions about you purely by automated means, including profiling, that have legal or similarly significant effects on you.

How we keep your data safe:

We protect personal data with access controls, encrypted connections (HTTPS), regular updates and backups.

Children:

Our website and services aren’t aimed at children under 13, and we don’t knowingly collect their data.

Changes to this policy:

We update this policy whenever our data processing changes. The date at the top shows the latest version. If a change significantly affects our clients or candidates, we’ll let them know directly.