Last updated: 14 February 2026
We are legally required to collect the following information from Providers under EU Council Directive 2021/514 (DAC7) as implemented in Estonian law.
| Purpose | Legal Basis | Retention |
|---|---|---|
| Platform operation | Contract (Art. 6(1)(b)) | Account lifetime + 3 years |
| Safety and security | Legitimate interests (Art. 6(1)(f)) | 12 months |
| Customer support | Contract (Art. 6(1)(b)) | Resolution + 2 years |
| Transaction addresses | Contract (Art. 6(1)(b)) | 30 days post-booking |
| Tax reporting compliance (EU DAC7) | Legal obligation (Art. 6(1)(c)) | 5 years after last reportable period |
| Premium feature payments (VAT compliance) | Legal obligation (Art. 6(1)(c)) | 10 years (VAT OSS record-keeping) |
| Analytics | Legitimate interests (Art. 6(1)(f)) | 26 months (anonymised) |
| Marketing | Consent (Art. 6(1)(a)) | Until opt-out |
| Other legal compliance | Legal obligation (Art. 6(1)(c)) | As required by law |
Note on tax compliance data: Processing of tax compliance data (TIN, date of birth, address, tax residence) is based on our legal obligation under EU DAC7 (Council Directive 2021/514) as implemented in Estonian law and does not require your consent. However, you will be informed before this data is collected and have the right to understand how it is used. The data will only be used for the purpose of fulfilling our tax reporting obligations and will not be used for marketing or other unrelated purposes.
Each sub-processor processes data only on our instructions and is bound by appropriate data processing agreements. A full, up-to-date list of sub-processors is available upon request.
Information shared with tax authorities includes: Provider name, address, date of birth, TIN, total transaction value (based on listed prices), number of transactions, platform fees, and (for property rentals) property addresses and days rented. This sharing is based on our legal obligation under Art. 6(1)(c) GDPR.
Under EU GDPR and RODO, you have the following rights:
Important note on tax compliance data: Your rights to erasure and restriction may be limited in respect of tax compliance data (TIN, date of birth, address, tax residence) where we are required by law to retain and process this data for tax reporting purposes. In such cases, we will explain the specific legal basis and any limitations that apply.
To exercise your rights, contact us at privacy@locayo.app or through our Help Centre. We respond to requests within one month (or up to three months for complex cases, with notification).
Supervisory Authorities:
We implement appropriate technical and organisational measures to protect your personal data, including:
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify affected individuals without undue delay.
We use cookies and similar technologies. See our Cookie Policy for details.
For privacy-related enquiries:
© 2026 LocaYo. All rights reserved.