Your Data Rights
Under EU GDPR and Polish RODO, you have powerful rights over your personal data.
Last updated: 26 May 2026
Your Rights Under Data Protection Law
Right of Access
Article 15Obtain confirmation that we process your data and access to that data.
How to exercise: Download in account settings or contact us
Right to Rectification
Article 16Have inaccurate data corrected and incomplete data completed.
How to exercise: Edit in profile settings or contact us
Right to Erasure
Article 17Request deletion of your data in certain circumstances.
How to exercise: Delete account in settings or submit request
Right to Restrict Processing
Article 18Request we limit how we use your data.
How to exercise: Submit request through Help Centre
Right to Data Portability
Article 20Receive your data in machine-readable format.
How to exercise: Download JSON/CSV from account settings
Right to Object
Article 21Object to processing based on legitimate interests.
How to exercise: Use marketing preferences or contact us
Automated Decision-Making
Article 22Rights regarding automated decisions that affect you.
How to exercise: We do not make such automated decisions
Withdraw Consent
Article 7(3)Withdraw consent at any time where we rely on it.
How to exercise: Manage in privacy settings
Limitations on Rights — Tax Compliance Data
If you are a Provider on LocaYo, certain data rights may be limited in respect of tax compliance data that we are legally required to collect and retain under EU DAC7 (Council Directive 2021/514) as implemented in Estonian law.
Specifically, your right to erasure and right to restrict processing may not apply to tax compliance data (including your Tax Identification Number, date of birth, address, and tax residence) where we are required by law to retain this data for at least 5 years after the last reportable period.
Your right of access, right to rectification, and right to data portability continue to apply in full. If you wish to exercise any right in respect of tax compliance data, please contact us at [email protected] and we will explain any limitations that apply.
Response Times
We respond as quickly as possible — usually within a few days. The statutory response period is one month; exceptionally complex cases may take up to three months, in which case we will inform you within the first month, including the reasons.
How to Make a Request
Self-Service
- Request a copy of your data ([email protected])
- Edit your profile
- Manage tax compliance data
- Delete your account
Supervisory Authorities
You have the right to lodge a complaint with a supervisory authority if you are concerned about how we handle your personal data.
Data Controller
Next Orbit OÜ, trading as LocaYo
Private limited company (osaühing) registered in the Republic of Estonia, registry code 17501338, registered address: Sepapaja 6, 15551 Tallinn, Estonia.
Data protection contact: [email protected]
Legal Framework
- EU GDPR (2016/679) — General Data Protection Regulation (directly applicable in Estonia and all EU/EEA member states; primary framework for LocaYo as an Estonian company)
- Estonian Personal Data Protection Act (Isikuandmete kaitse seadus) — Estonian implementation legislation supplementing GDPR
- Polish RODO — Polish implementation of GDPR (applicable to Polish users)
- Lithuanian Personal Data Protection Law (Asmens duomenų teisinės apsaugos įstatymas) — applicable to Lithuanian users
- Latvian Personal Data Processing Law (Fizisko personu datu apstrādes likums) — applicable to Latvian users
- UK GDPR & Data Protection Act 2018 — applicable to United Kingdom users
- ePrivacy Directive (2002/58/EC) — Rules for electronic communications and cookies, as implemented in national laws
- EU DAC7 (Council Directive 2021/514) — EU tax reporting obligations for digital platforms, as implemented in Estonian law
Related Documents
© 2026 LocaYo. All rights reserved.