Join community

Privacy Policy

Last updated: 12.10.2026

LIFT99 is a startup hub. To run it, we need to know who our members are, who has booked which room, who is in the building, and whom to invoice. This policy explains how we use that information.

In plain terms: we collect what we need to run the hub, we do not sell your data, and we protect access to it.

1. Who we are

LIFT99 TLN OÜ, Telliskivi tn 60a/5, 10412 Tallinn, Estonia, is the controller of the personal data described in this policy. For questions about your personal data, write to tallinn@lift99.co.

2. Who and what this policy covers

This policy applies to members, visitors, event attendees, newsletter subscribers, job applicants, and people who contact or book services with LIFT99.

3. What we collect, why, and on what legal basis

3.1 Membership and account data

Data: name, email address, phone number, company name and role, profile information you choose to provide, username and password, membership type and start/end dates.
Why: to set up and administer your membership or booking account, to give you access to the hub and to our systems, and to communicate with you about your membership.
Legal basis: performance of a contract with you, or steps taken at your request before entering into a contract.
Retention: for the duration of the membership and 3 years afterwards.

3.2 Bookings and use of the space

Data: meeting-room and desk reservations, dates and times, room and space used, day-pass purchases, event-space bookings, and visitor details.
Why: to provide the space you booked, manage capacity and scheduling, know who is on the premises, and invoice correctly.
Legal basis: performance of a contract and our legitimate interest in keeping the building secure.
Retention: booking records for 12 months; invoicing records as set out below.

3.3 Billing, payments and accounting

Data: billing name and address, company and VAT details, invoices, payment status, payment method and transaction references.
Why: to charge for memberships, bookings, events and other services, collect payment, and keep our books.
Legal basis: performance of a contract and compliance with accounting and tax obligations.
Payment cards: we do not store full card details. Payments are processed by Stripe or SumUp under their own privacy policies and payment-industry rules.
Retention: accounting documents for 7 years from the end of the financial year.

3.4 Access to the building

Data: access credentials and entry and exit logs.
Why: to let you into the hub, keep the premises secure, and establish who was present if there is an incident.
Legal basis: performance of a contract and legitimate interest in security.
What we don’t do with it: we do not use access logs to monitor working hours, attendance, or productivity.
Retention: access logs are kept for 3 months unless a specific incident requires a longer record.

3.5 Video surveillance (CCTV)

Data: footage from entrances, corridors, common areas, and shared office spaces.
Why: to protect people and property and investigate incidents.
Legal basis: our legitimate interest in site security.
What we don’t do with it: cameras are not used in private offices, toilets, showers, changing areas, or phone booths.
Retention: recordings are automatically deleted after 2 months unless needed for an ongoing incident, insurance claim, or legal proceeding.

3.6 Wi-Fi at the hub

Data: technical network traffic information.
Why: to provide and maintain a functioning, secure network.
Legal basis: our legitimate interest in maintaining the network.
Retention: technical traffic information is visible for up to 24 hours and is not stored thereafter.

3.7 Community platform, member directory and mobile application

Data: profile information, posts, questions and answers, and technical application usage data.
Why: to run the member community and improve the application.
Legal basis: performance of a contract and legitimate interest in maintaining and improving our services.
Retention: for the duration of your membership; profiles and posts are removed or anonymised within 3 months of your membership ending.

3.8 Events and ticketing

Data: registration name, email, company, ticket and payment status, attendance, and dietary or accessibility information you provide.
Why: to manage registration and entry, plan catering and capacity, and contact you about the event.
Legal basis: performance of a contract; explicit consent where required for accessibility or dietary information.
Retention: attendee lists for 1 year after the event; accounting records as set out in section 3.3.

3.9 Visits, tours and delegations

Data: organiser contact details, visitor group details, visit dates, and participant lists where provided.
Why: to schedule and host the visit and know who is in the building.
Legal basis: performance of a contract or pre-contractual steps, and our legitimate interest in managing access.
Retention: 6 months after the visit; correspondence as set out in section 3.13.

3.10 Sponsor and partner consultations

Data: consultation sign-up details and contact information.
Why: so the sponsor can contact you and prepare for the consultation.
Legal basis: your consent, given by signing up for the consultation.
Retention: sign-up records are kept for 3 months to administer the programme and answer questions.

3.11 Newsletter and marketing

Data: name, email address, and whether you open or click our emails.
Why: to send news about LIFT99, our events, and our community.
Legal basis: your consent or, where permitted, legitimate interest.
Withdrawing: every email contains an unsubscribe link; you can also write to tallinn@lift99.co.
Retention: until you unsubscribe or object, plus a record of the unsubscribe itself.

3.12 Photographs and video for communication and marketing

Data: photographs and video from the hub and events.
Why: to communicate about LIFT99, our community, and our events.
Legal basis: legitimate interest for general atmosphere and crowd shots, and consent for portraits or material where an individual is the clear subject.
Retention: for as long as the material is in use, and thereafter in our archive unless you ask us to delete it.

3.13 Enquiries and correspondence

Data: your name, contact details, and the content of your message.
Why: to answer you and keep a record of what was agreed.
Legal basis: pre-contractual steps or performance of a contract, otherwise legitimate interest in handling enquiries.
Retention: 2 years from the last message, or longer where correspondence relates to a contract.

3.14 Job applications

Data: your CV, application letter, contact details, and other information you send or we receive from referees you name.
Why: to assess your application.
Legal basis: steps taken at your request before entering an employment contract.
Retention: for the recruitment process; with consent, applications may be kept in our talent pool for a further year.

3.15 Website and cookies

Data: cookies and similar technologies used on our website.
Why: to run the site, understand usage, and provide analytics or marketing where you consent.
Legal basis: legitimate interest for necessary cookies and consent for analytics and marketing cookies.

4. Who we share your data with

We do not sell personal data or share it with advertisers. We may share information with service providers that help us run the hub, process payments, host systems, deliver newsletters, provide security, or meet legal obligations. They may use your information only for the services they provide to us.

5. Transfers outside the European Economic Area

Some service providers may be based outside the EEA. Where this happens, we use appropriate safeguards required by data-protection law.

6. How long we keep your data

We keep personal data only for as long as needed for the purpose it was collected, to meet contractual and legal requirements, or to resolve disputes and enforce agreements.

7. Your rights

You may request access to your personal data, ask us to correct or erase it, restrict or object to processing, withdraw consent, or request a portable copy where applicable. To make a request, write to tallinn@lift99.co.

8. Security

We use appropriate technical and organisational measures to protect personal data. No system can be completely secure, but we regularly review our safeguards.

9. Data breaches

If a personal-data breach is likely to result in a risk to your rights and freedoms, we will take the steps required by law, including notification where appropriate.

10. Children

Our services are intended for adults. We do not knowingly collect personal data from children except where necessary for an organised visit or event.

11. Is providing your data mandatory?

Some information is necessary to provide membership, room rental, access, or event services. Other information is voluntary, and refusing it may mean we cannot provide the related feature.