Privacy Policy
Last updated: 25 August 2026
This Privacy Policy explains how Gala Glow (“we,” “us,” “our”) collects, uses, and protects personal data of visitors and clients of the website galaglow.eu, in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).
1. Data Controller
Gala Glow
Website: galaglow.eu
Email: rfp@galaglow.eu
For any questions regarding this Privacy Policy or your personal data, please contact us at the email above.
2. What Data We Collect
We may collect the following categories of personal data:
- Contact details: name, email address, phone number, company name
- Request/booking information: event details, destination preferences, dates, budget, and other information you provide in RFP (request for proposal) forms or correspondence
- Technical data: IP address, browser type, device information, pages visited, and cookies (see Section 6)
- Communication data: content of emails and messages you send us
3. Legal Basis and Purpose of Processing
| Purpose | Legal basis |
|---|---|
| Responding to inquiries and RFPs | Consent / pre-contractual measures (Art. 6(1)(b) GDPR) |
| Providing event planning and destination management services | Performance of a contract (Art. 6(1)(b) GDPR) |
| Website analytics and improving user experience | Legitimate interest (Art. 6(1)(f) GDPR) / Consent for non-essential cookies |
| Marketing communications | Consent (Art. 6(1)(a) GDPR) |
| Compliance with legal obligations (e.g., accounting) | Legal obligation (Art. 6(1)(c) GDPR) |
4. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described above, or as required by applicable law (e.g., Estonian accounting legislation requires retention of financial records for 7 years). Inquiry and RFP data not leading to a contract is deleted or anonymized within a reasonable period, generally up to 24 months.
5. Data Sharing
We do not sell personal data. We may share data with:
- Trusted partners and suppliers (venues, hotels, transport providers) strictly necessary to fulfil your event request
- IT service providers (hosting, email) acting as data processors under GDPR-compliant agreements
- Authorities, where required by law
Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards (e.g., Standard Contractual Clauses) are in place.
6. Cookies
Our website uses cookies and similar technologies to:
- Ensure essential website functionality (strictly necessary, no consent required)
- Analyze website traffic and usage (requires consent)
- Remember your preferences (requires consent)
You can manage or withdraw cookie consent at any time via our cookie settings tool or your browser settings.
7. Your Rights
Under the GDPR, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase your data (“right to be forgotten”)
- Restrict processing
- Data portability
- Object to processing based on legitimate interest or for direct marketing
- Withdraw consent at any time, without affecting prior lawful processing
To exercise these rights, contact us at rfp@galaglow.eu. We will respond within one month, as required by Art. 12(3) GDPR.
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the supervisory authority of your country of residence.
8. Data Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse.
9. Changes to This Policy
We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised “Last updated” date.
10. Contact
Gala Glow
Email: rfp@galaglow.eu
Website: galaglow.eu