Eesti Firma OÜ
In short
- This policy covers only our company's LEI-related services. Our other services are covered by Eesti Firma's general privacy policy.
- For an LEI application, we need the name, email address and phone number of the organisation's representative, documents confirming their authority, and payment details.
- We are a registration agent: we accept your application and pass it on to the LEI issuer. Payments are handled by a payment provider.
- The open international LEI database, maintained by the GLEIF foundation, contains data about the organisation, not about its representative: that is what GLEIF's rules require.
- We may share contact details with our group companies and contractual partners. You can opt out of this at any time.
- We keep data for as long as we manage the organisation's LEI and for 3 more years after that. We keep data longer only where the law requires it: invoices for 7 years and anti-money-laundering data for 5 years.
- Our relationship with you is governed by the law of the Republic of Estonia.
- For any questions about your data, write to [email protected].
1. Who we are
LEI-related services are provided by Eesti Firma OÜ: registry code 14164797, LEI 2549006RA6TCO1KHOJ54, address Vesivärava tn 50-301, 10152 Tallinn, Estonia. We are an LEI registration agent: through the website eestifirma.ee/lei, we accept applications to obtain, renew or transfer an LEI and pass them on to the LEI issuer. We are responsible for our part of the processing of personal data: under the EU General Data Protection Regulation (GDPR), we are a data controller. The issuer and the payment provider are each responsible for their own part (see section 4).
For questions about your data, write to [email protected].
LEIs are obtained by organisations, not private individuals, so information about the organisation itself is not personal data. There is one exception: a sole proprietor obtains an LEI in their own name, and their data is personal data. In all other cases, the personal data in an application relates to the organisation's representative or contact person: name, email address and phone number.
This policy applies only to our LEI-related services. Our other services are covered by Eesti Firma's general privacy policy, published at eestifirma.ee.
2. What data we collect
We collect the data we need to review the application, take payment and meet legal requirements. Without this data, we cannot arrange an LEI.
| Data | Source |
|---|---|
First and last name of the representative or contact person, email address, phone number, position or basis of authority |
The applicant |
Documents proving authority and showing group structure (power of attorney, registry extract, documents on parent companies); these may contain a name, personal identification number and signature |
The applicant and official registers |
Payment data: payer's name, time, amount and method of payment; for card payments, a token, i.e. a pseudonymised card identifier from the payment provider |
The payer and the payment provider |
Correspondence with us |
You |
Website usage data (IP address, cookies) |
Your device |
Both we and the issuer may check application data against official registers and GLEIF's open database. We do not see or store the card number, expiry date or security code: only the payment provider handles them.
An application is often submitted not by the director personally but by an accountant, lawyer or other assistant. If you include another person's data in an application, for example the data of a management board member or of the person who signed the power of attorney, please show them this policy. If someone else provided your data, this policy applies to you as well, including all the rights in section 7.
3. Why we use data
The table below sets out why we use data and on what legal basis. No separate consent is needed to submit an application: without this data, the contract cannot be concluded or performed.
| Why | Legal basis |
|---|---|
To review an application to obtain, renew or transfer an LEI, verify the representative's authority, take payment (including automatic renewal using a token) and answer your questions |
For a sole proprietor: the contract with them and pre-contractual steps (Art. 6(1)(b) GDPR). For an organisation's representative: our and the organisation's legitimate interest in concluding and performing the contract (Art. 6(1)(f)) |
To remind you that the LEI is about to expire |
Legitimate interest, ours and the organisation's (Art. 6(1)(f)): with a lapsed LEI, the organisation risks being turned away by a bank or broker |
To write to clients about our similar services |
Legitimate interest (Art. 6(1)(f)): telling clients what else we can do for them |
To share contact details with our group companies and contractual partners so that they can offer the client related services |
Legitimate interest, ours and the recipient's (Art. 6(1)(f)): growing the business and offering clients related services |
To keep accounts, respond to requests from public authorities, and comply with anti-money-laundering and international sanctions requirements |
Legal obligation (Art. 6(1)(c)) |
To defend our rights in disputes, keep the website running and secure, maintain internal statistics and improve the service |
Legitimate interest (Art. 6(1)(f)) |
To collect website statistics and measure advertising using cookies |
Your consent (Art. 6(1)(a)) |
You can opt out of our emails and of the sharing of your contact details by sending an email to [email protected]. Service messages (confirmations, invoices, notices of an upcoming charge for automatic renewal) are sent in any case: they are part of the service.
When checking applications and documents, we use automated tools, including tools based on artificial intelligence. They assist our specialists. If you disagree with the result of a check, write to us and a human will review the application.
4. Who we share data with
Each recipient receives only as much data as it needs to do its job.
| Who | Role | Why |
|---|---|---|
The LEI issuer, an organisation accredited by the GLEIF foundation to issue LEIs (GLEIF documents also call it a Local Operating Unit, LOU). Our issuer is named in the General Terms of the LEI Service |
Responsible for the data in its own right (an independent controller under the GDPR) |
Issues, renews and transfers LEIs. Receives the application data, including the representative's name and contact details and the documents confirming their authority |
The payment provider you see when paying |
Responsible for the data in its own right (an independent controller under the GDPR) |
Processes payments, including card details |
Our service providers: hosting, email delivery, chat, document-checking tools, accounting |
Act on our instructions (data processors under the GDPR) |
Keep the website and chat running, send emails, check documents and do the accounting. They may not use the data for their own purposes |
Our group companies and our contractual partners |
Responsible for the data in their own right (independent controllers under the GDPR) |
Receive the organisation's name and its representative's contact details in order to serve the client or offer related services |
Analytics and advertising services |
On our instructions or independently |
Website statistics and advertising measurement, only with your consent |
We change providers and partners from time to time, so we name only their categories here. If you write to [email protected], we will tell you exactly who currently receives your data.
In addition, data may be received by public authorities and courts where the law so provides, and by our lawyers, auditors and other professional advisers where this is needed to protect our rights or to review our work. If we transfer this business to another company, clients' data will pass to it and clients will be notified.
Under GLEIF's rules, the issuer passes the organisation's data to the foundation, and it is published in the open database: name, registration number, addresses, LEI status and information about parent companies. This data is open, and anyone may use it. The representative's name and contact details are not part of this data set. If the organisation is owned by a private individual, only that fact is stated, without a name. Exception: a sole proprietor obtains an LEI in their own name, so their name and address are published.
We store data mainly in the European Economic Area. Some recipients are located, or process data, outside it. In that case, the transfer relies on a European Commission adequacy decision or on standard contractual clauses. Write to [email protected] and we will provide the details, including the countries.
5. How long we keep data
We keep data no longer than is needed for the service or required by law.
| Data | Period |
|---|---|
Application, documents and correspondence |
For as long as we manage the organisation's LEI, and for 3 more years (the limitation period under Estonian law) |
Data we are required to keep under anti-money-laundering rules |
5 years after the end of the client relationship |
Unpaid applications and enquiries that did not lead to an order |
6 months |
Invoices and other accounting source documents |
7 years from the end of the financial year, as required by the Estonian Accounting Act |
Card payment token |
While automatic renewal is switched on, or until the card expires |
Data relating to a dispute |
Until the dispute is finally resolved |
When the period ends, we delete or anonymise the data at the next scheduled clean-up. The issuer keeps application data under its own rules and is itself responsible for that.
6. Cookies
Cookies that are essential for the website to work are used without consent. All others (functional, statistics and marketing cookies) are switched on only if you have agreed to them in the cookie notice. You can change or withdraw your consent at any time in the cookie settings on the website. The list of cookies, with their providers and retention periods, is given there as well.
7. Your rights
You can:
- find out which of your data we process and receive a copy of it;
- ask us to correct inaccurate data;
- ask us to delete data if it is no longer needed or there is no basis for processing it;
- ask us to restrict processing, for example while the accuracy of the data is in dispute;
- object to processing that we carry out on the basis of legitimate interest. We stop reminders, any direct marketing and the sharing of contact details with group companies and partners at your first request, and you do not need to give a reason;
- receive the data we process under a contract or on the basis of consent in a machine-readable format or, where technically feasible, ask us to transfer it to another company;
- withdraw consent at any time. This does not affect processing already carried out.
To do so, write to [email protected]. We reply within one month. If the request is complex, we may extend the period by a further two months and will let you know within the first month. We sometimes ask for proof of identity so that data is not given to the wrong person.
8. Governing law, complaints and changes to this policy
Our relationship with you is governed by the law of the Republic of Estonia, including the GDPR as it applies in Estonia.
If you believe we are handling your data incorrectly, write to us at [email protected] and we will do our best to put things right. You also have the right to lodge a complaint at any time with the Estonian data protection supervisory authority (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn; [email protected]; +372 627 4135) or with the supervisory authority of the country where you live or work.
The current version of this policy is always published at eestifirma.ee/lei, and the date of the last update is shown at the top. We announce material changes on the website or by email.