Protection of personal data is very important for Crowdestate and we approach it very seriously. We process personal data pursuant to our obligations arising from the relevant legislation applicable in the European Union and in the Republic of Estonia and observe the principles of secure processing of personal data.
The composition of personal data, the purposes of and legal grounds for processing
Registration as a user of the Portal and using the Portal
Upon creating your user account in the Portal and in the course of using the Portal, we ask you to disclose to us certain personal data, without which it would be impossible to use the Portal. Crowdestate may also collect data from other public databases in certain cases. Upon registration as a user of the Portal and in the course of using the Portal, we collect the following personal data: first name and surname, personal identification code, mobile number, e-mail address, address, bank account details, and information about the right of representation. In addition to the above, further personal data are generated upon registration as a user of the Portal and in the course of using the Portal, such as the user account number and name, password, login details, details of the transactions performed in the Portal, orders for transactions and contractual documents, the details and balance of subaccounts registered in the Portal. The legal grounds for processing of all of the above-mentioned personal data is performance of the operations required prior to entry into the contract and for performance of the contract entered into with you for using the Portal (the terms and conditions of use of the Portal can be found here).The purpose of these operations is the creation of a registered user account and connection of the account with a specific person, administration of a user account and enabling secure logging in to the account, provision of services via the Portal, and enabling using the Portal for the intended purpose, incl. for fulfilling orders for transactions and identification in connection therewith, preparing and retaining documents of transactions, making payments on subaccounts, displaying reports and overviews to the user, sending e-mails related to using the Portal (information about executing transactions and terms and conditions), and contacting you in connection with using the Portal, if necessary (incl. by e-mail or telephone).
In the case of processing personal data on the basis of a contract, we generally retain the respective personal data until the deletion of the user account registered in the Portal. Irrespective of the above, we retain the data related to the subaccount and to the execution of transactions for 7 years after closing the subaccount, except for data related to displaying reports and reviews, which are deleted upon closing the subaccount. The documents of the contracts entered into between users via the Portal are retained for 7 years after expiry or full completion of the respective contract.
Identification and due diligence measures for the prevention of money laundering and terrorist financing
Based on the legal grounds of legitimate interest, Crowdestate processes your personal data for the purposes of first-time identification and for fulfilling the due diligence requirements related to the prevention of money laundering and terrorist financing. For the above-mentioned purposes, we process ourselves and/or through our data processor, Veriff OÜ, the following personal data disclosed by you or collected in another manner (from relevant public registers): first name and surname, personal identification code, gender, data of birth, place of birth, details of the identity document (type, number, date of issue, and date of expiry), nationality, residency, citizenship, photographs and video recordings taken upon identification of the person, status as a politically exposed person, information regarding international sanctions applied to the person, status as a beneficiary, and details of the operating system and browser used by the person for identification (incl. geolocation, device ID, and IP address). We also process biometric personal data (biometric facial dimensions) , which are deemed a specific type of personal data, within the framework of the process of identification based on your explicit consent. Your consent is asked prior to the beginning of the process of identification and you have the right to withdraw your consent at any time (this will not, however, affect the lawfulness of the processing which occurred before you withdrew your consent). As we offer an online service due to which accurate and secure identification of persons is extremely important, it is not possible to complete the process of identification without processing biometric data and the respective consent. Without this, the possible use of the Portal is restricted. The personal data processed for the above-mentioned purposes are retained for 5 years after the date of collection of the data.
Based on our legitimate interest, Crowdestate processes your personal data (e-mail address and first name) for purposes related to our marketing activities. In connection with the above, Crowdestate may send to your e-mail address notices about the possibilities for using the Portal and about changing of the possibilities, as well as about investment opportunities. All such notices include information on how to unsubscribe from the list of recipients. The personal data related to processing for this purpose are retained by Crowdestate until the deletion of the user account.
In addition to processing of personal data on the legal grounds listed above as the data controller, Crowdestate may process your personal identification code, tax residence information, and the data on the tax liabilities from the interest payments received by you through the Portal as a data processor authorised by a user who has taken a loan through the Portal. The purpose of this processing of personal data is withholding of the tax payable from the interests received from the transactions made via the Portal and payment of the taxes to the Tax and Customs Board; the legal grounds for this is the respective legal obligation of the recipient of the loan. The personal data related to processing for this purpose are retained by Crowdestate for 7 years after closing the subaccount registered in the Portal.
Disclosure of personal data or transfer of personal data to third parties
Upon completion of transactions in the Portal, Crowdestate transfers your personal data (incl. name, personal identification code, contact details, and other potential data which the other party to the contract or the guarantee agent may need in connection with a respective transaction completed with you) to the other party to the contract and, if necessary, to the guarantee agent.
In addition to the above, we may disclose your personal data to third parties in connection with fulfilling our legal obligation and, if necessary, for defending our legitimate interests or claims.
The personal data arising from using the Portal and sending marketing e-mails and required for this purpose are retained and processed in the server of our cooperation partner, MailChimp (The Rocket Science Group LLC d/b/a MailChimp), located in the United States of America. The security of processing of the data transferred to the United States of America by MailChimp is ensured through the Privacy Shield data protection framework between the European Union and the U.S. We do not transfer personal data outside of the European Union or the European Economic Area in other cases.
Execution of the rights related to processing of personal data
If you would like:
- to receive information on whether and which personal data are processed by us within the framework of our operations and how,
- to request the rectification, amendment, or complementation of your personal data if they are incorrect, incomplete, or insufficient,
- to submit objections against the processing of your personal data for the purposes of direct marketing or for processing your personal data based on a specific situation, if such processing is based on Crowdestate’s legitimate interest;
- to restrict the processing of your personal data (if you have disputed the accuracy of the data, your data are no longer needed by Crowdestate for the purposes of processing, and you are not interested in the deletion of your data or if you have submitted an objection against the processing of your personal data);
- to request the transfer of your personal data to another data controller in compliance with the applicable legislation,
- to express other wishes or submit other applications related to the processing your personal data or if you require further information about the processing,
please contact us by sending an e-mail to firstname.lastname@example.org.
Please keep in mind that the above-mentioned rights are not unlimited and, in certain cases, the rights of other persons or the legitimate interests and/or obligations of Crowdestate may restrict the execution of your rights. Crowdestate strives to ensure lawful and transparent processing of personal data, respecting the rights of the data subject. Should you find, however, that we have processed your personal data unlawfully or have violated your rights in connection with processing personal data, please notify us thereof by sending an e-mail to the address above. You may also file a complaint with the Estonian Data Protection Inspectorate (e-mail address: email@example.com).
Ensuring of the security of personal data
In the event of a violation related to personal data, Crowdestate implements the measures required to alleviate the outcomes and to reduce the respective risks in the future. Thereat, all such violations are registered and the Data Protection Inspectorate and data subjects are notified, if required.
A cookie is a small data file which is saved automatically in your device through the browser when you are using the browser. Cookies include the specific details of the specific user of a website and the specific website. Cookies help you identify yourself on a website and enable you to use various functions on a specific website – for example, website use your cookies to remember your preferences, settings, user habits, to collect data about visits to the website, etc. Crowdestate also uses Local Storage Objects for the same purpose.
Crowdestate uses the following cookies and Local Storage Objects in the Portal:
The above-mentioned Google Analytics cookies are so-called third-party cookies which are installed by a company included in the Google group to help us analyse the use of the Portal. The information about the cookies in connection with the use of the Portal is sent by your browser to the servers of Google in the United States of America and in other countries where they are also retained. Google uses this information to assess the use of the Portal, drawing up reports about the activity of the Portal and providing other services in connection with the use of the Portal and internet. The IP address received by Google Analytics is not associated with other data administered by Google.