Privacy policy

This privacy policy describes the processing of personal data of the users (including the natural persons related to the legal persons using the portal; hereinafter referred to as you) of the website www.crowdestate.eu and the subpages thereof (hereinafter referred to as the Portal) by Crowdestate AS (registry code 14773059, seat Müürivahe 17-2, Tallinn, 10140 Harju County, e-mail info@crowdestate.eu; hereinafter also referred to as Crowdestate or us). The personal data includes any information about you (e.g. name, contact details, details related to using the Portal, etc.) and processing of the personal data involves all operations performed with the personal data (incl. consultation, storage use, disclosure, etc.).

Protection of personal data is very important for Crowdestate and we approach it very seriously. We process personal data pursuant to our obligations arising from the relevant legislation applicable in the European Union and in the Republic of Estonia and observe the principles of secure processing of personal data.

By submitting your personal data upon registering as a user of the Portal or in another manner, you confirm having read the privacy policy of Crowdestate, as well as the accuracy of the data disclosed to us by you.

The composition of personal data, the purposes of and legal grounds for processing

Registration as a user of the Portal and using the Portal

Upon creating your user account in the Portal and in the course of using the Portal, we ask you to disclose to us certain personal data, without which it would be impossible to use the Portal. Crowdestate may also collect data from other public databases in certain cases. Upon registration as a user of the Portal and in the course of using the Portal, we collect the following personal data: first name and surname, personal identification code, mobile number, e-mail address, address, bank account details, and information about the right of representation. In addition to the above, further personal data are generated upon registration as a user of the Portal and in the course of using the Portal, such as the user account number and name, password, login details, details of the transactions performed in the Portal, orders for transactions and contractual documents, the details and balance of subaccounts registered in the Portal. The legal grounds for processing of all of the above-mentioned personal data is performance of the operations required prior to entry into the contract and for performance of the contract entered into with you for using the Portal (the terms and conditions of use of the Portal can be found here).The purpose of these operations is the creation of a registered user account and connection of the account with a specific person, administration of a user account and enabling secure logging in to the account, provision of services via the Portal, and enabling using the Portal for the intended purpose, incl. for fulfilling orders for transactions and identification in connection therewith, preparing and retaining documents of transactions, making payments on subaccounts, displaying reports and overviews to the user, sending e-mails related to using the Portal (information about executing transactions and terms and conditions), and contacting you in connection with using the Portal, if necessary (incl. by e-mail or telephone).

In the case of processing personal data on the basis of a contract, we generally retain the respective personal data until the deletion of the user account registered in the Portal. Irrespective of the above, we retain the data related to the subaccount and to the execution of transactions for 7 years after closing the subaccount, except for data related to displaying reports and reviews, which are deleted upon closing the subaccount. The documents of the contracts entered into between users via the Portal are retained for 7 years after expiry or full completion of the respective contract.

Identification and due diligence measures for the prevention of money laundering and terrorist financing

Based on the legal grounds of legitimate interest, Crowdestate processes your personal data for the purposes of first-time identification and for fulfilling the due diligence requirements related to the prevention of money laundering and terrorist financing. For the above-mentioned purposes, we process ourselves and/or through our data processor, Veriff OÜ, the following personal data disclosed by you or collected in another manner (from relevant public registers): first name and surname, personal identification code, gender, data of birth, place of birth, details of the identity document (type, number, date of issue, and date of expiry), nationality, residency, citizenship, photographs and video recordings taken upon identification of the person, status as a politically exposed person, information regarding international sanctions applied to the person, status as a beneficiary, and details of the operating system and browser used by the person for identification (incl. geolocation, device ID, and IP address). We also process biometric personal data (biometric facial dimensions) , which are deemed a specific type of personal data, within the framework of the process of identification based on your explicit consent. Your consent is asked prior to the beginning of the process of identification and you have the right to withdraw your consent at any time (this will not, however, affect the lawfulness of the processing which occurred before you withdrew your consent). As we offer an online service due to which accurate and secure identification of persons is extremely important, it is not possible to complete the process of identification without processing biometric data and the respective consent. Without this, the possible use of the Portal is restricted. The personal data processed for the above-mentioned purposes are retained for 5 years after the date of collection of the data.

Marketing

Based on our legitimate interest, Crowdestate processes your personal data (e-mail address and first name) for purposes related to our marketing activities. In connection with the above, Crowdestate may send to your e-mail address notices about the possibilities for using the Portal and about changing of the possibilities, as well as about investment opportunities. All such notices include information on how to unsubscribe from the list of recipients. The personal data related to processing for this purpose are retained by Crowdestate until the deletion of the user account.

Authorised processing

In addition to processing of personal data on the legal grounds listed above as the data controller, Crowdestate may process your personal identification code, tax residence information, and the data on the tax liabilities from the interest payments received by you through the Portal as a data processor authorised by a user who has taken a loan through the Portal. The purpose of this processing of personal data is withholding of the tax payable from the interests received from the transactions made via the Portal and payment of the taxes to the Tax and Customs Board; the legal grounds for this is the respective legal obligation of the recipient of the loan. The personal data related to processing for this purpose are retained by Crowdestate for 7 years after closing the subaccount registered in the Portal.

Disclosure of personal data or transfer of personal data to third parties

In certain cases, Crowdestate uses partners and service providers for processing your personal data, who process your personal data on our behalf and are authorised by us only for the purposes and in a manner established in this privacy policy. For example, we may send your personal data to our IT partners (incl. cloud service providers and IT developers), for e-mail and message service providers, for the provider of accounting services, and for the provider of the identification service. The personal data is also processed in the extent required for fulfilling their duties to achieve the purposes laid down in this privacy policy by the Board Members and personnel of Crowdestate and, if necessary and if there are legal grounds, Crowdestate may transfer your personal data to our subsidiaries and affiliates.

Upon completion of transactions in the Portal, Crowdestate transfers your personal data (incl. name, personal identification code, contact details, and other potential data which the other party to the contract or the guarantee agent may need in connection with a respective transaction completed with you) to the other party to the contract and, if necessary, to the guarantee agent.
In addition to the above, we may disclose your personal data to third parties in connection with fulfilling our legal obligation and, if necessary, for defending our legitimate interests or claims.

The personal data arising from using the Portal and sending marketing e-mails and required for this purpose are retained and processed in the server of our cooperation partner, MailChimp (The Rocket Science Group LLC d/b/a MailChimp), located in the United States of America. The security of processing of the data transferred to the United States of America by MailChimp is ensured through the Privacy Shield data protection framework between the European Union and the U.S. We do not transfer personal data outside of the European Union or the European Economic Area in other cases.

Execution of the rights related to processing of personal data

If you would like:

• to receive information on whether and which personal data are processed by us within the framework of our operations and how,
• to request the rectification, amendment, or complementation of your personal data if they are incorrect, incomplete, or insufficient,
• to request the deletion of your personal data (deletion is above all possible if, for example, Crowdestate no longer requires your personal data for the purposes described in the privacy policy in connection with which the data were collected or processed in another manner, your personal data are processed by Crowdestate based on consent and you have withdrawn your consent, you have submitted objections against the processing of personal data and there are no significant lawful reasons for the processing, or your data has been processed unlawfully),
• to submit objections against the processing of your personal data for the purposes of direct marketing or for processing your personal data based on a specific situation, if such processing is based on Crowdestate’s legitimate interest;
• to restrict the processing of your personal data (if you have disputed the accuracy of the data, your data are no longer needed by Crowdestate for the purposes of processing, and you are not interested in the deletion of your data or if you have submitted an objection against the processing of your personal data);
• to request the transfer of your personal data to another data controller in compliance with the applicable legislation,
• to express other wishes or submit other applications related to the processing your personal data or if you require further information about the processing,

please contact us by sending an e-mail to info@crowdestate.eu.

Please keep in mind that the above-mentioned rights are not unlimited and, in certain cases, the rights of other persons or the legitimate interests and/or obligations of Crowdestate may restrict the execution of your rights. Crowdestate strives to ensure lawful and transparent processing of personal data, respecting the rights of the data subject. Should you find, however, that we have processed your personal data unlawfully or have violated your rights in connection with processing personal data, please notify us thereof by sending an e-mail to the address above. You may also file a complaint with the Estonian Data Protection Inspectorate (e-mail address: info@aki.ee).

Ensuring of the security of personal data

Crowdestate retains and processes personal data in cooperation with our contractual partners digitally and physically in secure servers. We use the secure SSL encryption technology for transmitting information. Only our employees and the employees of our cooperation partners who require the information to fulfil their duties related to the purposes established in this privacy policy and who are under the obligation to observe the provisions of the legislation regulating data protection and this privacy policy in the processing of personal data have access to the personal data processed by us and our cooperation partners. We have established guidelines and rules to ensure the security of processing of personal data by implementing organisational as well as technical measures.

In the event of a violation related to personal data, Crowdestate implements the measures required to alleviate the outcomes and to reduce the respective risks in the future. Thereat, all such violations are registered and the Data Protection Inspectorate and data subjects are notified, if required.

The use of cookies and other online technologies

Upon visiting the website of Crowdestate, a pop-up window is opened on the website that notifies you of the use of cookies. Continued use of the website is interpreted as consenting to the use of cookies. If you do not consent to the use of cookies, you can block, control or, delete the cookies in your browser settings. Refusing to accept cookies may reduce the quality of your user experience and you may not have access to some of the services provided by us.
A cookie is a small data file which is saved automatically in your device through the browser when you are using the browser. Cookies include the specific details of the specific user of a website and the specific website. Cookies help you identify yourself on a website and enable you to use various functions on a specific website – for example, website use your cookies to remember your preferences, settings, user habits, to collect data about visits to the website, etc. Crowdestate also uses Local Storage Objects for the same purpose.

Crowdestate uses the following cookies and Local Storage Objects in the Portal:

The above-mentioned Google Analytics cookies are so-called third-party cookies which are installed by a company included in the Google group to help us analyse the use of the Portal. The information about the cookies in connection with the use of the Portal is sent by your browser to the servers of Google in the United States of America and in other countries where they are also retained. Google uses this information to assess the use of the Portal, drawing up reports about the activity of the Portal and providing other services in connection with the use of the Portal and internet. The IP address received by Google Analytics is not associated with other data administered by Google.

Amendment of the privacy policy

This privacy policy is valid from 07.05.2019. In the case of amendment of the privacy policy, the amendments and additions will enter into force when the new version is published on our website.

Contact

Any comments, questions, and suggestions concerning the privacy policy are welcome and should be sent to Crowdestate AS, Müürivahe 17-2, 10140 Tallinn, Estonia; or e-mailed to info@crowdestate.eu.