This Privacy Policy explains how Crowdestate AS processes personal data in connection with the public website www.crowdestate.eu, business enquiries, website communications, and communications relating to pre-existing loan relationships or projects that were entered into before Crowdestate changed its business focus.

This policy does not describe the terms of any financial, payment, investment, or crowdfunding service. It is intended to explain personal data processing only.

1. Controller

The controller of personal data is Crowdestate AS, registry code 14773059, address Narva maantee 7a, 15172 Tallinn, Estonia, e-mail info@crowdestate.eu.

2. Personal data we may process

Depending on how you interact with us, we may process the following categories of personal data:

• Identification and contact data, such as name, company name, role, e-mail address, phone number, and other details you provide when contacting us.

• Business enquiry data, such as the content of messages, meeting requests, submitted forms, business needs, and communications with Crowdestate.

• Website usage data, such as IP address, browser type, device information, pages visited, approximate location, timestamps, and cookie or analytics identifiers where applicable.

• Communication records, including e-mails, support requests, correspondence, and internal notes needed to respond to you.

• Legacy communication data, where needed to contact relevant persons about pre-existing loan relationships or projects, including contact details, communication history, reference information, and information required to answer questions or send notices.

• Legal and compliance data, where needed to protect rights, respond to official requests, handle complaints, maintain records, or comply with applicable law.

3. Purposes and legal bases

We process personal data only where we have a lawful basis to do so. The main purposes and legal bases are:

4. Legacy communications for pre-existing loans

Crowdestate is no longer using this website to promote or operate new crowdfunding offers. However, Crowdestate may still need to process personal data and communicate with relevant persons in connection with loan relationships, projects, or agreements that existed before the change in business focus.

This may include communications about repayments, distributions, project updates, administrative notices, support questions, complaints, legal notices, record requests, or other matters connected with those pre-existing relationships.

The personal data processed for this purpose may include name, contact details, communication history, relevant reference information, and other information necessary to send or respond to communications, maintain records, or comply with legal obligations.

Crowdestate does not use this section as a basis to market new loan, investment, or crowdfunding opportunities.

5. Cookies and similar technologies

We use cookies and similar technologies on our website. Strictly necessary cookies may be used to operate the website. Non-essential cookies, such as analytics or marketing cookies, are used only where permitted by law and, where required, based on consent.

More information is available in the separate Cookie Policy.

6. Sources of personal data

We usually receive personal data directly from you when you contact us, use our website, submit a form, request information, or communicate with us. We may also receive business contact data from professional introductions, publicly available business sources, counterparties, advisers, or service providers where this is lawful and relevant.

7. Recipients and service providers

We may share personal data with service providers and partners where necessary for the purposes described in this policy. These may include hosting providers, IT service providers, website providers, analytics providers, e-mail and communication tools, professional advisers, legal advisers, auditors, and public authorities where required by law.

Where service providers process personal data on our behalf, they must process it only under our instructions and apply appropriate security measures.

8. International transfers

Some service providers may process personal data outside the European Economic Area. Where this happens, we use appropriate safeguards required by applicable data protection law, such as adequacy decisions, standard contractual clauses, or other legally recognised transfer mechanisms.

9. Retention

We keep personal data only for as long as necessary for the purposes described in this policy, unless a longer retention period is required or permitted by law.

• Website and analytics data are retained according to the relevant cookie or analytics settings.

• Business enquiry and communication data are generally retained for as long as needed to handle the enquiry and maintain reasonable business records.

• Marketing contact data are retained until you unsubscribe or object, unless another lawful basis applies.

• Legacy communication data relating to pre-existing loans or projects may be retained for as long as necessary to administer communications, comply with legal obligations, maintain accounting or legal records, or protect legal rights.

• Data needed for legal claims, audits, regulatory matters, or compliance may be retained for the relevant limitation or statutory period.

10. Your rights

Subject to the conditions and limits under applicable law, you may have the right to:

• request access to your personal data;

• request correction of inaccurate or incomplete personal data;

• request deletion of personal data;

• request restriction of processing;

• object to processing based on legitimate interests, including direct marketing;

• withdraw consent where processing is based on consent;

• request data portability where applicable;

• lodge a complaint with the Estonian Data Protection Inspectorate.

To exercise your rights, please contact us at info@crowdestate.eu.

11. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. Access to personal data is limited to persons who need it for the purposes described in this policy.

12. Complaints

If you believe that your personal data has been processed unlawfully, please contact us first so that we can review the matter. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate.

Estonian Data Protection Inspectorate: info@aki.ee

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be published on our website and will apply from the date of publication, unless stated otherwise.

14. Contact

Crowdestate AS
Narva maantee 7a, 15172 Tallinn, Estonia
E-mail: info@crowdestate.eu