--- title: Privacy Policy date: 2018-05-29T06:28:31Z modified: 2025-10-07T14:33:52Z permalink: "https://grow.ee/privaatsuspoliitika/" type: page status: publish excerpt: "" wpid: 5347 featured_image: "https://grow.ee/wp-content/uploads/2018/05/Grow-Finance-priivaatsuspoliitika.jpg" featured_image_alt: Grow Finance-privacy policy timestamp: 2025-10-07T14:33:52Z tags: [] --- # Privacy Notices Grow Finance OÜ is the controller of personal data. Below we explain how your personal data as a data subject is processed. When processing personal data, we base our processing on the General Data Protection Regulation and possible special laws. Our data protection contact is: Kaari Timuska (kaari@grow.ee) ## I Definitions In order to make the privacy notices understandable and comprehensible to you, we explain to you some of the most important definitions used in the privacy notices: 1. Data subject – a natural person whose personal data is processed by Grow Finance OÜ. Data subjects are: Company contact persons, Website visitors, Company representatives, Social media platform visitors, Beneficial beneficiaries, Authorized representatives of a private client 2. Personal data – any information about an identified or identifiable natural person ("data subject"). An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, personal identification number, location information, online identifier or to one or more physical, physiological, genetic, mental, economic, cultural or social characteristics of that natural person. 3. Controller – Grow Finance OÜ, as the controller, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be laid down in Union or Member State law. 4. Third party – a natural or legal person, public authority, agency or body, other than the data subject, the controller, the processor and persons who may process personal data under the direct authority of the controller or the processor. 5. Profiling – any automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. 6. Automated decision-making – a decision taken by a data processing system without the data subject’s participation which evaluates the data subject’s characteristics, abilities or other personal characteristics, where this produces legal effects concerning the data subject or otherwise significantly affects him or her. 7. Cooperation partners – natural or legal persons or authorities with whom Grow Finance OÜ processes personal data within the framework of its business activities or to whom it transfers data. According to this document, cooperation partners include recipients of personal data, authorized processors and third parties. 8. Recipient of personal data – a natural or legal person to whom data is transferred within the framework of personal data processing. 9. Authorized processor – a natural or legal person who is authorized to process personal data on behalf of Grow Finance OÜ, or the controller, based on the instructions of the controller. Grow Finance OÜ ensures the lawfulness of personal data processing and considers keeping personal data confidential and protecting personal data to be very important. The aim is to ensure responsible processing of personal data based on the interests, rights and freedoms of the data subject. The exact scope of personal data processed by Grow Finance OÜ depends on the purpose for which the personal data is processed. Personal data is collected only for specified and legitimate purposes and is not further processed in a manner that is incompatible with these purposes. Below we provide the necessary information about the purposes and activities of processing your personal data, based on whether the data was obtained from you or whether the data was generated during the cooperation between you and Grow Finance OÜ, or between us, or obtained from a third party. Grow Finance OÜ retains personal data for as long as it is needed to achieve the purpose of processing. If personal data is to be kept longer than is necessary due to the purpose of collection, the personal data will be anonymized in such a way that you as a data subject can no longer be identified. ## II Processing activities with data obtained from you Here we provide you with an overview of the purposes and activities for which Grow Finance OÜ collects your personal data, on what legal basis it processes it and for how long the data is stored. We also highlight whether the provision of personal data is voluntary, an obligation arising from legislation or a contract or a requirement necessary for concluding a contract, and what the consequence of not providing data is. ### Activities | Activity | Purpose | Legal basis | Basis for providing data | Consequence of not providing data | Retention period | | --- | --- | --- | --- | --- | --- | | Settlement | Financial operations | Data processing necessary for entering into a contract at the request of the data subject and performance of the contract | Obligation arising from the contract | Performance of the contract may be prevented | 7 years from the recording of the economic transaction | | Responding to price inquiries | Sales | Legitimate interest (Increasing the company's turnover) | Optional | Failure to send a sales offer | 5 years from the sending of a response | | Use of cookies | Marketing; Customer service | Consent of the data subject; Legitimate interest (Ensuring the functionality of the company's website) | Optional | Use of the website may be limited | In accordance with the cookie principles | | Contract management | Protection of the company's interests | Legitimate interest (Protection of the company's rights, Prevention of losses) | Requirement necessary for entering into a contract | The contract will not be concluded | 5 years from the termination of the contract | | Prevention of money laundering and terrorist financing | Crime prevention | Fulfillment of a legal obligation | Requirement necessary for concluding a contract | No contract will be concluded | 5 years from the termination of the contract | | Use of social media | Marketing | Legitimate interest (Increasing the company's turnover) | Optional | Not receiving advertising offers | 1 year from the closure of the account | | Making background inquiries | Protection of the company's interests | Legitimate interest (Prevention of losses) | Optional | No contract will be concluded | 5 years from the termination of the contract | | Order processing | Sales | Legitimate interest (Protection of the company's rights) | Optional | No contract will be concluded | 5 years from the termination of the contract | Legitimate interest analyses can be viewed by submitting a relevant request: ## III Processing activities with data that have arisen during our cooperation or that we have received from a third party In addition to the fact that you provide us with data about yourself, data about you also arise during our cooperation and we store your data in the systems we use. We also receive data about you from third parties. Here, Grow Finance OÜ provides you with an overview of the purposes and activities for which we process your personal data that have arisen during our cooperation or that we have received from a third party. In addition, we outline the types of personal data we process and how long we store the data. ### Activities | Activity | Purpose | Legal basis | Types and sources of personal data | Retention period | | --- | --- | --- | --- | | Implementation of information security measures | Protection of company assets | Legitimate interest (Protection of company assets, including information assets) | E-mail address (System); First and last name (System); Personal identification code (System) | Data not stored | | Personal data management (change, correction, deletion) | Protection of individuals | Fulfillment of legal obligations | Email address (System); First and last name (System); Personal identification code (System) | Data not stored | | Customer account management | Protection of the company's interests | Data processing necessary for concluding a contract at the request of the data subject and fulfillment of the contract | Email address (System); First and last name (System); Personal identification code (System); Phone number (System) | 5 years from the termination of the contract; 1 month from the closure of the account | | Prevention of money laundering and terrorist financing | Crime prevention | Fulfillment of legal obligations | Email address (Data subject); First and last name (Data subject); Personal identification code (Data subject); Identity document data (Data subject); Customer data form (Data subject); Responses to background inquiries (Public source) | 5 years from the termination of the contract | | Software development | Product development | Legitimate interest (Ensuring the functionality of the company's software, including development) | Email address (System); First and last name (System); Personal identification code (System); Identity document data (System) | Data is not stored | | Making background inquiries | Protection of company interests | Legitimate interest (Prevention of damage) | First and last name (Data subject); Basis for the right of representation (Public source); Personal identification code (Public source) | 5 years from the termination of the contract | | Notifications to the customer | Ensuring customer satisfaction | Legitimate interest (Ensuring customer satisfaction) | Email address (System); First and last name (System) | 1 year from the notification | Legitimate interest analyses can be accessed by submitting a relevant request: ## IV Disclosure of personal data to partners Within the framework of our cooperation, it is necessary to disclose or transfer personal data to Grow Finance OÜ's partners, who are the following: Partners | Data analytics provider | | --- | | Data protection service provider | | Database provider | | Business software | | Digital signature service provider | | IT service partner | | Customer service partner | | Customer administration service provider | | Search engine | | Accounting and payroll program provider | | Marketing partner | Partners have the right to process personal data only to the extent necessary to fulfill the specified purposes. Partners must comply with Grow Finance OÜ's requirements regarding the processing of personal data. ## V Transfer of data to a partner located in a third country Within the framework of our cooperation, it is necessary to transfer personal data to Grow Finance OÜ's partners located in a third country, which is why we implement the following protection measures: | Partner category | Main place of business | Applicable protection measures | | --- | --- | --- | | Data Protection Service Provider | United States | EU Commission Adequacy Decision (incl. EU-US Data Privacy Framework) | | Customer Service Partner | United States | EU Commission Adequacy Decision (incl. EU-US Data Privacy Framework) | | Marketing Partner | United States | EU Commission Adequacy Decision (incl. EU-US Data Privacy Framework) | | Search Engine | United States | EU Commission Adequacy Decision (incl. EU-US Data Privacy Framework) | For more information on additional safeguards, please contact: ## VI Profile analysis including automated decisions We perform profile analysis and/or automated decisions regarding you within the framework of the following activities ### Activities | Activity | Purpose | Profile analysis and automated decisions | | --- | --- | --- | | Prevention of money laundering and terrorist financing | Crime prevention | Profile analysis | | Software development | Product development | Profile analysis | | Making background inquiries | Protection of company interests | Profile analysis | ## VII Your rights You have the right to receive information about the terms of data processing. Grow Finance OÜ will make the terms of data processing available to you on the basis of this document or a corresponding request. You have the right to access the information referred to in points 1 and 2 of the General Data Protection Regulation [Article 15](https://eur-lex.europa.eu/legal-content/ET/TXT/?uri=CELEX:32016R0679#d1e2501-1-1). We will make the information referred to in the General Data Protection Regulation available to you on the basis of this document and/or a corresponding request, which you can submit to: You have the right to request correction of your personal data. You can correct the data by sending a corresponding request to: You have the right to erasure of personal data („right to be forgotten“). You have the right to request that your personal data be erased, for example if you have withdrawn your consent to the processing of the data and there is no other legal basis for the processing of your data. You have the right to restriction of processing of personal data. You have the right to request restriction of processing of personal data if the processing of personal data is not permitted by law or if you contest the accuracy of the personal data. You have the right to request restriction of processing of personal data for a period that allows us to verify the accuracy of the personal data or if the processing of personal data is unlawful but you do not request the erasure of personal data. You have the right to receive the personal data concerning you that you have provided to us and the right to transmit this data to another controller (right to data portability). You have the right to object at any time to the processing of personal data concerning you that is necessary for legitimate interest, including profiling based on legitimate interest. You have the right to lodge a complaint with us, the Data Protection Inspectorate or a court if you find that your rights have been violated in the processing of personal data. You can find the contacts of the Data Protection Inspectorate on their website: [https://aki.ee](https://aki.ee/) You can contact us with a request or objection: . We will respond to you no later than one month after receiving your request or objection. We may, if necessary, extend this period by two months, taking into account the complexity and volume of your request or objection. In such a case, we will inform you of the extension of the deadline for submitting a response and the reasons for the delay within one month of receiving your request or objection. When we receive your electronic request, we will also respond to you electronically, unless you prefer another method of receiving a response. We have the right to refuse your request to exercise your rights if we are unable to identify you as a data subject. If we do not take action in accordance with your request or objection, we will inform you of the reasons for not taking action within one month of receiving your request or objection, and explain to you the possibility of filing a complaint with the supervisory authorities and using legal remedies. ## VIII Other terms and conditions Grow Finance OÜ has the right to update, specify and supplement the terms and conditions at any time based on changes in legislation and the processing of personal data. Last updated: 06.10.2025 11:34:22