Privacy notices
Grow Finance OÜ is the controller of personal data.
Below we explain how your personal data as a data subject is processed. When processing personal data, we base our processing on the General Data Protection Regulation and any special laws.
Our data protection contact is: Kaari Timuska (kaari@grow.ee)
I. Definitions
To make the privacy notices clear and understandable to you, we will explain some of the most important terms used in the privacy notices:
- Data subject – a natural person whose personal data is processed by Grow Finance OÜ. Data subjects are: Company contact persons, Website visitors, Company representatives, Social media platform visitors, Beneficial owners, Authorized representatives of private clients
- Personal data – any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location information, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social characteristics of that natural person.
- Controller – Grow Finance OÜ as the controller determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for his or her designation may be laid down in Union or Member State law.
- Third party – a natural or legal person, public authority, agency or body, other than the data subject, the controller, the processor and persons who may process personal data under the direct authority of the controller or processor.
- Profiling – any automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to the natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
- Automated decisions – a decision made by a data processing system without the participation of the data subject, which assesses his or her character traits, abilities or other personal characteristics, if this produces legal consequences for the data subject or otherwise significantly affects him or her.
- Cooperation partners – natural or legal persons or authorities with whom Grow Finance OÜ processes personal data within the framework of its business activities or to whom it transfers data. According to this document, cooperation partners include recipients of personal data, authorized processors and third parties.
- Recipient of personal data – a natural or legal person to whom data is transferred within the framework of personal data processing.
- Authorized processor – a natural or legal person who is authorized to process personal data on behalf of Grow Finance OÜ, the controller, based on the instructions of the controller.
Grow Finance OÜ ensures the lawfulness of the processing of personal data and considers the confidentiality and protection of personal data to be very important. The aim is to ensure responsible processing of personal data based on the interests, rights and freedoms of the data subject.
The exact scope of personal data processed by Grow Finance OÜ depends on the purpose for which the personal data is processed. Personal data is collected only for specified and legitimate purposes and is not further processed in a manner incompatible with those purposes.
Below, we provide the necessary information about the purposes and activities of processing your personal data, based on whether the data was obtained from you or whether the data was generated during the cooperation between you and Grow Finance OÜ, or between us, or whether it was obtained from a third party.
Grow Finance OÜ will retain personal data for as long as it is necessary to achieve the purpose of the processing. If personal data is to be retained for longer than is necessary for the purpose of collection, the personal data will be anonymized so that you as the data subject can no longer be identified.
II Processing activities with data received from you
Here we will provide you with an overview of the purposes and activities for which Grow Finance OÜ collects your personal data, on what legal basis it processes it, and for how long the data is stored. We will also point out whether the provision of personal data is voluntary, an obligation arising from legislation or a contract, or a requirement necessary for concluding a contract, and what the consequences are of not providing the data.
Activities
| Activity | Purpose | Legal basis | Basis for reporting data | Consequence of failure to provide data | Shelf life |
|---|---|---|---|---|---|
| Settlement | Financial operations | Data processing necessary for concluding a contract at the request of the data subject and performance of the contract | Obligation arising from the contract | The performance of the contract may be hindered | 7 years from the date of recording the economic transaction |
| Responding to price inquiries | Sales | Legitimate interest (Increasing the company's turnover) | Volunteer | Failure to submit a sales offer | 5 years from the date of delivery of the response |
| Use of cookies | Marketing; Customer Service | Consent of the data subject; Legitimate interest (Ensuring the functionality of the company's website) | Volunteer | Use of the website may be limited | According to the cookie policy |
| Contract management | Protection of company interests | Legitimate interest (Protection of company rights, Prevention of damage) | Requirement necessary for concluding a contract | No contract will be concluded. | 5 years from the date of termination of the contract |
| Prevention of money laundering and terrorist financing | Crime prevention | Fulfillment of a legal obligation | Requirement necessary for concluding a contract | No contract will be concluded. | 5 years from the date of termination of the contract |
| Using social media | Marketing | Legitimate interest (Increasing the company's turnover) | Volunteer | Not receiving promotional offers | 1 year from account closure |
| Making background inquiries | Protection of company interests | Legitimate interest (Prevention of damage) | Volunteer | No contract will be concluded. | 5 years from the date of termination of the contract |
| Order processing | Sales | Legitimate interest (Protection of company rights) | Volunteer | No contract will be concluded. | 5 years from the date of termination of the contract |
Legitimate interest analyses can be accessed by submitting a relevant request: kaari@grow.ee
III Processing activities with data that have arisen during our cooperation or that we have received from a third party
In addition to the information you provide to us about yourself, data about you is also generated during our cooperation and we store your data in the systems we use. We also receive data about you from third parties.
Here, Grow Finance OÜ provides you with an overview of the purposes and activities for which we process your personal data, which have arisen during our cooperation or which we have received from a third party. In addition, we outline the types of personal data we process and how long we retain the data.
Activities
| Activity | Purpose | Legal basis | Types and sources of personal data | Shelf life |
|---|---|---|---|---|
| Implementation of information security measures | Protection of company assets | Legitimate interest (Protection of company assets, including information assets) | Email address (System); First and last name (System); Personal identification number (System) | No data is stored. |
| Personal data management (modification, correction, deletion) | Protection of individuals | Fulfillment of a legal obligation | Email address (System); First and last name (System); Personal identification number (System) | No data is stored. |
| Customer account management | Protection of company interests | Data processing necessary for concluding a contract at the request of the data subject and performance of the contract | Email address (System); First and last name (System); Personal identification number (System); Phone number (System) | 5 years from contract termination; 1 month from account closure |
| Prevention of money laundering and terrorist financing | Crime prevention | Fulfillment of a legal obligation | Email address (Data subject); First and last name (Data subject); Personal identification number (Data subject); Identity document details (Data subject); Customer data form (Data subject); Background inquiry responses (Public source) | 5 years from the date of termination of the contract |
| Software development | Product development | Legitimate interest (Ensuring the functionality of the company's software, including development) | Email address (System); First and last name (System); Personal identification code (System); Identity document details (System) | No data is stored. |
| Making background inquiries | Protection of company interests | Legitimate interest (Prevention of damage) | First and last name (Data subject); Basis of right of representation (Public source); Personal identification number (Public source) | 5 years from the date of termination of the contract |
| Notifications to the customer | Ensuring customer satisfaction | Legitimate interest (Ensuring customer satisfaction) | Email address (System); First and last name (System) | 1 year from the date of notification |
Legitimate interest analyses can be accessed by submitting a relevant request: kaari@grow.ee
IV Disclosure of personal data to cooperation partners
As part of our cooperation, it is necessary to disclose or transfer personal data to Grow Finance OÜ's cooperation partners, who are as follows:
| Data analytics provider |
| Data protection service provider |
| Database provider |
| Business software |
| Digital signature service provider |
| IT service partner |
| Customer Service Partner |
| Customer management service provider |
| Search engine |
| Accounting and payroll software provider |
| Marketing partner |
Cooperation partners have the right to process personal data only to the extent necessary to fulfill the specified purposes. Cooperation partners must comply with Grow Finance OÜ's requirements regarding the processing of personal data.
V Transfer of data to a cooperation partner located in a third country
As part of our cooperation, it is necessary to transfer personal data to Grow Finance OÜ's cooperation partners located in a third country, which is why we implement the following protection measures:
| Partner category | Main place of business | Applicable safeguards |
|---|---|---|
| Data protection service provider | United States | EU Commission adequacy decision (including EU-US Data Privacy Framework) |
| Customer Service Partner | United States | EU Commission adequacy decision (including EU-US Data Privacy Framework) |
| Marketing partner | United States | EU Commission adequacy decision (including EU-US Data Privacy Framework) |
| Search engine | United States | EU Commission adequacy decision (including EU-US Data Privacy Framework) |
For more information about additional protective measures, please submit a request: kaari@grow.ee
VI Profile analysis including automated decisions
We perform profiling and/or automated decision-making on you in the following activities:
Activities
| Activity | Purpose | Profile analysis and automated decisions |
|---|---|---|
| Prevention of money laundering and terrorist financing | Crime prevention | Profile analysis |
| Software development | Product development | Profile analysis |
| Making background inquiries | Protection of company interests | Profile analysis |
VII Your rights
You have the right to receive information about the terms and conditions of data processing. Grow Finance OÜ will make the terms and conditions of data processing available to you on the basis of this document or a corresponding request.
You have the right to access the General Data Protection Regulation article 15 with the information specified in points 1 and 2. We will make the information specified in the General Regulation available to you on the basis of this document and/or a corresponding request, which you can submit: kaari@grow.ee
You have the right to request correction of your personal data. You can correct the data by sending a corresponding request to: kaari@grow.ee
You have the right to erasure of your personal data (“right to be forgotten”). You have the right to request that your personal data be erased, for example if you have withdrawn your consent to the processing of the data and there is no other legal basis for the processing of your data.
You have the right to restrict the processing of your personal data. You have the right to request the restriction of the processing of your personal data if the processing of your personal data is not permitted by law or if you contest the accuracy of your personal data. You have the right to request the restriction of the processing of your personal data for a period that allows us to verify the accuracy of your personal data or if the processing of your personal data is unlawful but you do not request the erasure of your personal data.
You have the right to receive the personal data concerning you that you have provided to us and the right to transmit this data to another controller (right to data portability).
You have the right to object at any time to the processing of personal data concerning you which is necessary for legitimate interests, including profiling based on legitimate interests.
You have the right to file a complaint with us, the Data Protection Inspectorate or a court if you believe that your rights have been violated in the processing of your personal data. You can find the contacts of the Data Protection Inspectorate on their website: https://aki.ee
You can contact us with a request or objection: kaari@grow.ee. We will respond to you no later than one month after receiving your request or objection. We may, if necessary, extend this period by two months, taking into account the complexity and volume of your request or objection. In such a case, we will inform you of the extension of the deadline for submitting a response and the reasons for the delay within one month of receiving your request or objection. When we receive your electronic request, we will also respond to you electronically, unless you prefer another method of receiving a response.
We have the right to refuse to grant your request to exercise your rights if we are unable to identify you as a data subject.
If we do not take action in accordance with your request or objection, we will inform you of the reasons for not taking action no later than one month from the date of receipt of your request or objection and explain to you the possibility of filing a complaint with the supervisory authorities and using legal remedies.
VIII Other conditions
Grow Finance OÜ has the right to update, specify and supplement the terms and conditions at any time, based on changes in legislation and the processing of personal data.
Last updated: 06.10.2025 11:34:22