Access (Art. 15)
Ask whether we hold data about you and receive a copy of it, together with the information in this notice.
Privacy notice
How BalticDealHub collects, uses and protects personal data under the General Data Protection Regulation (EU) 2016/679.
1. Who is responsible for your data
The controller of the personal data described in this notice is the operator of balticdealhub.ee, established in Tallinn, Estonia. You can reach us at the postal address on our contact page, or by email for any privacy matter. If we appoint a Data Protection Officer their contact details will be published here; you may use the privacy address below in the meantime, and it is monitored specifically for data protection requests.
2. What this notice covers
This notice applies to the balticdealhub.ee website and the marketplace services offered through it: browsing, enquiring about a listing, publishing a listing, verifying your identity, and contacting us. It does not cover the websites of advisers, banks or other third parties we may introduce you to, each of whom acts as its own controller.
3. What personal data we collect
We collect only what a marketplace transaction genuinely requires. Depending on how you use the site that means: identification and contact data you type into a form (name, email address, telephone number, company); listing content you choose to publish, which for a seller includes commercial and financial information about the business and may incidentally identify you; verification data where you verify your identity or we check who is enquiring (proof of identity and, where you provide it, evidence of funding); correspondence with our team; and technical data generated automatically by your browser, such as IP address, user agent and the pages requested. We do not ask for special categories of data under Article 9, and you should not send them to us.
4. Why we use it, and our legal basis
Article 6 of the GDPR requires a lawful basis for every processing purpose. Ours are set out below, together with how long we keep the data for that purpose.
| Purpose | Data used | Legal basis | Retention |
|---|---|---|---|
| Delivering and securing the website | IP address, browser type, pages requested | Art. 6(1)(f) — our legitimate interest in operating a functioning, secure site | Server logs deleted after 30 days |
| Answering your enquiry | Name, email, telephone, company, message | Art. 6(1)(b) — steps at your request before a contract, or Art. 6(1)(f) | 24 months after our last contact |
| Publishing and managing a listing | Listing content, business financials, seller contact details | Art. 6(1)(b) — performance of our agreement with you | Duration of the listing plus 24 months |
| Verifying a party before an introduction | Identity evidence, funding evidence | Art. 6(1)(b) and Art. 6(1)(c) — contract, and legal obligations including anti-money-laundering checks where they apply | 5 years from the end of the relationship |
| Sending you market updates you asked for | Email address, topics of interest | Art. 6(1)(a) — your consent | Until you withdraw consent, then a suppression record is kept |
| Optional cookies: audience measurement and marketing | Device and usage data as listed in the cookie policy | Art. 6(1)(a) — your consent, plus Art. 5(3) ePrivacy Directive | Per item, see the cookie policy; consent expires after 12 months |
5. Cookies and similar technologies
Storage on your device is governed by Article 5(3) of the ePrivacy Directive. Only strictly necessary items are placed automatically; everything else waits for your consent, which you give or refuse through our banner and can change at any time. Our cookie policy lists every item individually.
6. Who we share data with
We do not sell personal data and we do not share it for third-party advertising. We disclose it only to: the counterparty in a transaction, and only what you have approved for release, normally after a non-disclosure agreement is signed; professional advisers (legal, tax, valuation) where you ask to be introduced; service providers acting as processors under Article 28 written contracts, such as our hosting provider and email service; and public authorities where a law obliges us to. Each processor is bound to act only on our documented instructions and to apply appropriate security.
7. Transfers outside the EEA
Our hosting and primary infrastructure are located inside the European Economic Area. If a provider we use processes data outside the EEA, we rely on an adequacy decision under Article 45 or, failing that, on the European Commission's Standard Contractual Clauses under Article 46 together with a transfer impact assessment. You can ask us for a copy of the safeguards in place.
8. How long we keep data
We keep personal data only as long as the purpose requires, then delete or anonymise it. The retention periods for each purpose are in the table above. Where a longer period is imposed by Estonian accounting or tax law — seven years for accounting source documents — that period prevails for the records concerned.
9. Your rights
The GDPR gives you the following rights over your personal data. They are free to exercise and we will respond within one month of receiving your request, extendable by two further months for complex requests, in which case we will tell you why.
Rectification (Art. 16)
Have inaccurate data corrected and incomplete data completed.
Erasure (Art. 17)
Have your data deleted where it is no longer needed, where you withdraw the consent it rested on, or where you successfully object.
Restriction (Art. 18)
Require us to pause processing while an accuracy dispute or an objection is resolved.
Portability (Art. 20)
Receive the data you gave us in a structured, machine-readable format, and have it sent to another controller where technically feasible.
Objection (Art. 21)
Object at any time to processing based on our legitimate interest. Where the objection concerns direct marketing we stop immediately, with no balancing test.
Withdrawing consent (Art. 7(3))
Withdraw any consent as easily as you gave it. This does not affect the lawfulness of what we did before you withdrew.
Complaint (Art. 77)
Lodge a complaint with a supervisory authority, in the EU country where you live, work, or where you believe the infringement happened.
How to exercise your rights
Write to our privacy address with enough detail to identify the data concerned. We may ask you to confirm your identity before we act, because releasing data to the wrong person would itself be a breach. We do not charge for this, and we will not treat you less favourably for asking. privacy@balticdealhub.ee
Supervisory authority
Our lead supervisory authority is the Estonian Data Protection Inspectorate. You have the right to complain to them directly, and you may also seek a judicial remedy under Article 79.
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) — Tatari 39, 10134 Tallinn, Estonia —
https://www.aki.ee/en
10. Automated decision-making
We do not make decisions producing legal or similarly significant effects about you by automated means, and we do not profile you. The valuation calculator on this site is a simple arithmetic tool that runs entirely in your browser: the figures you type are never transmitted to us or stored.
11. Security, and children
The site is served exclusively over TLS, access to non-public material is granted per request rather than by default, and we apply the principle of least privilege to internal access. No system is perfectly secure, so if a breach is likely to result in a risk to your rights we will notify the supervisory authority within 72 hours as Article 33 requires, and notify you directly where the risk is high. This service is intended for business users and is not directed at children; we do not knowingly collect data from anyone under 18.
12. Changes to this notice
We may update this notice as the service develops. The version number and date at the top of this page always identify the current text. Where a change materially affects how we use data you have already given us, we will bring it to your attention rather than relying on you to check.
This notice is drafted to match how the site is actually built. Before you go live, have it reviewed by a qualified adviser and confirm that every retention period and processor named here matches your real operations.