Legal
Privacy Notice
1. Who we are
Contact Person Estonia is a trading name of JusTrust OÜ, registered in Estonia under registry code 16093920, address Harju maakond, Tallinn, Kesklinna linnaosa, Viru väljak 2, 10111, Estonia. JusTrust OÜ holds activity licence FIU000395 from the Estonian Financial Intelligence Unit.
Quintum OÜ (registry code 17024619) is the controller of personal data processed in connection with applications for, and the provision of, accounting services. JusTrust OÜ (registry code 16093920) is the controller of personal data processed in connection with contact person, legal address and mail forwarding services. Each processing activity described in this notice identifies the controller responsible for that activity.
Quintum OÜ is registered in Estonia under registry code 17024619, address Harju maakond, Tallinn, Kesklinna linnaosa, Viru väljak 2, 10111, Estonia. For questions about accounting data write to privacy@quintum.ee; for questions about contact person, legal address or mail data write to hello@contactpersonestonia.ee.
Contact Person Estonia is not a separate company. The same services are also offered by JusTrust OÜ under other names and in packages that include advisory work, at a different price. Accounting services are provided and invoiced by Quintum OÜ. Contact person, legal address and mail services are provided separately by JusTrust OÜ under the applicable Contact Person Estonia terms.
2. When you visit this website
Controller: JusTrust OÜ
| What | Why | Legal basis |
|---|---|---|
| Google reCAPTCHA on the contact form of our home page: your IP address, device and behaviour data, and cookies set by Google | to stop automated spam submissions | Art 6(1)(f) legitimate interest in protecting the form |
| Google Maps, embedded on our home page to show where our office is: your IP address and browser data are received by Google when that map loads | to show the location of our office | Art 6(1)(f) legitimate interest in telling you where to find us |
We use no analytics, advertising or tracking tools, and we set no cookies of our own. Our fonts and stylesheets are served from our own server, so no content delivery network or font provider receives your data. This page and our Terms page load nothing at all from third parties — the two items above apply only to the home page.
3. When you write to us, or apply for our services
Controller: JusTrust OÜ
The contact form on our home page. We collect the name, e-mail address and message you enter, use them to answer you, and send you an automatic confirmation.
The application form for Contact Person, Legal Address and Mail Forwarding. We collect what the company does, anything you choose to write in the free-text field, your name and your e-mail address, and your confirmation that the company does not carry out any of the activities we do not serve. If the company is already registered, we also collect its Estonian registry code and read its name from the register, so you do not type it. If the company is being founded, we instead collect its proposed name and your declaration that you are applying for and on behalf of the company being founded. We use this to answer you and to decide whether we can take the company on. Applications for accounting are described in section 6.
Legal basis. For the contact form and for applications for a registered company: Art 6(1)(b) steps taken at your request before entering a contract, and Art 6(1)(f) our legitimate interest in responding to enquiries. For applications for a company that is being founded: Art 6(1)(f) our legitimate interest in responding to your application and deciding whether we can take the company on. If we cannot take the company on, or you do not go ahead, we keep what you sent for 12 months (section 10).
Paying for your application. You pay the fee when you apply. To receive, reconcile and, where a refund is due, refund the payment, we process the payment reference and amount, when it was paid, any refund, and the name and country that our payment provider gives us for the person who paid. Legal basis: Art 6(1)(f), our legitimate interest in administering payments connected with your application and our services. If someone other than you paid, we establish who they are and what their relationship to the company is before we accept the application, and if they own or control the company we include them in our due diligence; the legal basis for that is Art 6(1)(c), our anti-money laundering and sanctions obligations. We keep accounting records under Art 6(1)(c) (Accounting Act).
Your right to object to this. Where we rely on our legitimate interest — including for an application for a company that is being founded — you may object at any time, on grounds relating to your particular situation. Write to hello@contactpersonestonia.ee. We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims. If you object while your application is open, we cannot continue with it.
4. If we contacted you first — where we got your details
Controller: JusTrust OÜ
We may write to Estonian companies to offer our services. If you received such a message from us, this section explains it. This is the information required by Article 14 of the GDPR, because we did not obtain the data from you.
| Question | Answer |
|---|---|
| Where did you get my address? | From the open data of the Estonian Business Register (avaandmed), published by the Centre of Registers and Information Systems (RIK) and freely available to anyone. |
| What do you hold? | The company's name, Estonian registry code, registered address, field of activity, the date it was entered in the register, and the e-mail address the company itself publishes in the register. |
| Whose data is it? | Company data. Where a company e-mail address identifies a person, it is personal data and this notice applies to it. |
| Why are you writing to me? | To offer Contact Person, Legal Address and Mail Forwarding services to companies that appear likely to need them — for example a company whose own address is outside Estonia. |
| On what legal basis? | Art 6(1)(f) legitimate interest in offering a relevant business service to another business. We have weighed this against your interests: the data is already public, the message is addressed to a company about its own regulatory position, and you can stop it at any time. |
| How long do you keep it? | 12 months, unless you become a client or ask us to keep your objection on record for longer. |
Two limits we set ourselves, and you can hold us to them:
We use the e-mail address the company publishes in the register. We do not use the personal contact details of a company's contact person or board member taken from the register for this purpose.
We write to a company once about a given offer. We are not running a sequence, and we do not sell or share the list.
Your right to object is absolute here. Under Art 21(2) you may object to direct marketing at any time and without giving a reason, and we must stop. Reply to the message and say so, or write to hello@contactpersonestonia.ee. We keep a record of your objection so that we do not contact you again — that record is the one thing we keep after you object.
5. When you become our client
Controller: JusTrust OÜ
| Data | Why | Legal basis |
|---|---|---|
| Company name, registry code, address, contact details | to provide the service and to be entered in the Commercial Register as your contact person | Art 6(1)(b) contract |
| Identity data of board members, shareholders and beneficial owners: full name, personal identification code or date of birth, citizenship, identity document data and a copy of the document, address | customer due diligence required by law (RahaPTS) | Art 6(1)(c) legal obligation |
| Screening results: politically exposed person status, international sanctions checks | due diligence and ongoing monitoring | Art 6(1)(c) legal obligation |
| Correspondence received at our address for your company, and forwarding records | to provide Mail Forwarding. This may incidentally contain personal data of the people who wrote to you | Art 6(1)(b) contract; Art 6(1)(f) for the sender's data |
| Payment and billing data | to invoice you and keep accounting records | Art 6(1)(b) contract; Art 6(1)(c) Accounting Act |
Due diligence is required by law, not by us, and it is the same for every client. It does not depend on the fee you pay or the package you choose. We cannot provide the service without it, and we cannot delete the records early.
If your company is being founded, we carry out this due diligence on you, as the person applying, before we accept the application (Art 6(1)(c) legal obligation), and on the company after it is registered.
6. Accounting services and accounting applications
Controller: Quintum OÜ
Accounting services offered through Contact Person Estonia are provided and invoiced by Quintum OÜ. When you apply for accounting through this website, Quintum OÜ is the controller of the personal data you provide and of the data created in the accounting relationship that follows.
When you apply. The application form asks for your company's registry code, its field of activity, and the name and email address of the person we should reply to. We use this to assess whether we can take the company on and to reply to you. The legal basis is the taking of steps at your request before entering into a contract (Art 6(1)(b)).
When you become an accounting client. To provide accounting services Quintum OÜ processes the data your business gives us: contact details of the people we deal with, and the accounting source documents, invoices, bank data, payroll data and tax filings we handle on your behalf. The legal basis is the performance of our contract (Art 6(1)(b)) and Quintum's legal obligations as an accounting service provider (Art 6(1)(c)).
Money laundering prevention. Quintum OÜ provides accounting services and is therefore an obliged entity under the Estonian Money Laundering and Terrorist Financing Prevention Act (rahapesu ja terrorismi rahastamise tõkestamise seadus, RahaPTS § 2(1) p 7). Before entering into a business relationship, and periodically afterwards, Quintum identifies and verifies the client, its representatives and its beneficial owners, establishes the purpose and nature of the relationship, screens against international sanctions lists, and monitors the relationship on an ongoing basis. The legal basis is Quintum's legal obligation (Art 6(1)(c)).
Who operates this website. JusTrust OÜ operates Contact Person Estonia and the accounting application form, and processes accounting application data on behalf of Quintum OÜ and on its instructions. JusTrust OÜ does not use accounting application data for its own customers, marketing or commercial profiling.
7. Your data becomes public in the Commercial Register
Controller: JusTrust OÜ
If you use our Contact Person or Legal Address service, the fact that JusTrust OÜ is your company's contact person, and our address as your company's registered address, are entered in the Estonian Commercial Register and are publicly accessible. Data about a company's board members and shareholders is published by the Register itself under Estonian law.
We cannot restrict or withdraw that publication. It follows from Estonian law, not from your contract with us.
8. Who else receives your data
| Recipient | Why |
|---|---|
| Estonian Commercial Register | as described in section 7 |
| Estonian Financial Intelligence Unit (Rahapesu Andmebüroo) | where we are required to report. We are prohibited by law from telling you that we have made such a report. |
| Estonian Tax and Customs Board, notaries, courts, other authorities | where the law requires |
| Google (Gmail) | We keep a copy of correspondence sent to hello@contactpersonestonia.ee in a mailbox operated by Google, so that we can manage and answer it |
| reCAPTCHA and website resources (section 2) | |
| Stripe (payment provider) | to process your payment. Stripe also uses the data it receives (section 9) for its own purposes, as a separate controller: to prevent fraud and loss, and to meet its own legal obligations, including anti-money laundering checks. Stripe's privacy policy applies to that use: stripe.com/privacy |
| Our service providers acting on our instructions: hosting, e-mail, payment, identity verification and screening providers | to run the service. They may use your data only on our instructions. The current list is available on request. |
We do not sell your data and we do not share it for anyone else's marketing.
9. Where your data is kept, and transfers outside the EEA
Our own servers are located in the European Union (Germany).
In addition, a copy of e-mail correspondence sent to hello@contactpersonestonia.ee is held in a mailbox operated by Google, so that we can manage and answer it. Google also processes the data from the reCAPTCHA on our contact form.
Google may process this data outside the EEA, including in the United States. Where such a transfer takes place it relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework or on standard contractual clauses.
When you pay for your application, the payment is handled by Stripe, our payment provider. We pass to Stripe the amount, your e-mail address (for the payment and the receipt), our reference for your application and, depending on whether your company is already registered, either its registry code or — if it is being founded — its proposed name. This data is transferred to Stripe, LLC in the United States, and Stripe may pass it on to its affiliates and sub-processors in other countries, including India. Stripe also collects directly what you enter on its payment page.
The transfer to Stripe, LLC relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which Stripe, LLC is certified. Where that framework does not apply, the transfer relies on standard contractual clauses.
10. How long we keep it
| Data | Period |
|---|---|
| Marketing contact data from the register (section 4) | 12 months |
| A record that you objected to marketing | kept for as long as needed so that we do not contact you again |
| Enquiries that do not lead to a contract | 12 months |
| Due diligence data and documents, transaction records | 5 years after the business relationship ends (RahaPTS) |
| Due diligence records where no business relationship was established — we did not accept the application, you withdrew, or due diligence could not be completed | 5 years from the date the due diligence case was closed, under our retention rule for records required to be retained under RahaPTS |
| Contract and service records | 5 years after the contract ends |
| Accounting source documents | 7 years (Accounting Act § 12) |
Where a supervisory authority or a court requires longer retention, we keep the data for as long as that requirement lasts.
11. Automated decision-making
We do not make decisions about you by automated means alone. Every decision to accept, refuse or end a business relationship is taken by a person. If this changes, we will update this notice before the change takes effect.
12. Your rights
You may ask us for a copy of your data, ask us to correct inaccurate data, and — where the law allows — ask us to erase it, to restrict processing, or to receive it in a portable form. Where we rely on legitimate interests, you may object — and for direct marketing that right is absolute (section 4).
These rights are limited where we process data to meet a legal obligation. We cannot erase due diligence records before the statutory period ends, and we cannot tell you whether we have reported a suspicion.
Write to hello@contactpersonestonia.ee. We answer within one month.
You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, or to the supervisory authority where you live.
13. Security
Access to your data is limited to the people who need it for their work. Data is protected in transit by encryption and backed up regularly.
14. Changes to this notice
The version number and date at the top always show the current text. We keep earlier versions and can provide them on request.