Privacy policy

1. Who processes your personal data?

E-Raamatupidamine24 services are provided by MR Trade OÜ, registry code 12686623 (referred to as “we”, “us” or “our”).

Address: F. R. Kreutzwaldi tn 43b, Võru, 65610, Estonia
Email: info@e-raamatupidamine24.ee
Phone: +372 5820 7197

This policy explains how we process personal data about website visitors, people making enquiries, clients and their representatives, and people whose data are supplied to us for service delivery. Personal data means information relating to an identified or identifiable individual.

2. When are we a controller or a processor?

As a controller, we determine the purposes and means of processing, for example when managing our client communications, invoicing for our services and meeting our own statutory obligations.

As a processor, we process a client's employees', customers' or other individuals' data on the client's behalf when providing accounting, payroll or other agreed services. We follow the client's documented instructions and the data processing agreement. The client determines the purposes and applicable legal bases for that processing.

Our role depends on the particular activity. Within the same client relationship, we may have different roles for different processing operations.

3. What data do we obtain and from where?

We process only data necessary for the relevant purpose. These may include:

• Enquiry and contact data: name, email address, telephone number, company, position or authority to represent a company, and enquiry and correspondence content.
• Contract and billing data: services ordered, contracts, invoices, payments, arrears and documents relating to our cooperation.
• Identification and due diligence data: personal identification code or date of birth, citizenship, identity document information, authority to represent a company and beneficial ownership information, to the extent necessary to meet a statutory obligation.
• Service delivery data: accounting source documents, transaction and bank account information, payroll and employment data, and other information needed for the agreed work. Payroll may involve limited health data where necessary, for example to account for statutory absences or benefits. Diagnoses and unnecessary health information should not be sent to us.
• Website data: IP addresses, technical logs, cookie choices and usage data in accordance with website settings and your consent where required.

We obtain data from you, your representative or the client on whose behalf we work. Where necessary, we also obtain data from public registers, competent authorities, payment information and communications during service delivery. Public availability alone does not permit unrestricted use.

4. Why do we use data and on what basis?

• Enquiries, proposals and contracts with you as an individual: necessary pre-contractual steps and contractual performance under GDPR Article 6(1)(b).
• Communications with a corporate client's representatives: legitimate interests in managing the client relationship and service delivery under Article 6(1)(f), taking account of individuals' rights and reasonable expectations.
• Our accounting, tax and anti-money laundering obligations: compliance with applicable statutory obligations under Article 6(1)(c).
• Legal claims and information-system security: legitimate interests in protecting rights, evidencing agreements and preventing misuse under Article 6(1)(f), where necessary and proportionate.
• Consent-based direct marketing and non-essential analytics and marketing tracking: your consent under Article 6(1)(a). Sending an enquiry does not subscribe you to a newsletter.

The controller determines the grounds for processing carried out on a client's behalf. Health data require an applicable Article 9 exception in addition to an Article 6 basis, for example to meet employment and social protection obligations where the relevant conditions are met.

Refusing information necessary for a contract or statutory obligation may prevent service delivery or the establishment of a client relationship. Refusing optional marketing consent does not prevent you from ordering our core services.

5. Who receives data and how do we protect them?

Access is limited to our authorised staff as necessary for their work and the following categories of service providers:

• accounting, payroll, client management and other business software providers;
• hosting, IT administration, communications, document management and archiving providers;
• legal and audit providers where their involvement is necessary;
• competent authorities where there is a statutory obligation or another applicable legal basis.

We use externally supplied online software services. Processing by processors is governed by contractual arrangements. When engaging sub-processors for client data, we follow the data processing agreement and applicable authorisation requirements.

We apply technical and organisational measures appropriate to the risks, including access restrictions, confidentiality obligations and secure data exchange. No information system can be guaranteed to be entirely risk-free.

6. Transfers outside the EEA

Using an online service does not automatically mean that data remain within the European Economic Area. Remote access by a provider or sub-processor from another country may also be relevant.

Transfers outside the EEA require a basis under GDPR Chapter V. This may be a European Commission adequacy decision covering the transfer or appropriate safeguards, such as standard contractual clauses with the necessary assessment and supplementary measures. The US data protection framework can be relied on only where the particular recipient and transfer fall within the applicable adequacy decision.

You can contact us by email for information about specific transfers affecting your data and how to access the relevant safeguards.

7. How long do we retain data?

Retention depends on the data category, purpose, contract and statutory obligations.

• Our accounting records: for the mandatory period under § 12 of Estonia's Accounting Act. The applicable period and its starting event depend on the document category, including the specific provisions for records concerning long-term rights and obligations.
• Anti-money laundering records: for the period required by the Money Laundering and Terrorist Financing Prevention Act, according to the data category and applicable starting event, such as the end of a business relationship or completion of a transaction. Withdrawing consent does not end a statutory retention obligation.
• Enquiries and proposals: as necessary to handle the enquiry and related proposal negotiations. Subsequent retention requires a separate justification, such as a legal claim or statutory obligation.
• Contracts and claims records: as necessary for contractual performance and to establish or defend relevant claims, taking account of limitation periods and ongoing disputes.
• Marketing data: until consent is withdrawn or the purpose ends, whichever is earlier. Minimal information needed to evidence consent or respect an opt-out may be retained on a separate lawful basis.
• Website data and cookies: according to the stated lifetime of the particular cookie and the justified retention need for technical data. Withdrawing consent stops the relevant consent-based processing.

Data held on a client's behalf are returned or deleted in accordance with the client's instructions and the data processing agreement, unless statutory retention is required. When the applicable period or need ends, data are deleted or irreversibly anonymised.

8. Cookies and website technologies

Strictly necessary cookies support the website or a function you request. We ask for prior consent for analytics and marketing cookies and other non-essential tracking.

You can refuse non-essential cookies through the banner and subsequently change your preferences or withdraw consent. Visiting or scrolling through the website, or reading this policy, is not consent. Information about the actual cookies, providers, purposes and lifetimes is supplied in cookie settings.

Your browser can delete existing cookies. Refusing non-essential cookies should not prevent use of the website's core functions; displaying external content may require a separate choice.

9. Your rights and how to contact us

Subject to the applicable conditions, you can request access and a copy, rectification, erasure or restriction, and portability of data you provided that are processed automatically on consent or contract grounds.

You can object to legitimate-interest processing on grounds relating to your situation, and always object to direct marketing. Consent can be withdrawn at any time without affecting the lawfulness of earlier processing.

Write to info@e-raamatupidamine24.ee. We may request proportionate additional identity-verification information. We generally respond within one month and notify you of a justified extension within the first month. Statutory retention may limit erasure.

Where we act as a processor, we assist in referring requests to the client acting as controller. You may complain to Estonia's Data Protection Inspectorate or another competent supervisory authority and seek a judicial remedy.

10. Updates

We update this policy when our practices or applicable requirements change. The website will display the current version and its effective or updated date. We provide additional notice of material changes where necessary.