ESTATEGURU PRIVACY RULES
Effective as of 01.12.2022

Each company of the Estateguru group (collectively, "Estateguru" or “we”) recognizes the importance of the proper and adequate protection of personal data of natural persons. This Privacy Statement helps you to understand why and how we process your data. We explain how we collect and use as well as what we do to protect your data and what are your rights in relation to your personal data.

This Privacy Statement is applicable to you if you are our investor, a representative or related party to a legal entity investor or borrower, if you submit an information request on our Portal or contact us for any other purpose, if we have received your personal data from third parties, and if you visit our Portal at estateguru.co or any of its sub-pages.

1. Terms and definitions

Any capitalized terms used in this Privacy Statement which are not defined herein, follow the definitions provided in the Estateguru User Terms.

Personal data – any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing of personal data – any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Controller – the natural or legal entity, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Joint controller – two or more controllers who jointly determine the purposes and means of data processing. They have equal responsibilities for compliance with the obligations under the GDPR in ensuring the rights of the data subject are met, the data subjects are appropriately informed and there is designated contact point for data subjects.

Processor – a natural or legal entity, public authority, agency or other body which processes personal data on behalf of the controller.

Third party – a natural or legal entity, public authority, agency or body other than the data subject, controller, processor or persons who process personal data under the direct authority of the controller or processor.

Data subject – a person whose personal data is processed (e.g. an Investor who is a natural person, a visitor of our Portal at estateguru.co or any of its sub-pages, a representative or a contact person of a legal entity).

2. The categories of personal data we process

We collect the following personal data:

Identification data – first and last name, a national identification number (e.g. personal identification code, social security number) and/or date of birth, age, language, copy of an identification document with a photo (including the following data: date of issue and validity of the document,  gender, citizenship) and other data needed for a person’s identification (for a more specific description of data processing upon identification, please refer to the privacy terms of our identification service providers Veriff and Onfido); 

Contact data – phone number, e-mail address, contact address;

Due diligence data – data which is necessary to take due diligence measures regarding creditworthiness, anti money laundering and prevention of terrorism financing and to comply with international sanctions, including your residency data, area of activity, origin of funds and assets used in transactions, and qualifications or connections to politically exposed persons;

Transaction data – data related to the financial transactions you make via the Portal, including data on invested and available funds, loan contracts, incoming and outgoing payments, debts etc.

Bank account data – name of the account holder, account number, IBAN, Swift code (BIC) and the name of the bank;

User preferences of the Portal – data related to the preferences and settings defined by the Portal User;

Contract data – any contracts negotiated or concluded by the User via the Portal;

Loan guarantor data – identification and contact data of collateral provider, proof of assets (including data on mortgaged assets or other collateral) used in guaranteeing the loan; 

Portal data – data on the Portal visitors’ sessions, cookies, and IP addresses, time and number of log-ins, including log-ins via Facebook, LinkedIn or other third-party service provider;

Communication data – personal data related to any communication with you e.g. data from e-mails or chatbot conversations with Estateguru. 

3. Purpose and legal basis for processing personal data

Estateguru processes personal data under the following legal grounds.

3.1 Data processing required for performance of a contract.

We are processing personal data when this is necessary for the performance of a contract concluded with you or for taking the necessary measures prior to signing of the contract.  

3.2. Processing to fulfil legal obligations of Estateguru

Legal obligations of processing include all personal data processing under relevant laws and regulations in all of our locations, for example the European Crowdfunding Regulation (Regulation (EU) 2020/1503) and other European and domestic financial sector regulations and accounting laws. These laws and regulations mandate the type of data collected and data retention periods. 

3.3. Data processing based on Estateguru’s legitimate interest

A legitimate interest means that data processing is necessary for our business purposes. We process personal data based on our legitimate interest only if we have conducted balance test to measure the impact of the processing on your privacy and data protection rights. You have a right to receive additional information about our or third-party legitimate interest and to object to the personal data processing. If you object to the processing of your personal data under our legitimate interests, we shall no longer process the personal data for that purpose unless we demonstrate compelling legitimate grounds for the processing. When you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

*User profiling

We use different data processing technologies to process your data using mathematical analysis, statistics or other methods enable us to create investor profiles, establish probabilities and intermediate to you suitable investment opportunities. The information received gives us an opportunity to evaluate and predict your preferences in investment and offer to you the investment options matching your expectations. We might also need to profile our Users when performing risk assessment or for anti-money laundering purposes.  

3.4. Data processing based on your consent

When processing personal data with consent as a lawful basis, we limit the use of your data to those processing activities you have consented to. You can take back your consent at any given time and as easily as it was given.

You have a right to withdraw your consent at any time by contacting us at: info@estateguru.co and we will delete the data we are processing based on your consent, unless we also need the personal data for processing activities conducted under other legal bases. 

4. The sources of personal data

We collect your personal data from the following sources: 

• Directly from you;
• Third parties such as public registers (e.g real estate register, building register, business register);
• verification service providers;
• Solvency and credit information service providers.

Please note that if you provide Estateguru any personal data of third persons (e.g. when disclosing the data of a collateral provider), it is your responsibility to make sure you have the right to do so (for example you have the data subject’s consent).

5. Managing access and disclosures of personal data by Estateguru

Internally, we need to share personal data about our Users between different Estateguru entities for administrative and marketing purposes, and to the extent it is needed to provide and develop the services. Inside our organisation your personal data is accessible only to those Estateguru employees who need the data to perform their work duties (on so-called need-to-know basis). 

Outside Estateguru, in a manner strictly limited by necessity and pursuant to the purposes, Estateguru may transfer data to the following categories of third party service providers such as: IT maintenance service, server hosting, e-mail service, website administration, audit, legal counselling.

Estateguru also needs to disclose your personal data to third persons who are independent controllers in the following situations:

• if legally obliged, your data shall be disclosed to public authorities and institutions (e.g. police, courts, data protection supervisory authorities);

• banks, payment or e-money institutions providing payment transfer services to whom we transfer personal data related to payments to fulfil the agreement concluded between you and us or to apply prevention of money laundering and terrorism financing measures;
• in exceptional cases, we might have to disclose certain limited amount of personal data to any entity who provides or intends to provide financing to Estateguru (including by giving a loan or purchasing any type of debt instrument) or is involved in the relevant process as an intermediary or advisor;
• for debt collection purposes to the courts, bailiffs and debt collection service providers.

We conclude a data sharing agreement with our partners to ensure secure processing of personal data. These contracts oblige the other parties to: 

• take appropriate measures to ensure confidentiality and security of the personal and 

• process personal data in compliance with legal requirements and the agreement.

6. Transfer to third countries

A third country is a country other than the EU member state, EEA country or a country that doesn’t have European Commission adequacy decision.

We do not store or transfer your data outside the European Economic Area or to third countries which the European Commission does not consider as having an adequate level of protection of personal data, except for cases described herein. If necessary, the transfer will only take place if we have a legal basis for it, in particular if we have concluded an agreement with the recipient which meets the requirements established in GDPR for the transfer of personal data outside the EEA and have applied other relevant measures to ensure the security of the transfer.

Estateguru is using the services of one of our affiliates, EstateGuru Technology LLC in Armenia for IT and technological support services. In the course of providing these services, some employees of EstateGuru Technology LLC may have access to your personal data. We are making sure your data is processed according to the high standards of GDPR by keeping in place a data processing agreement and the Standard Contractual Clauses, to implement appropriate technical and organisational measures and ensure that your rights are protected.

7. Data retention periods

Your personal data is retained for as long as required by legal requirements applicable in the relevant country of operations, or until the purpose of processing is fulfilled. Below are some examples of data retention periods:

8.  Security of your personal data

Estateguru applies necessary legal, organisational, physical and technical security measures to protect your personal data, as specified in dedicated internal rules of Estateguru. Some examples of the measures we use:

Physical measures – the offices are locked and paper-based documents containing personal data are stored in locked cabinets. 

Technical measures – computers are password protected and encrypted as necessary; firewalls and antivirus programmes are in use; backups are done regularly; all IT system users are assigned roles and profiles.

Organisational measures – data protection, information security and access management policy; regular employee training, confidentiality requirements for employees.

9. Your rights concerning your personal data

You have the right to receive information what data we process about you and receive a copy of the personal data we hold about you.

You have the right to request deletion of your personal data. Please keep in mind that we cannot delete any data that we process to fulfill contractual or legal obligation. 

You have the right to object to or restrict the processing of your personal data.

You have the right to data portability which means that if technologically possible we can forward your data in a digital format to other similar service.

We always make sure that a person requesting information about themselves or submitting any other data subject request is identified and is entitled to exercise the above-mentioned data subject’s rights. For this reason, you may have to prove your identity or right to make the request.

If you have any queries about how we process your data please contact us at: info@estateguru.co

10. Data processing roles 

Estateguru entities act as a controller, a joint controller or a processor in various personal data processing activities, as specified below. 

Estateguru OÜ is the Controller for all Investor and Borrower data, for all data you have registered on the Portal, for our supplier or partner personal data and for the data of our Portal visitors.

Estateguru OÜ (registry code: 12558919)

Tartu mnt 2
Tallinn 10145
Estonia 

In Finland, Latvia, Lithuania and Germany, the controller for the personal data which you disclose to the relevant local Estateguru entity is as follows:

Estateguru Lietuva UAB in Lithuania;
Estateguru Latvia SIA in Latvia;
Estateguru Germany Gmbh in Germany;
Estateguru Finland Oy in Finland.

The contact details of the above mentioned Estateguru entities are available on our homepage footer at https://estateguru.co/.

We are a joint controller with Lemonway SAS in the processing of the payments related to loans granted via Estateguru Portal.

Lemonway SAS (registry code: 500 486 915)
8 rue de Sentier
Paris 75002
France

Our Armenian entity, EstateGuru Technology LLC, acts as a data processor when providing IT services to other entities of Estateguru.  

11. Contact data of DPO

We have a Data Protection Officer (DPO) overseeing data protection at Estateguru group level. If you have any questions regarding this Privacy Statement or our processing of personal data please contact us at: dpo@estateguru.co.

12. The right to submit a complaint to the data protection supervisory authority

In case you consider your privacy and data protection rights breached you have the right to lodge a complaint to a data protection regulator at locations where we operate. 

13. Changes to the Privacy Statement

Personal privacy is important to Estateguru and we update this Privacy Statement regularly. The version published on our Portal is always the latest version.

14. Cookies

A cookie is a small piece of data or message that is sent from an organisation's web server to your web browser and is then stored on your hard drive. Cookies can't read data off your hard drive or cookie files created by other sites, and do not damage your system.

However, you can reset your browser so as to refuse any cookie or to alert you to when a cookie is being sent. Web browsers allow you to control cookies stored on your hard drive through the web browser settings. To find out more about cookies, including what cookies have been set and how to manage and delete them, visit http://www.allaboutcookies.org.

If you choose not to accept our cookies, some of the features of our site may not work as well as we intend.