Privacy Policy

Version of 16 October 2026.

This Privacy Policy explains what personal data we collect when you use the website gtpartner.org, contact us or order our services. It sets out why we need the data, to whom we disclose it, how long we retain it and what rights you have. This Policy has been prepared in accordance with the EU General Data Protection Regulation 2016/679, hereinafter the GDPR, the Estonian Personal Data Protection Act (isikuandmete kaitse seadus) and the Electronic Communications Act (elektroonilise side seadus).

1. Who is responsible for your data

The controller of your personal data is Digital Invest OÜ, which operates under the GTPartner.ORG brand.

Registry code 12806257, Estonian Commercial Register
VAT number EE101815576
Address: Tuukri 19, 10120 Tallinn, Estonia
E-mail: info@gtpartner.org
Telephone: +372 5661 9999

The company holds licence No. FIU000423 for the provision of trust and company services, issued by the Estonian Financial Intelligence Unit (Rahapesu Andmebüroo). We are therefore required to comply with the Money Laundering and Terrorist Financing Prevention Act (rahapesu ja terrorismi rahastamise tõkestamise seadus). What this means for your data is described in sections 3 and 4.

For any questions concerning personal data, please write to info@gtpartner.org with the subject line “Personal data”.

2. Whose data we process

Website visitors.
Persons who contact us through the website forms, by e-mail, by telephone or via messengers, or who book a call.
Clients who are natural persons, and representatives of clients that are legal entities.
Management board members, shareholders and beneficial owners of the companies we register or service, as well as other persons whose data a client provides to us for the purpose of providing a service.

If you provide us with the personal data of other persons, for example the management board members or shareholders of your company, please make them aware of this Policy.

3. What data we collect and where we obtain it

3.1. Data you provide to us

Enquiries submitted through the website forms: name, e-mail address, telephone number, company name, subject and text of the message, the selected service and its price.
Call bookings via Cal.com: name, e-mail address, selected time and comment.
Correspondence by e-mail, by telephone and via WhatsApp, Telegram or Viber: your contact details and the content of the messages.
Data required for the provision of services: first name and surname, date of birth, personal identification code, citizenship, residential address, the details and a copy of an identity document, contact details and tax residency. This also includes information about the company, its shareholders, management board members and beneficial owners, the company’s activities, the source of funds and source of wealth, politically exposed person status, as well as the documents required for a particular service.
Payment data: bank details and information on accounts and payments. When you pay by card, the card details are entered on the page of the payment service provider Stripe. We do not see or store them.

3.2. Data collected automatically

Technical data relating to your visit: IP address, browser and device type, language, the address of the page opened and of the referring page, and the date and time of the request. These data are logged by the website server and by Cloudflare.
When a form is submitted, we store the IP address, browser data and time of submission. This helps us protect against spam and abuse.
Cookies and similar technologies — see section 6 for details.
Visit statistics via Google Analytics — only with your consent.

3.3. Data from other sources

Public registers, including the Estonian Commercial Register and the registers of other countries.
Sanctions lists and databases of politically exposed persons. We are required by law to check them.
The client or its representative, where they provide us with the data of management board members, shareholders or beneficial owners.
Public authorities, notaries and banks — to the extent necessary for the service or provided for by law.
Mail received at your company’s legal address or addressed to its contact person, if you use these services.

We are required by law to obtain certain data. If you do not provide the data required under the Money Laundering and Terrorist Financing Prevention Act, we must refuse to provide the service or terminate the business relationship.

4. Purposes and legal bases of processing

Purpose	Data	Legal basis
To answer a question, provide a consultation or prepare an offer	Contact details, text of the enquiry	Taking steps at your request prior to entering into a contract, Art. 6(1)(b) GDPR. If you write on behalf of a company — our legitimate interest in responding to business enquiries, Art. 6(1)(f) GDPR
To conclude and perform a contract: company registration, legal address, contact person, accounting, VAT registration, document handling and other services	Data of the client and of persons connected with the company, documents	Performance of a contract, Art. 6(1)(b) GDPR. Where requirements for the service are laid down by law, for example the obligations of a contact person under the Commercial Code — compliance with a legal obligation, Art. 6(1)(c) GDPR
To carry out client due diligence under anti-money laundering legislation. This includes identification, establishing the beneficial owner, checking politically exposed person status and sanctions lists, monitoring the business relationship, retaining data and reporting to the Financial Intelligence Unit	Identity data, copies of documents, information on the company and on the source of funds and source of wealth	Legal obligation, Art. 6(1)(c) GDPR, under the Money Laundering and Terrorist Financing Prevention Act and the International Sanctions Act
To keep accounting records and fulfil tax obligations	Client data, invoices, payments	Legal obligation, Art. 6(1)(c) GDPR, under the Accounting Act and tax legislation
To accept payments	Amount, payment reference, e-mail address, payment details	Performance of a contract, Art. 6(1)(b) GDPR
To ensure the operation and security of the website, protect forms against spam by means of reCAPTCHA and keep server logs	Technical data	Legitimate interest in a functioning and secure website, Art. 6(1)(f) GDPR
To collect visit statistics via Google Analytics	Technical data, cookies	Your consent, Art. 6(1)(a) GDPR
To inform clients about similar services and important changes in legislation	Name, e-mail address	Legitimate interest, Art. 6(1)(f) GDPR, and the Electronic Communications Act. You may opt out of such e-mails at any time
To protect our rights and to handle claims and disputes	Data relevant to the matter	Legitimate interest, Art. 6(1)(f) GDPR

We process data relating to criminal convictions and sanctions only to the extent provided for by law, as required by Art. 10 GDPR.

5. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you. Decisions on the provision of services are always taken by a member of staff.

6. Cookies and similar technologies

Cookies are small files that a website stores in your browser. The browser’s local storage works in a similar way. Without your consent, we use only what is necessary for the operation and security of the website. Google Analytics is loaded and sets its cookies only after you click “Accept” in the cookie consent window on your first visit. You can change your choice at any time via the “Cookie settings” link at the bottom of every page. You can also delete or block cookies in your browser settings, but some functions of the website may then not work properly.

Name	Set by and purpose	Retention period	Consent
gtp_consent	Website: remembers your cookie choice	12 months	Not required
qtrans_front_language	Website: remembers the selected language	1 year	Not required
selectedLang, local storage	Website: remembers the language chosen in the language switcher	Until you clear your browser storage	Not required
pop-up-form	Website: stops showing the pop-up window once a form has been submitted	1 hour	Not required
PHPSESSID	Website: enables the payment page to function	Until the browser is closed	Not required
wordpress_, wp-settings-	Website: staff login to the administration panel. Not set for visitors	Up to 14 days, settings — up to 1 year	Not required
_GRECAPTCHA	Google reCAPTCHA: distinguishes humans from bots and protects forms. Loaded only when you start filling in a form	Up to 6 months	Not required
__cf_bm, cf_clearance	Cloudflare: protects the website against bots and attacks. Set only when a check is performed	From 30 minutes to 1 year	Not required
Chaty keys, local storage	Messenger contact button: remembers the state of the widget	Until you clear your browser storage	Not required
Cal.com cookies	Cal.com: operation of the call booking widget	In accordance with the rules of Cal.com	Not required
_ga, _ga_ZZW2XJ8RQ3	Google Analytics: statistics on visits and enquiries	Up to 2 years	Required

7. Recipients of personal data

We do not sell personal data or disclose it for third-party advertising. Data is disclosed only to those without whom we cannot provide the service or comply with legal requirements.

7.1. Service providers processing data on our behalf

Service provider	Service	Place of processing
Hosting provider	Website server and databases	Estonia
Cloudflare, Inc.	Delivery of website pages, protection against attacks, caching	Global network, including the USA
Zoho Corporation B.V.	Corporate e-mail	EU
Google Ireland Limited, Google LLC	Google Analytics, reCAPTCHA, Google Apps Script for a separate feedback form, and the Gmail e-mail service as a backup channel for forwarding enquiries when our main system is unavailable	EU and USA
Optimole	Optimisation and delivery of website images. Receives the IP address and technical browser data	Global content delivery network
Cal.com, Inc.	Call bookings	USA

7.2. Other recipients

Stripe Payments Europe, Limited, Ireland — processing of card payments. Stripe is itself responsible for certain processing, for example fraud prevention, in accordance with its own privacy policy.
WhatsApp, Telegram and Viber — if you write to us via these messengers, their operators process the data under their own rules.
Public authorities and registers — the Centre of Registers and Information Systems, which maintains the Commercial Register, the Tax and Customs Board, the Financial Intelligence Unit, the police, the courts and other authorities. Data is disclosed where required for the service or by law.
Notaries, sworn translators, banks and payment institutions, auditors and lawyers — to the extent necessary for the service or on your instructions.
A purchaser or legal successor of our business — if the company is reorganised or sold.

We are required to report suspicious transactions to the Financial Intelligence Unit. The law prohibits us from informing the client of such a report.

8. Transfers of data outside the EEA

Some of our service providers are located in the USA or use servers outside the European Economic Area, namely Google, Cloudflare, Cal.com and Stripe. We transfer data to them only where safeguards under Chapter V GDPR are in place. Such a safeguard is an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for certified companies, or the standard contractual clauses approved by the European Commission. A copy of the safeguards applied may be requested at info@gtpartner.org.

9. How long we retain data

Data	Retention period
Enquiries and correspondence that did not result in a contract	Up to 3 years after the last contact
The contract, related correspondence and service documents	The term of the contract and 7 years after its termination
Client due diligence data under anti-money laundering legislation	5 years after the end of the business relationship. Longer only by order of a competent authority and within the period laid down by law
Accounting documents: invoices, payment information	7 years from the end of the financial year in which the transaction took place
Technical data of form submissions	Up to 1 year
Server logs	Up to 6 weeks
Website backups	Up to 12 months, after which they are deleted
Google Analytics statistics	No more than 14 months
E-mail address of a person who has opted out of our e-mails	For as long as necessary to ensure that we do not write to that person again

When the retention period expires, we delete the data or anonymise it so that the individual can no longer be identified.

10. How we protect data

Only staff members who need access to data for their work have such access. Staff members are bound by confidentiality obligations.
Access rights are segregated, and the website administration panel is accessible only from a restricted network.
The website transmits data over the secure HTTPS protocol.
We make regular backups and choose service providers that guarantee the protection of data.

In the event of a personal data breach that poses a risk to your rights, we will notify the Data Protection Inspectorate within 72 hours. If the risk is high, we will also inform you without undue delay.

11. Your rights

To find out what data about you we process and to obtain a copy of it.
To have inaccurate or incomplete data rectified.
To request the erasure of data where there are no longer any grounds for retaining it.
To restrict processing, for example while the accuracy of the data is being verified.
To receive the data you have provided to us in a machine-readable format and to transmit it to another controller.
To object to processing based on our legitimate interest. You may object to e-mails about our services at any time without giving reasons.
To withdraw your consent at any time. Processing carried out before the withdrawal remains lawful.

Some rights are restricted by law. We cannot erase data that we are required to retain, for example client due diligence data for 5 years or accounting documents for 7 years. The Money Laundering and Terrorist Financing Prevention Act may also restrict the right of access to data, for example to information on reports made to the Financial Intelligence Unit.

To exercise your rights, please write to info@gtpartner.org. We may ask you to confirm your identity so that data is not disclosed to an unauthorised person. We will respond within one month. If a request is complex or there are numerous requests, this period may be extended by a further two months, in which case we will inform you. Requests are handled free of charge.

If you believe that we are infringing your rights, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee. You may also lodge a complaint with the supervisory authority of the EU Member State in which you live or work, or bring an action before a court. We would appreciate it if you contacted us first, and we will endeavour to resolve the matter promptly.

12. Minors

Our services are intended for adults. We process the data of minors, for example shareholders of a company, only on the instructions or with the consent of their legal representatives.

13. Links to other websites

The website contains links to third-party resources, for example the e-Residency portal, public registers, Wise, LinkedIn, Facebook and Trustpilot. Their owners process data under their own rules, and we are not responsible for them.

14. Changes to this Policy

We update this Policy when our services, the services we use or the legislation change. The new version is published on this page with the date at the top. We will notify clients by e-mail of material changes that affect them.