Invego Privacy Notice

This privacy notice describes how Invego OÜ, registry code 11790620, address Telliskivi 51a, 10611 Tallinn, e-mail (hereinafter Invego) processes your personal data as a controller, or, together with the real estate developer of the development you are interested in (hereinafter the developer; Invego and the developer jointly hereinafter we), as joint controllers.

Please note that personal data is any information relating to an identified or identifiable natural person (e.g. name, e-mail address, personal identification code), and the processing of personal data is any operation performed on personal data (e.g. modification, viewing, deletion, storage).

Invego processes personal data in accordance with the applicable data protection legislation, including the General Data Protection Regulation of the European Union (GDPR).

Invego processes your personal data as a controller if:

1. You apply for a job at Invego;
2. You are a representative or contact person of a service provider or cooperation partner of Invego;
3. You are an investor of Invego or a representative or contact person of an investor;
4. You visit Invego’s website.

Invego processes your personal data as a joint controller together with the developer if:

1. We send you news and notices about our activities or satisfaction surveys;
2. You register for and attend our events;
3. You contact us.

In addition, in certain cases Invego may also process your personal data as a processor.

1. Which personal data do we process as a controller, for what purposes and for how long?

1.1. You apply for a job at Invego

If you apply for a job at Invego, Invego processes the personal data that you have set out yourself in your application or CV. In addition, Invego collects personal data from the executive search service provider. If you have provided the contact details of referees when applying, Invego also collects information from the referees – we do this only with your prior consent (GDPR Article 6(1)(a)). Invego may also review publicly available information about you (e.g. your LinkedIn profile) that is relevant for assessing your suitability.

Invego processes the personal data of applicants in order to:

• Identify you, contact you and, if you are successful, prepare a contract (first name and surname, contact details such as telephone number, e-mail address, place of residence);
• Assess your suitability (data on education, qualifications and previous experience, data presented in the CV and the motivation letter, data received from the executive search service provider, data collected during interviews, e.g. on skills and qualities, information received from referees, relevant information collected from public sources);
• Manage the application process, collect additional information from you and inform you of decisions (contact details, communication data).

The legal basis for the processing of personal data is Invego’s legitimate interest in finding a suitable person for the position offered, in assessing the suitability of candidates within the application process and in managing the application process (GDPR Article 6(1)(f)). In order to prepare a contract with the successful candidate, Invego processes personal data in order to take the steps necessary towards concluding a contract (GDPR Article 6(1)(b)).

Invego retains the personal data of an applicant for as long as it is necessary for taking and communicating the decision, and for one year after the decision has been communicated. The data of the successful candidate is retained by Invego thereafter in accordance with the rules applicable to employees. If you were not successful but wish Invego to inform you of possible new job opportunities in the future, Invego will retain your personal data for a longer period (in that case Invego will ask for separate consent for retention for that purpose).

1.2. You are a representative or contact person of a service provider or cooperation partner of Invego

If, in your communication with Invego, you represent a company related to you (e.g. you are its employee or representative), Invego processes the personal data that you have submitted yourself or that has been submitted by the company related to you.

Invego processes personal data such as first name and surname, business contact details, professional position and, where necessary, data concerning the right of representation, in order to perform and manage the contractual relationship established with the company related to you and to cooperate with the company (including to contact it).

The legal basis for the processing of personal data is Invego’s legitimate interest in performing and managing the contract concluded with the company related to you or in otherwise cooperating with it (GDPR Article 6(1)(f)).

Invego retains the personal data of representatives or contact persons for the duration of the contractual relationship and for five years after the end of the contractual relationship. If no contractual relationship is entered into, we retain the data of the representative or contact person for up to one year from the last contact.

1.3. You are an investor of Invego or a representative or contact person of an investor

If you have invested in Invego or are in another contractual relationship with Invego as an investor, Invego processes your personal data as a controller. If the investor is a legal person, Invego also processes the personal data of its representative, contact person and beneficial owner.

Invego processes the personal data of the investor and of the representative of an investor that is a legal person in order to:

• Identify you and verify your identity (first name and surname, personal identification code or date of birth, citizenship, place of residence, identity document data and a copy thereof);
• Contact you and organise investor communication (contact details, data concerning the right of representation, professional position, communication data);
• Prepare, conclude and perform the contract related to the investment and pay out returns (contract data, size and terms of the investment, bank and payment details, data on payouts);
• Comply with due diligence obligations arising from the prevention of money laundering and terrorist financing (beneficial owner data, politically exposed person status, data on the origin of funds and assets, results of international sanctions checks);
• Comply with accounting, tax and reporting obligations and maintain lists required by law (payment data, tax residency data, data on holdings or claims).

In the case of an investor who is a natural person, the legal basis for the processing of personal data is the necessity to prepare and perform the contract related to the investment (GDPR Article 6(1)(b)). The legal basis for processing the personal data of the representative and contact person of an investor that is a legal person is Invego’s legitimate interest in performing and managing the contract concluded with the investor and in communicating with the investor (GDPR Article 6(1)(f)). For the application of due diligence measures and for the fulfilment of accounting, tax and reporting obligations, Invego processes personal data in order to comply with a legal obligation (GDPR Article 6(1)(c)).

Providing the personal data necessary for identity verification and for the application of due diligence measures is a precondition for making an investment – without it Invego is not entitled to establish or continue a business relationship. The provision of other data is voluntary.

Invego receives most of the personal data from you or from the company representing you. In addition, Invego may receive data from the commercial register and other public registers and from the databases used for checking politically exposed persons and international sanctions.

Invego may share the personal data of investors and their representatives with notaries, credit institutions, auditors, legal and accounting service providers, the operator of the securities register and supervisory and tax authorities, including the Financial Intelligence Unit and the Estonian Tax and Customs Board, where there is a legal basis for doing so.

Invego retains the personal data of investors and their representatives for the duration of the investment relationship and for three years after the end of the relationship. Data collected in the course of applying due diligence measures and the underlying documents are retained by Invego for five years from the end of the business relationship on the basis of the Money Laundering and Terrorist Financing Prevention Act. Payment-related data is retained by Invego for seven years from the relevant financial year in order to comply with accounting and tax obligations.

1.4. You visit Invego’s website

Invego uses various cookies on its website, through which personal data may also be collected. Strictly necessary cookies, without which the website does not function, do not require your consent under the Electronic Communications Act; the personal data collected through them is processed by Invego on the basis of its legitimate interest in ensuring the security and functioning of the website (GDPR Article 6(1)(f)). All other cookies, including statistics, preference and marketing cookies, are used by Invego only with your prior consent (GDPR Article 6(1)(a)).

More information about cookies can be found in the cookie selection panel displayed when entering Invego’s website and in the cookie notice, which can be opened from the icon located in the bottom right-hand corner of the website. The cookie notice sets out the name, setter, purpose, type and validity period of each cookie. You can withdraw or change the consent you have given at any time, as easily as you gave it. Some cookies are set by third parties (e.g. providers of web analytics and social media platforms), which may involve the transfer of personal data outside the European Economic Area; in such a case Invego applies the safeguards described in this privacy notice.

2. Which personal data do we process as joint controllers, for what purposes and for how long?

In order to provide a higher-quality service, in certain cases Invego processes your personal data together with the developer as joint controllers. In such a case both Invego and the developer process your data in order to achieve the jointly determined purposes described below. For this we have jointly determined the scope, legal bases and duration of the processing of personal data. As joint controllers, both Invego and the developer are responsible for the lawfulness and security of the processing of your personal data. To exercise your rights relating to your personal data, you may contact us at any time by sending an enquiry to the e-mail address given below (see section 8).

2.1. We send you news and notices about our activities or satisfaction surveys

In order to send news and notices (including invitations to events) and satisfaction surveys, we use the personal data that you have disclosed to us if you have previously used the services we offer or shown an interest in them by sending us an enquiry or completing the relevant form.

We process personal data such as first name and surname, e-mail address and the residential district you have been interested in, in order to send you interesting information about our activities and to invite you to our events. We may also use this data to send you satisfaction surveys about our services. We use the feedback to ensure and further develop the quality of our services. We may segment the content of newsletters on the basis of the residential district you have been interested in; this does not constitute automated decision-making within the meaning of Article 22 of the GDPR.

If you are our client, we send you information about our activities and similar products on the basis of our legitimate interest (GDPR Article 6(1)(f)) and under the conditions laid down for direct marketing in the Electronic Communications Act. If you have submitted an enquiry to us or attended our event but are not our client, we send you news, notices and satisfaction surveys only on the basis of your prior consent (GDPR Article 6(1)(a)). We ask for consent separately and in a manner clearly distinguishable from other information, and you may withdraw it at any time as easily as you gave it. You may always refuse to receive news and notices from us already at the time your contact details are initially collected, or opt out of further news and notices in accordance with the instructions given at the end of the e-mail. We retain personal data for the purpose of sending news and notices until you have objected to such use of your contact details; please note, however, that we review and refresh the consents given from time to time.

2.2. You register for and attend our events

If you register for our client days or other public events, we process the personal data that you have submitted to us yourself or that has been submitted by the company related to you.

When you register for and attend events, we process your first name and surname and e-mail address in order to better manage the organisation of the event and to enable you to attend it. In such a case the legal basis for the processing of personal data is our legitimate interest in enabling you to attend the event if you so wish and in ensuring that the event is a success (GDPR Article 6(1)(f)).

Photographs and/or video recordings are sometimes taken at our events. The purpose of this is to keep a nice record of the event and to share information about our activities also outside our companies (e.g. on our social media channels, in the media, on our website). If photographing and/or filming takes place, we inform you of this before the event and on site at the event. You always have the right to refuse to be recorded by indicating this to the person recording the event. In such a case the legal basis is our legitimate interest in obtaining records of the events we organise (GDPR Article 6(1)(f)). In the case of recordings made for the purpose of disclosure at an event taking place in a public place, we additionally rely on § 11 of the Personal Data Protection Act. At closed events, including client days, we rely solely on legitimate interest and ensure that you have a genuine opportunity to refuse to be recorded.

We retain personal data for as long as it is necessary for the purpose of holding and covering the event. If you request the removal of a recording of yourself, we will remove it from the channels we manage without undue delay. Data on registration for and attendance at an event is generally retained for up to one month after the event.

2.3. You contact us

If you contact us (e.g. by e-mail, letter or telephone), we process the personal data that you have submitted to us (first name and surname, contact details, data on the content of the enquiry) in order to respond to your enquiry.

The legal basis for the processing of personal data is our legitimate interest in responding to and/or resolving the enquiry (GDPR Article 6(1)(f)). If your enquiry concerns the conclusion of a contract or the performance of an existing contract, the basis is the preparation or performance of the contract (GDPR Article 6(1)(b)).

We retain personal data for as long as it is necessary for managing and responding to enquiries or for taking the measures required by the enquiry. As a rule, we retain data on the enquiry and the related correspondence for up to three years from the enquiry.

3. Processing of personal data for the protection of Invego’s rights and the fulfilment of legal obligations

In addition to the purposes set out above, Invego may need to process personal data in order to protect Invego’s rights (e.g. in a legal dispute), to comply with obligations arising from law or to resolve a request that you have submitted to Invego as a data subject in order to exercise your rights relating to your personal data.

The legal basis for the processing of personal data is, where there is a need to protect rights, the legitimate interest arising therefrom (GDPR Article 6(1)(f)). Resolving a data subject’s request is mandatory for Invego under the GDPR, and therefore we process personal data for that purpose in order to comply with a legal obligation (GDPR Article 6(1)(c)).

In addition to retaining personal data on the basis of the main purpose of its collection and processing, personal data must sometimes also be retained after that purpose has been fulfilled in order to protect Invego’s rights (in the case of a contractual relationship for 3 years, or 5 years in matters relating to structures, and in the case of a non-contractual relationship for 10 years) or in order to comply with obligations arising from law (in order to comply with accounting and tax obligations, Invego retains payment-related data for 7 years from the relevant financial year). Data relating to the resolution of a data subject’s request is retained by Invego for 10 years from the moment a possible claim arises.

4. When does Invego process personal data as a processor?

If you have purchased or wish to purchase real estate in a development, the controller of your personal data as a client is the respective developer, and Invego processes that personal data on behalf of the developer as a processor, on the basis of a data processing agreement concluded with the developer. In such a case the privacy notice of the respective developer applies, and to exercise your rights you may contact the specific developer – you may also contact Invego, which will forward your enquiry to the developer.

In such a case Invego processes on behalf of the developer, among other things, identification, contact, payment and contract performance data and retains it in accordance with the developer’s instructions for the duration of the contractual relationship and for five years after the end of the contractual relationship or, in the absence of a contractual relationship, for one year from the last communication.

5. Automated decision-making and profiling

Invego does not take decisions in respect of you that are based solely on automated processing and that have a legal or other significant effect on you (Article 22 of the GDPR).

6. With whom does Invego share personal data?

In the course of its activities, Invego may also need to share personal data with third parties who process personal data either as processors on behalf of Invego or as independent controllers. Invego shares personal data with third parties only where there is a legal basis for doing so.

For example, access to personal data in the course of providing their services may be obtained by Invego’s IT service providers, the customer relationship management service provider, the accounting service provider, the executive search service provider, Invego’s auditors, legal service providers, notaries, construction, maintenance and administration partners, partners carrying out warranty works and marketing service providers. Personal data may also be accessed by credit institutions where the financing of a transaction or investment so requires and, in the case of investors, by the operator of the securities register, supervisory authorities and the Estonian Tax and Customs Board.

Invego may also need to grant access to personal data where this is relevant in connection with the restructuring, merger, acquisition, sale or other transaction involving Invego or in connection with the assignment of claims. The legal basis for such sharing is Invego’s legitimate interest (GDPR Article 6(1)(f)).

Some of Invego’s service providers process personal data outside the European Economic Area, mainly in the United States of America (e.g. providers of the customer management system, web analytics and marketing platforms). In such a case Invego relies on the standard contractual clauses established by Commission Implementing Decision (EU) 2021/914, together with the necessary additional safeguards. You can obtain more detailed information about the safeguards applied by writing to .

7. How does Invego protect personal data?

Invego applies appropriate technical and organisational measures to protect personal data: for example, access to personal data is restricted on the basis of job duties, encrypted connections are used when transmitting data, internal rules relating to the processing of personal data have been established, employees are trained in data protection matters, and confidentiality agreements have been concluded with employees and partners.

Should a personal data breach occur, Invego will notify the Data Protection Inspectorate thereof within 72 hours of becoming aware of the breach, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons, and, where the breach entails a high risk to your rights and freedoms, you will also be notified without undue delay (Articles 33–34 of the GDPR).

8. What are your rights in respect of your personal data?

If you have questions about the processing of your personal data or wish to exercise your rights, please contact Invego at the e-mail address . However, please note that your rights in respect of your personal data are not absolute, and therefore Invego may not always be obliged or able to take the measures requested in an application.

When processing personal data on the basis of legitimate interest, Invego has previously carried out a proper balancing of the competing interests, in the course of which it has been assessed whether Invego’s interest in processing the personal data outweighs your interests and the rights and freedoms for the sake of which personal data is protected. You always have the right to object to such processing.

If Invego processes personal data on the basis of your consent, you always have the right to withdraw the consent given. However, please note that the withdrawal of consent does not affect the lawfulness of the processing of personal data that has already taken place on that basis.

In addition, you have the right to:

• Request all personal data that Invego processes about you. To do so, please clarify whether you wish to receive confirmation of what personal data Invego holds about you and/or whether you wish to receive a copy of your personal data.
• Request the rectification of your personal data. Exercising the right to rectification presupposes that the personal data is inaccurate or incomplete. If this is the case, Invego will rectify and/or complete the personal data. To do so, please specify in your request which personal data needs to be rectified.
• Request the erasure of your personal data. Erasure of personal data may be requested where (i) Invego no longer needs the personal data for the purpose for which it was collected; (ii) you wish to withdraw your consent to the processing of personal data and Invego has no other legal basis on which to continue processing it; (iii) you object to the processing of your personal data and Invego has no overriding legitimate grounds for continuing the processing; (iv) Invego has processed the personal data unlawfully; (v) erasure is required in order to comply with a legal obligation. However, if, notwithstanding the above, Invego needs to continue processing the personal data in order to comply with a legal obligation or to protect its rights, it may not be possible to erase the personal data. In any such case we will explain why Invego cannot erase the personal data.
• Request the restriction of the processing of your personal data. This applies where (i) you have drawn Invego’s attention to the fact that the personal data is inaccurate and Invego is verifying its accuracy; (ii) the processing of the personal data is unlawful but you do not wish the data to be erased and request restriction of the processing instead; (iii) Invego no longer needs the personal data for the purposes of the processing, but you and/or the company related to you need it for the establishment, exercise or defence of legal claims; (iv) you have objected to the processing of the personal data and we are verifying whether Invego’s legitimate grounds for processing the personal data override the grounds put forward for ceasing the processing. Even where the processing of personal data is restricted, Invego may process such data where (i) you have given your consent thereto; (ii) Invego needs the data for the establishment, exercise or defence of legal claims; (iii) Invego needs the data for the protection of the rights of a natural or legal person; or (iv) the data needs to be processed in connection with an important public interest.
• Request the portability of your personal data. You may request that your personal data be issued in a structured, commonly used and machine-readable format and transmit that data to another controller (or request that Invego transmit the data), where the processing of the personal data is based on consent or on a contract concluded with Invego and the personal data is processed by automated means.

Invego responds to a request submitted within one month, unless there are circumstances due to which we need more time to respond to the request. In any event, we will inform you of this within one month of the submission of the request.

You also have the right to lodge a complaint with the Data Protection Inspectorate (AKI) if you consider that the processing of personal data has not been carried out in accordance with the applicable data protection legislation and that your rights have been infringed (AKI address Tatari 39, 10134 Tallinn, telephone +372 627 4135, e-mail: ). If your habitual residence, place of work or the place of the infringement is in another Member State, you also have the right to lodge a complaint with the data protection supervisory authority of that country. Nevertheless, in the event of any problems we recommend that you first contact Invego.

9. Amendments to the privacy notice

If Invego needs to amend the terms of this privacy notice, we will always inform you of such amendments via our website https://invego.ee/. Earlier versions of the privacy notice are available on request at .

The privacy notice was last updated: 13.10.2026