Personal data is any information that can directly or indirectly identify a natural person, such as a name, personal identification code, email address, location data, or online identifier. The information regarding the processing of personal data applies to the personal data of natural persons and does not extend to companies, other legal entities, or institutions. However, the information provided in this Privacy Policy also applies to the personal data of all natural persons engaged in professional or occupational activities (e.g. employees, contact persons, managers, representatives of companies). This Privacy Policy explains what personal data we collect, how and why we use it, how long we retain the data, and what rights you have regarding your personal data.
Capital Mill OÜ and its group companies (hereinafter “Capital Mill” or “we”) value your privacy and process personal data responsibly, securely, and in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the laws of the Republic of Estonia, and other applicable legislation. Capital Mill processes the contact details of business clients and cooperation partners based on legitimate interest for the purpose of managing business relationships and providing services. Where the legal basis for processing is legitimate interest, Capital Mill assesses the balance between its interests and the rights and freedoms of the data subject prior to processing. By using the website, you confirm that you have read this Privacy Policy.
Capital Mill may collect the following data voluntarily provided by you:
We also collect anonymized data – information that cannot be directly linked to a specific individual (such as gender, age, language preference, location). We may collect data regarding website usage and user activity on the website. This data is used to provide users with more useful information and to understand which parts of the website are of the greatest interest.
We primarily use the collected data to respond to inquiries, manage client communication, prepare lease relationships, issue invoices, improve website functionality and user experience, and for marketing and statistical analysis purposes.
Where justified, we also process data to comply with legal obligations. The legal basis for processing personal data may be your consent, legitimate interest, legal obligation, or the preparation and performance of a contract between us. In such cases, Capital Mill uses personal data to prepare relevant agreements and, after the conclusion of the agreement, to fulfill contractual obligations or exercise contractual rights. For the preparation of agreements, Capital Mill may perform inquiries in the Land Register, Commercial Register, payment default registers, Official Announcements, or rely on information provided by the contracting party.
Capital Mill’s legitimate interest also includes providing information about the company’s activities to the media. The information shared by Capital Mill is sector-specific, and the processed personal data generally consists of first and last names and professional contact details.
Capital Mill’s website uses cookies and similar technologies to ensure proper website functionality, analyze website usage, improve user experience, and provide marketing content. A cookie is a small text file stored on your device when visiting a website. The retention period of cookies depends on the purpose and settings of the specific cookie. Cookies may include session cookies, which are deleted when the browser is closed, and persistent cookies, which remain stored for a defined period.
We use cookies for:
Cookies may be:
Users may consent to the use of cookies, refuse non-essential cookies, and change their cookie preferences at any time.
We do not sell or disclose your personal data to third parties. Where necessary, we may share data with trusted service providers supporting our IT, website management, marketing, analytics, legal, and financial services, as well as with competent authorities where required by law. Service providers process data only according to our instructions and with appropriate security measures to ensure the confidentiality of personal data.
If any of our cooperation partners are located outside the European Union or the European Economic Area, Capital Mill ensures that the transfer of personal data complies with applicable data protection requirements by using the European Commission’s Standard Contractual Clauses or other safeguards permitted under the GDPR.
Personal data disclosed during website visits and contract conclusion is treated as confidential information. Capital Mill applies all necessary precautions (including administrative, technical, and physical measures) to protect personal data. Capital Mill implements access restrictions, data encryption, secure server solutions, regular security updates, and other appropriate technical and organizational measures. Access to modify and process data is limited to authorized persons only.
We retain personal data only as long as necessary to fulfill the purposes of processing or comply with legal obligations. If the data relates to a contractual or legal relationship, we may retain the data for as long as necessary to establish, exercise, or defend legal claims. Retention periods depend on the type and duration of the contract and, in certain cases, are determined by law (for example, accounting legislation).
As a general rule, we retain:
The controller responsible for personal data processing is Capital Mill OÜ. For questions related to personal data processing, please contact us at legal@capmill.eu or visit our office at Maakri tn 30, Tallinn.
You have the right to receive information about the processing of your personal data, access your data, request correction or deletion of data, restrict data processing, object to processing, or withdraw previously given consent. You also have the right to receive your personal data in a structured, commonly used format and transmit it to another controller where processing is based on consent or a contract and carried out by automated means. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
We will respond to your request concerning personal data where we are the controller responsible for the data specified in the request. Responses are provided in accordance with the GDPR and other applicable legislation. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate if you believe that the processing of your personal data violates applicable requirements.
If you suspect that your personal data has been processed contrary to this Privacy Policy or that there is a risk that your data has been disclosed to unauthorized persons, please notify us immediately. Only in this way can we minimize potential damage. To prevent misuse of client data and rights, requests may only be submitted in a format where the applicant’s identity is verifiable (digitally signed or signed in person at our office). We reserve the right to respond to such requests within 30 days.
Capital Mill OÜ reserves the right to update this Privacy Policy where necessary. We make every effort to ensure that the most recent version of the policy is always published on our website.