1 General provisions
This Privacy Policy explains how Regulated United Europe OÜ collects, uses, shares and protects personal data when you visit rue.ee, contact us or use our services. It also explains your rights and how to contact us about your data.
Personal data are processed in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), applicable Estonian data protection legislation and other relevant legal requirements.
Personal data means information relating to an identified or identifiable individual. This may include contact details, information in documents and correspondence, IP addresses and other online identifiers.
This Policy is a privacy notice, not a request for consent. Visiting our website, submitting an enquiry or acknowledging this Policy does not give us unrestricted permission to use your data. Where a particular activity requires consent, we request it separately.
2 Who is responsible for your data
The controller responsible for the website processing described in this Policy is Regulated United Europe OÜ.
Registration number: 14153440
Address: Tartu mnt 83, 10115 Tallinn, Estonia
Email: info@rue.ee
Telephone: +372 56 966 260
In this Policy, Regulated United Europe OÜ is also referred to as RUE, we or the Company.
RUE is a brand used in connection with services provided by different legal entities. Your service agreement identifies the entity responsible for your engagement. This Policy covers processing for which Regulated United Europe OÜ is responsible; it does not automatically make other entities joint controllers.
Where another entity is responsible for processing your data, information about that entity and its role is provided in the relevant privacy notice or service documentation. You can send privacy enquiries and requests to info@rue.ee.
3 Categories of personal data
The data processed depend on your enquiry, the website functions used and the services requested.
Contact and enquiry information: your name, email address, telephone number, organisation, position, enquiry and related correspondence.
Service information: information about clients, representatives, directors, shareholders and beneficial owners, together with personal data contained in documents supplied for the engagement. The information requested depends on the assignment and applicable requirements.
Contract and payment information: details necessary to enter into and perform agreements, issue invoices, record payments and settle accounts.
Feedback and complaints: the content of an enquiry, information about the relevant service or consultant, supporting documents and details needed to respond.
Technical information: IP addresses, browser and device information, server logs, pages visited and cookie identifiers, depending on the technologies actually used and your consent choices.
We request only information needed for the relevant purpose. Please do not submit unnecessary documents or unrelated sensitive information through the general enquiry form.
Please do not send health information, other special category data or information about criminal convictions unless it is relevant to your matter and we have agreed an appropriate way to receive it. Processing such information requires the additional conditions prescribed by applicable law.
4 Sources of personal data
We primarily receive data from you through website forms, email, correspondence and documents supplied during our engagement.
Depending on the service, data may also be obtained from authorised representatives, official registers, public authorities and other lawful sources. Public availability does not remove data protection requirements. Technical data may be collected automatically when you use the website.
Where data are obtained indirectly, we provide the information required by the GDPR, including the relevant categories and sources, unless a lawful exemption applies.
If you share personal data about someone else, you must be entitled to do so and should make this Policy available to them where appropriate. RUE remains responsible for its own obligations concerning that information.
5 Purposes and legal bases
Handling enquiries and preparing proposals. We use data to answer questions, assess requests and discuss potential cooperation. Where an individual enquires about a contract to which they would be a party, processing may be necessary to take steps at their request before entering into that contract, under Article 6(1)(b) GDPR. Communications with representatives of organisations may rely on our legitimate interest in conducting business communications under Article 6(1)(f).
Entering into and performing agreements. Data about an individual contracting party are processed where necessary to perform the agreement under Article 6(1)(b). Data about corporate client representatives may be processed on the basis of our legitimate interest in arranging and performing business relationships under Article 6(1)(f).
Compliance with legal obligations. Processing may be necessary under Article 6(1)(c) for applicable accounting, tax, client identification or anti-money laundering obligations, where those obligations apply to the relevant provider and service.
Feedback, complaints and legal claims. Processing may rely on our legitimate interests in service quality, dispute resolution and establishing, exercising or defending legal claims under Article 6(1)(f), or on an applicable legal obligation under Article 6(1)(c).
Website operation and security. Necessary technical processing may rely on our legitimate interest in keeping the website available, preventing misuse and protecting information systems under Article 6(1)(f), subject to any separate consent requirements for device access or tracking.
Analytics and marketing. Where consent is required, we rely on Article 6(1)(a). Other legally permitted processing requires an appropriate basis and compliance with the specific rules on electronic communications and cookies.
When relying on legitimate interests, we assess necessity and the impact on individuals’ rights and freedoms. Where information is legally or contractually required, or necessary to enter into an agreement, we explain this when requesting it. Failure to provide necessary information may prevent the relevant service from being supplied.
6 Marketing communications
Submitting an enquiry or signing an agreement does not automatically give consent to advertising messages.
Where consent is required, we obtain it before sending marketing messages. Where applicable law permits us to contact existing customers about our own similar services without new consent, we do so only if the relevant conditions are satisfied, including offering an easy, free opt-out when contact details are collected and in each message.
You can object to direct marketing at any time, using the unsubscribe mechanism in a message or contacting info@rue.ee. Processing for direct marketing stops after an objection.
Opting out does not prevent communications necessary to perform an agreement, respond to an enquiry or comply with a legal obligation.
7 Cookies and similar technologies
We use cookies and similar technologies to support website functions and preferences. Analytics and marketing technologies are subject to the applicable consent requirements. Consent cannot be inferred merely from visiting the website or enabling cookies or JavaScript in your browser.
Our Cookie Policy at https://rue.ee/cookies-policy/ provides further information about these technologies. You can also contact info@rue.ee about your choices or to withdraw consent. Withdrawing consent must be as easy as giving it. Browser settings can help you manage stored cookies, but do not replace the consent required before non-essential technologies are used.
Technical identifiers may be personal data even where your name is not recorded. Pseudonymised data are not the same as data that have been irreversibly anonymised.
8 Recipients of personal data
Data may be disclosed only where there is a lawful basis and to the extent necessary for the relevant purpose. Depending on the engagement and processing involved, recipient categories may include:
- Staff and specialists who need access to perform their duties.
- The entity providing the agreed service and professional advisers engaged for the matter.
- Technical and organisational service providers supporting the website, information systems and communications.
- Banks and payment organisations where necessary for payments or the agreed service.
- Registration bodies, supervisory and other competent authorities, notaries, courts and other participants in the relevant procedure.
Service providers acting on our instructions are subject to appropriate contractual obligations, including confidentiality and data protection requirements. Recipients acting as independent controllers are responsible for their own processing. RUE remains responsible for its own disclosures and other GDPR obligations. We do not sell or rent your personal data.
Submitting feedback for internal review does not authorise publication of your name, photograph, project details or other identifying information. Publication requires a separate lawful basis; where consent is relied upon, it is requested separately.
9 Transfers outside the European Economic Area
Some services or engagements may involve recipients outside the European Economic Area (EEA). Where we transfer personal data outside the EEA, we apply the requirements of Chapter V GDPR.
The applicable protection may be an adequacy decision issued by the European Commission or appropriate safeguards, such as standard contractual clauses, supported by the required assessment and additional measures where necessary.
Exceptions under Article 49 GDPR are used only where their specific requirements are met. Signing a service agreement or giving general consent does not, by itself, authorise every international transfer.
To ask whether a transfer is relevant to your data, which safeguards apply and how to obtain a copy, contact info@rue.ee.
10 Retention of personal data
We retain personal data only for as long as necessary for the purposes of processing, taking account of applicable legal obligations. The relevant criteria include:
- Enquiries and proposals: for the time needed to respond, assess your requirements and complete related discussions. If an enquiry leads to an engagement, relevant information becomes part of the client file.
- Client files and payments: throughout the engagement and completion of outstanding work and accounts, and thereafter where required by law or justified for establishing, exercising or defending legal claims.
- Accounting, tax and client verification records: for the statutory period applicable to the relevant records and services. The applicable period depends on the obligation and the entity responsible for processing.
- Complaints and disputes: until the matter is resolved and for any further period justified by applicable limitation periods, proceedings or the need to preserve evidence.
- Marketing: while the relevant lawful basis and purpose continue. Following an opt-out, we may retain the minimum information needed to respect your preference and document compliance.
- Technical records: for the period justified by their operational or security purpose. Cookie lifetimes depend on the technology concerned; see our Cookie Policy.
Termination of an agreement or withdrawal of consent does not necessarily require immediate deletion of all data. Some records may need to be retained for a separate lawful purpose. Withdrawal does not permit retrospective substitution of another basis for the same processing.
We review whether continued retention is justified. When it is no longer needed, data are deleted or anonymised so that individuals cannot be identified by means reasonably likely to be used. You may contact info@rue.ee for information about the retention period applicable to your data.
11 Security
We apply technical and organisational safeguards appropriate to the nature of the processing and the associated risks. These measures are intended to prevent unauthorised access, unlawful disclosure, alteration, loss or destruction.
Access is limited to what is necessary for the relevant tasks. Confidentiality and security requirements are considered when engaging providers. If a personal data breach occurs, we assess its consequences and fulfil applicable duties to notify the supervisory authority and affected individuals.
12 Your rights
Subject to the conditions and exceptions in the GDPR, you may:
- Obtain access to your personal data and information about their processing.
- Request correction of inaccurate data or completion of incomplete data.
- Request erasure or restriction of processing.
- Object to processing based on legitimate interests on grounds relating to your particular situation.
- Object to direct marketing at any time.
- Receive relevant data in a structured, commonly used and machine-readable format and transmit them to another controller where the right to portability applies.
- Withdraw consent where processing is based on it.
- Exercise your rights concerning solely automated decisions, including profiling, that have legal or similarly significant effects on you. Where Article 22 GDPR applies, the relevant restrictions, exceptions and safeguards apply, including human intervention and the ability to contest a decision where required.
These rights are not absolute. For example, a legal duty to retain records may limit immediate erasure. Withdrawal of consent does not affect processing lawfully carried out before withdrawal.
13 Requests and complaints
To exercise your rights, email info@rue.ee and explain what you would like us to do. Provide enough information for us to identify the records concerned. If there are reasonable doubts about your identity, we may ask for additional information necessary to confirm it.
We respond without undue delay and normally within one month of receiving a request. Where necessary because of complexity or the number of requests, this may be extended by two further months. We will inform you of the extension and its reasons within the first month.
Requests are generally handled free of charge. A reasonable fee or refusal may be permitted for manifestly unfounded or excessive requests, subject to the GDPR conditions.
You may lodge a complaint with a competent data protection authority, in particular in the country of your habitual residence, place of work or the alleged infringement. In Estonia, the authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): https://www.aki.ee/. You do not have to contact RUE before exercising this right.
14 Third party websites
The website may link to external resources. Their processing is governed by their own privacy information. This does not exclude RUE’s responsibility for processing or disclosures carried out by RUE itself.
15 Changes to this Policy
We may update this Policy to reflect changes in our services, processing arrangements or legal requirements. The current version is available at https://rue.ee/privacy-policy/. We communicate material changes separately where required by law.
Updating the Policy does not itself establish a new legal basis. Where a new purpose requires consent, that consent will be requested separately.
