This Privacy Policy explains which personal data Reinvest24 OÜ processes about the users of the Website, for what purposes and on what legal basis, to whom the data is disclosed and what rights the users have. Since November 2023 Reinvest24 does not publish new projects and does not accept new investments. The Website is in a wind-down phase, and personal data is processed mainly to administer the existing loans and to pay the recovered money to investors.

1. DATA CONTROLLER

The controller of the personal data is Reinvest24 OÜ, registry code 14383364, Vesivärava 50, 10159 Tallinn, Estonia (“we”). Questions and requests about personal data can be sent to support [at] reinvest24 [dot] com.

2. PERSONAL DATA WE PROCESS

• identification and contact data: name, date of birth, personal identity code, address, country of residence and tax residency, email address, telephone number, communication language;
• data collected for anti-money laundering and counter-terrorist financing purposes: copies of identity documents, information on the source of funds, information on politically exposed persons and sanctions checks;
• account data: login data, registration date, data on the use of the user account, IP address;
• financial data: bank account details, the balance of the account, investments, loan agreements, payments and payouts;
• communication with us: emails, complaints, requests and other messages;
• for users who are legal persons: data on their representatives and beneficial owners;
• data received from third persons where this is permitted by law, for example from public registers, courts, bailiffs, notaries and the identity verification provider.

3. PURPOSES AND LEGAL BASES

• providing the user account and performing the Terms of Service and the loan agreements, including payments and payouts – performance of a contract (Article 6(1)(b) of the General Data Protection Regulation (GDPR));
• identifying users and assignees of claims and carrying out checks required by anti-money laundering and counter-terrorist financing rules – compliance with a legal obligation (Article 6(1)(c) GDPR);
• accounting and tax obligations – compliance with a legal obligation (Article 6(1)(c) GDPR);
• administering the existing loans during the wind-down: recovery of claims, enforcement of collateral, sale of claims and distribution of the recovered amounts – performance of a contract and our legitimate interest and the legitimate interest of the investors in recovering the claims (Article 6(1)(b) and (f) GDPR);
• handling complaints, questions and requests – performance of a contract and our legitimate interest (Article 6(1)(b) and (f) GDPR);
• establishing, exercising and defending legal claims and responding to requests of courts and public authorities – compliance with a legal obligation and our legitimate interest (Article 6(1)(c) and (f) GDPR);
• security of the Website and the user accounts – our legitimate interest (Article 6(1)(f) GDPR).

Where we ask for consent for a specific purpose, the user can withdraw the consent at any time. Withdrawal does not affect processing carried out before it, or processing based on another legal basis.

We do not use personal data for marketing and we do not make decisions based solely on automated processing that produce legal effects for the users.

4. RECIPIENTS OF PERSONAL DATA

We disclose personal data only to the extent necessary for the purposes described above, to the following recipients:

• the Collateral Agent and other parties to the relevant loan agreements, as provided for in the Terms of Service;
• bailiffs, notaries, courts, insolvency administrators and other persons taking part in the recovery or enforcement of claims;
• acquirers of claims sold under the Terms of Service and their advisers, to the extent necessary for the sale and the transfer of the claims;
• lawyers, auditors, accounting service providers and other advisers bound by confidentiality;
• the identity verification provider and other service providers who process data on our behalf (for example hosting and email services);
• banks and payment service providers, when payments or payouts are made;
• public authorities where we are required to disclose data by law, including the Financial Supervision Authority (Finantsinspektsioon), the Financial Intelligence Unit (Rahapesu Andmebüroo), the Tax and Customs Board and law enforcement authorities.

We conclude data processing agreements with the service providers who process personal data on our behalf.

5. STORAGE AND TRANSFERS OUTSIDE THE EEA

Personal data is stored in data centres located in the European Union. Users who log in with their Google or Facebook account use the login services of these providers, which may transfer data outside the European Economic Area. Such transfers are based on the EU–US Data Privacy Framework or on standard contractual clauses approved by the European Commission, as described in the privacy policies of these providers.

6. RETENTION PERIODS

• data collected for anti-money laundering purposes is kept for 5 years after the end of the business relationship;
• accounting documents, including data on payments and payouts, are kept for 7 years from the end of the financial year in which they were recorded;
• data on the user account, investments and loan agreements is kept until the loans have been closed, the recovered amounts have been distributed and the limitation periods for the related claims have expired;
• communication, including complaints, is kept for as long as the matter it concerns is kept.

After the retention period ends, the data is deleted or anonymised.

7. RIGHTS OF THE USERS

The user has the right to:

• get access to their personal data and information about its processing;
• have inaccurate data corrected;
• have the data deleted, unless we must keep it under law or need it to establish, exercise or defend legal claims;
• restrict the processing of the data in the cases provided for in the GDPR;
• receive the data they have given us in a structured, commonly used format (data portability);
• object to processing based on our legitimate interest;
• withdraw their consent, where processing is based on consent.

Requests can be sent to support [at] reinvest24 [dot] com. We may ask the user to confirm their identity before answering. We reply within one month of receiving the request. If the request is complex or we receive many requests, this period may be extended by up to two months, and we inform the user of the extension and the reasons for it.

The user must keep their personal data in the user account up to date, in particular the email address, because we use it to send notices under the Terms of Service.

8. COOKIES

The Website uses cookies that are necessary for it to work: a cookie that keeps the user logged in, a cookie that stores the language of the Website and a cookie that remembers that the cookie notice was closed. If the user arrives on the Website through a referral or partner link, a cookie stores the referral code for a limited period.

The Website uses Google Tag Manager, which may load tools of third-party providers that set their own cookies. The Google and Facebook login components used on the Website may process technical data, such as the IP address, and set their own cookies under the privacy policies of these providers.

9. SECURITY

We use technical and organisational measures to protect personal data against unauthorised access, loss, disclosure and destruction. Access to personal data is given only to persons who need it for their work and who are bound by confidentiality.

10. COMPLAINTS

If the user believes that their personal data is processed in breach of the law, they can contact us at support [at] reinvest24 [dot] com. The user also has the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

11. CHANGES

We may update this Privacy Policy. The current version is always published on the Website.