Effective date: 27 August 2026
This Privacy Policy explains how Legasset OÜ, registry code 14870443, registered at Harju maakond, Tallinn, Kesklinna linnaosa, Vesivärava tn 50-201, 10152 Tallinn, Estonia (“Legasset”, “we”, “us” or “our”) collects, uses, stores and otherwise processes personal data.
This Privacy Policy applies to personal data processed in connection with our website legasset.com (the “Website”), enquiries and consultation requests, communications with clients, prospective clients and business partners, introductions and potential transactions facilitated by Legasset, legal, corporate, licensing, consulting and other professional services provided by Legasset, and our other legitimate business activities.
For the purposes of Regulation (EU) 2016/679 (the “GDPR”), Legasset OÜ acts as the data controller where it determines the purposes and means of processing personal data.
1. Personal Data We May Collect
Identification and Contact Information
We may process full name, email address, telephone number, residential or business address, nationality, date of birth, job title, company or organisation, professional contact details and other information provided when contacting or communicating with us.
Corporate and Professional Information
Where relevant, we may process information relating to directors, shareholders, ultimate beneficial owners, authorised representatives, employees, professional advisers, business partners and other persons connected with a company or transaction.
Identification, KYC and Compliance Information
Where necessary in connection with our services, legal obligations, compliance procedures or a transaction, we may process identification document details, proof of address, corporate ownership and control information, source-of-funds or source-of-wealth information, sanctions and politically exposed person screening information, information required for KYC, AML or compliance purposes, and other information reasonably necessary to establish identity, authority, ownership or regulatory suitability.
Such information is processed only where appropriate and subject to applicable legal requirements.
Transaction and Service Information
We may process information concerning services requested from or provided by Legasset, potential acquisitions, disposals or other transactions, communications and negotiations, companies, businesses or assets in which you have expressed an interest, contractual arrangements, invoices, payments and transaction history, and documents or information provided in connection with our services.
Communications
We may retain correspondence and communications with you, including communications by email, telephone, messaging applications or other communication channels used in the course of our business.
Website and Technical Information
When you use our Website, certain technical information may be collected automatically, including IP address, browser type and version, device and operating system information, access times, pages visited, referring website or source, and cookie and analytics information where permitted.
When you submit a Website form, we may also record technical and submission metadata associated with the enquiry, such as the relevant Website page or form, IP address and browser or device information.
Further information about cookies is available in our Cookie Policy and through the Website’s Cookie Settings.
2. How We Obtain Personal Data
We may obtain personal data directly from you; from a company, employer, representative or adviser with whom you are associated; from clients, prospective clients, buyers, sellers or transaction counterparties; from professional advisers, agents, introducers and business partners; from corporate registries, regulatory registers and other official sources; from publicly available sources; from compliance, KYC or verification service providers; and through your use of our Website.
Where personal data is not obtained directly from you, we process it in accordance with applicable data protection law and provide information about such processing where required by law
3. Purposes and Legal Bases for Processing
Providing Services and Performing Contracts
We may process personal data where necessary to provide requested services, respond to enquiries, prepare proposals or engagement arrangements, perform contractual obligations, facilitate introductions or communications, administer client relationships, and take steps requested before entering into a contract.
The legal basis is generally performance of a contract or taking steps prior to entering into a contract.
Legitimate Business Interests
We may process personal data where necessary for legitimate interests, including managing and developing our business, communicating with clients and business partners, facilitating legitimate business introductions and transactions, maintaining professional and commercial records, protecting legal and commercial interests, preventing fraud and misuse, maintaining system and Website security, and establishing, exercising or defending legal claims.
Where we rely on legitimate interests, we consider whether those interests are overridden by the rights and freedoms of the relevant individual.
Legal and Regulatory Obligations
We may process personal data where necessary to comply with applicable legal, regulatory, tax, accounting, compliance or other obligations.
Consent
Where required by law, we may process personal data on the basis of consent.
Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
4. KYC, AML and Compliance Processing
Depending on the nature of the services, transaction and applicable legal requirements, Legasset may request or process information for identification, KYC, AML, sanctions screening, compliance or similar purposes.
Such processing may be necessary to:
- comply with legal or regulatory obligations;
- establish or verify identity and authority;
- assess whether Legasset can provide or continue particular services;
- prevent fraud or unlawful activity; or
- pursue legitimate compliance and risk-management purposes.
Where Legasset transmits KYC or compliance information to another party, professional adviser, regulated institution or service provider in connection with a transaction or service, such disclosure will be made only where there is an appropriate legal basis or other lawful justification.
5. Sharing of Personal Data
We do not sell personal data.
We may disclose personal data where reasonably necessary to:
- professional advisers;
- service providers and contractors;
- IT, hosting, website, CRM, email and cloud providers;
- compliance, verification and KYC providers;
- accountants and auditors;
- banks, payment service providers and financial institutions;
- regulators, public authorities, courts or law-enforcement bodies where required;
- prospective transaction counterparties and their advisers where necessary for a legitimate transaction or service; and
- other persons where disclosure is authorised or otherwise permitted or required by law.
Where third parties process personal data on our behalf, we take appropriate steps to ensure that such processing is subject to appropriate data protection obligations.
6. International Transfers
Some service providers, professional advisers, counterparties or other recipients may be located outside the European Economic Area (“EEA”).
Where personal data is transferred outside the EEA, we take appropriate steps to ensure the transfer is made in accordance with applicable data protection law.
Depending on the circumstances, this may include an adequacy decision, applicable Standard Contractual Clauses or another lawful transfer mechanism available under the GDPR.
Information regarding applicable safeguards may be requested using the contact details below.
7. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to satisfy applicable legal, regulatory, accounting, tax, contractual and legitimate business requirements.
The applicable period may depend on:
- the nature of our relationship;
- the type of service or transaction;
- statutory limitation periods;
- legal or regulatory retention requirements;
- the need to establish, exercise or defend legal claims; and
- legitimate compliance and record-keeping requirements.
Where personal data is no longer required, it will be deleted, anonymised or otherwise securely disposed of, subject to applicable legal requirements.
8. Data Security
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access or other unlawful processing.
No electronic transmission or storage system can be guaranteed to be completely secure.
9. Your Data Protection Rights
Subject to applicable law, you may have the right to:
- request access to your personal data;
- request correction of inaccurate personal data;
- request deletion;
- request restriction of processing;
- object to processing based on legitimate interests;
- object to direct marketing;
- exercise data portability where applicable;
- withdraw consent where processing is based on consent; and
- lodge a complaint with a competent supervisory authority.
The applicability of individual rights depends on the circumstances and legal basis.
To exercise your rights, contact us using the details below. We may request information reasonably necessary to verify your identity.
10. Direct Marketing
Where permitted by applicable law, we may use your contact details to communicate information about Legasset services, business opportunities, regulatory developments or other information relevant to your professional relationship with us.
Where consent is legally required, we will obtain it before sending such communications.
You may opt out at any time using an unsubscribe mechanism or by contacting office@legasset.com.
Opting out does not prevent service-related, contractual, administrative or other non-marketing communications.
11. Cookies and Analytics
Our Website uses cookies and similar technologies for essential functionality, preferences and analytics.
Strictly necessary cookies may be used where required for operation of the Website. Non-essential analytics technologies are used subject to applicable consent requirements.
Google Analytics and Google Tag Manager are configured to operate through the Website’s analytics consent mechanism.
You can manage or withdraw your analytics preferences through the persistent Cookie Settings control available on the Website.
Further information, including the current cookie and technology inventory, is available in our Cookie Policy.
12. Automated Decision-Making
Legasset does not currently make decisions producing legal or similarly significant effects concerning individuals solely by automated means.
If this changes, we will provide information required by applicable data protection law.
13. Third-Party Websites and Services
Our Website or communications may contain links to third-party websites or services.
Legasset is not responsible for the privacy practices of independent third parties. We recommend reviewing their privacy policies before providing personal data.
14. Children’s Privacy
Our services are intended for businesses and adults acting in a professional or commercial capacity and are not directed at children.
We do not knowingly seek to collect personal data from children through our Website.
15. Supervisory Authority
You have the right to lodge a complaint with a competent data protection supervisory authority.
As Legasset OÜ is established in Estonia, you may contact the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
You may also have the right to contact the supervisory authority in the EU/EEA Member State of your habitual residence, place of work or place of the alleged infringement, where applicable.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our business activities, legal requirements, technology or data-processing practices.
The current version will be published on our Website together with its effective date.
Where required by law, we will provide additional notice of material changes.
17. Contact Us
For questions concerning this Privacy Policy, the processing of your personal data or exercise of your rights, please contact:
Legasset OÜ
Registry code: 14870443
Harju maakond, Tallinn, Kesklinna linnaosa
Vesivärava tn 50-201
10152 Tallinn, Estonia
Email: office@legasset.com
