1. Who we are
Daru Capital OÜ (“DARU Capital”, “we”, “us”) is the controller of your personal data. We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the Estonian Personal Data Protection Act and other applicable laws.
2. Whose data we process
This policy applies to:
- visitors to our website;
- people who contact us or ask for a proposal;
- representatives, employees, shareholders and beneficial owners of our clients, such as real estate developers and project owners;
- contact persons at banks, lenders, investors, crowdinvesting platforms and other partners.
3. What personal data we collect
- Identification and contact details — name, job title, company, email address and phone number.
- Communication data — the content of enquiries, emails, calls and meeting notes.
- Project and business data — information about real estate projects, companies and financing needs that you share with us, which may include personal data of the people involved.
- Contract and billing data — contract details, invoicing and payment information.
- Technical data — IP address, browser and device information, and how you use our website.
We only collect data that we need for the purposes described in this policy. We do not intentionally collect special categories of personal data, such as health data.
4. Where we get your data
Most of the data we hold comes directly from you. We may also receive data from your company or its representatives, from our partners — for example banks, investors or crowdinvesting platforms — in the course of a project, and from public sources such as commercial and land registers.
5. Why we process your data
We process personal data only when we have a legal basis under the GDPR:
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and preparing proposals | Steps before entering into a contract; our legitimate interest in answering business requests |
| Providing our services — project analysis, financing advisory and crowdinvesting advisory | Performance of a contract |
| Presenting projects to banks, lenders, investors and crowdinvesting platforms | Performance of a contract and our client’s instructions; our legitimate interest |
| Meeting legal obligations, such as accounting and tax requirements | Compliance with a legal obligation |
| Managing business relationships and sending relevant business updates | Our legitimate interest; consent where required by law |
| Operating, securing and improving our website | Our legitimate interest; consent for non-essential cookies |
| Establishing, exercising or defending legal claims | Our legitimate interest |
You can stop receiving business updates at any time by contacting us or using the unsubscribe link in our messages. We do not make decisions about you based solely on automated processing.
6. Who we share your data with
- Banks, lenders, investors and crowdinvesting platforms — when this is needed to provide our services and in line with our client’s instructions.
- Service providers acting on our behalf — such as IT, hosting, email, accounting and legal service providers, who are bound by confidentiality and data processing agreements.
- Public authorities — when we are required to do so by law.
We never sell your personal data.
7. Transfers outside the EEA
We mainly process personal data within the European Union and the European Economic Area (EEA). If data is transferred outside the EEA, we make sure appropriate safeguards are in place, such as a European Commission adequacy decision or Standard Contractual Clauses.
8. How long we keep your data
- Enquiries that do not lead to cooperation — up to 2 years after our last contact.
- Client and contract data — for the duration of our cooperation, and afterwards for as long as needed to protect legal claims: generally up to 3 years and, in some cases, up to 10 years under Estonian law.
- Accounting documents — 7 years, as required by the Estonian Accounting Act.
When data is no longer needed, we delete or anonymise it.
9. Your rights
Under the GDPR, you have the right to:
- access your personal data and receive a copy of it;
- ask us to correct inaccurate or incomplete data;
- ask us to delete your data;
- ask us to restrict how we process your data;
- object to processing based on our legitimate interest, including direct marketing;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting processing that took place before.
To exercise any of these rights, email us at dainis@darucap.com. We will respond within one month.
10. Cookies
Our website uses only the cookies it needs to work. If we introduce analytics or marketing cookies, we will ask for your consent first. You can manage or delete cookies in your browser settings at any time.
11. Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse, and we limit access to the people who need it for their work.
12. Complaints
If you have any concerns about how we handle your data, please contact us first — we will do our best to resolve them. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee, or with the data protection authority in the EU country where you live or work.
13. Changes to this policy
We may update this policy from time to time. The current version is always available on our website, together with the date of the latest update.