Invego Privacy Notice

In this Privacy Notice, we describe how Invego OÜ,registry code 11790620 (hereinafter Invego), as a data controller processes your personal data. You should know that personal data is any information relating to an identified or identifiable natural person (e.g. name, e-mail address, personal identification code) and that the processing of personal data is any activity (e.g. alteration, viewing, erasure, storage) which is performed upon personal data.

Invego processes personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).

This Privacy Notice applies to you if:

1. You apply to work for us
2. You would like to receive an offer for our services
3. You are a private client of ours
4. You are a representative or contact person of our service provider, cooperation partner, or client
5. We send you news and notifications about our activities or satisfaction surveys
6. You register for and participate in our events
7. You contact us
8. You visit our website
9. You are connected with us through any of the above situations

1. What personal data do we process, for what purposes, and for how long?

1.1. You apply to work for us

If you apply to work for Invego, we will process the personal data that you have provided in your application or CV. In addition, we collect personal data from the targeted search service provider and from public sources (e.g. LinkedIn profile information). We may also contact your nominated referees to collect further information.

We process the personal data of applicants to:

• Identify you, contact you and, in the case of successful selection, prepare the contract (first name and surname, contact details such as telephone number, e-mail address, and address);
• Assess your suitability (information about education, qualifications, and previous experience, details provided in the CV, information provided in the motivation letter, details submitted in the questionnaire of the targeted search service provider, data collected during interviews, e.g. about skills and qualities, information gathered from public sources);
• Manage the application process, collect additional information from you, and inform you of decisions (contact details, communication information).

The legal basis for processing personal data is our legitimate interest in finding a suitable candidate for the offered position, assessing candidates’ suitability as part of the application process, and managing the application process (GDPR Article 6(1)(f)). To prepare a contract with the successful candidate, we process personal data to take the necessary steps towards entering into a contract (GDPR Article 6(1)(b)).

We store the personal data of applicants for as long as necessary to make a decision and inform about the decision, and for one year following the notification of the decision. The data of the successful candidate will be stored further in accordance with the rules applicable to employees. If you are not successful but wish to be notified of potential future application opportunities, we will store your personal data for a longer period (in such cases, we will request your separate consent for storage for this purpose).

1.2. You would like to receive an offer for our services

If you request an offer for a service from Invego and, for that purpose, you have made an inquiry to us through our website or by contacting our sales consultants, we will process the personal data that you have provided to us in the inquiry and in the communication related to the offer.

We process personal data to:

• Identify you (first name and surname);
• Contact you (contact details, such as telephone number, e-mail address);
• Make you a suitable offer (information about the product of interest and preferences – e.g. number of rooms, price, size, interior design preference).

The legal basis for processing personal data is the necessity to make you an offer, at your request, for the preparation and entry into a contract (GDPR Article 6(1)(b)).

We store personal data for as long as necessary to make the offer and enter into a contract. If we enter into a contract, we will retain personal data further in accordance with the rules applicable to the processing of clients’ personal data. If no contract is entered into as a result of the inquiry, we may continue processing your personal data in accordance with the rules applicable to the processing of personal data for the purpose of sending news and notifications.

1.3. You are a private client of ours

If you are a private client of Invego, we will process personal data that you have provided to us before entering into a contract to make an offer or that we have received from you in the framework of the client relationship in connection with the contracts entered into with you or in connection with the provision of a service to you.

We process personal data to:

• Identify you (first name and surname, personal identification code, or date of birth);
• Contact you (contact details, such as telephone number, e-mail address);
• Provide you with the service, perform the contract entered into, and manage the contractual relationship (data related to services and the object of the contract, payment details, information regarding contract performance, and communication data).

The legal basis for processing personal data is the necessity to prepare and perform the contract to be entered into with you (GDPR Article 6(1)(b)) and our legitimate interest in managing the contractual relationship and organising the provision of services (GDPR Article 6(1)(f)). Additionally, the necessity to fulfil our accounting and tax obligations (GDPR Article 6(1)(c)).

We store clients’ personal data for the duration of the contractual relationship and for five years after the termination of the contractual relationship.

1.4. You are a representative or contact person of our service provider, cooperation partner, or client

If you represent a company related to you in communication with Invego (e.g. you are an employee or representative of the company), we will process your personal data that you have provided to us yourself or that has been provided by the company related to you.

We process personal data, such as first name and surname, professional contact details, job position, and, if necessary, data related to the right of representation to perform and manage the contractual relationship established with the company related to you and to cooperate with the company (including making contact).

The legal basis for processing personal data is the necessity to perform or manage the contract entered into with the company or to cooperate in other ways (GDPR Article 6(1)(f)).

We store personal data of representatives or contact persons for the duration of the contractual relationship and for five years after the termination of the contractual relationship.

1.5. We send you news and notifications about our activities or satisfaction surveys

For sending news and notifications (including invitations to Invego’s events) and satisfaction surveys we use your personal data which you have disclosed to us when you have previously used our services or expressed interest in them by sending us an inquiry or filling out a relevant form at our event.

We process personal data, such as your first name and surname, e-mail address, and the residential area you are interested in to send you exciting information about Invego’s activities and invite you to our events. We may also use those data to send you satisfaction surveys about our services. We use feedback to ensure the quality of our services and to develop them further.

The legal basis for the processing of personal data is our legitimate interest (GDPR Article 6(1)(f)), subject to the restrictions applicable to direct marketing by electronic means. You can always opt-out of receiving news and notifications from us at the time of the initial collection of contact information or opt-out of receiving further news and notifications in accordance with the instructions at the end of the e-mail.

We store personal data for the purpose of sending you news and notifications until you have opted out of such use of your contact details.

1.6. You register and participate in our events

When you register for our client days or other public events, we will process personal data about you that you have provided to us yourself or that has been provided by a company related to you.

When registering for and attending events, we will process your first name, surname, and e-mail address to better manage the event organisation and enable you to participate in the event.

The legal basis for processing personal data in this case is our legitimate interest in enabling you to participate in the event, should you wish to do so, and ensuring the successful organisation of the event (GDPR Article 6(1)(f)).

Invego’s events sometimes include photography and/or filming. The purpose is to create a pleasant record of the event for us and to share information about our activities beyond Invego (e.g. on our social media channels, in the media, and on our website). If photography or filming takes place, we will inform you before the event and at the event. You always have the right to refuse being recorded by informing the person recording the event. The legal basis in this case is our legitimate interest in obtaining recordings of events we organise (GDPR Article 6(1)(f)) or § 11 of the Personal Data Protection Act (PDPA)).

We store personal data for as long as it is necessary for the purposes of conducting and documenting the event.

1.7. You contact us

When you contact us (e.g. by e-mail, letter, or telephone), we will process the personal data you have provided to us (first name and surname, contact details, details of the content of the inquiry) to respond to your inquiry.

The legal basis for processing personal data is your consent (GDPR Article 6(1)(a)) and/or our legitimate interest in responding to and/or resolving your inquiry (GDPR Article 6(1)(f)).

We store personal data for as long as it is necessary to manage and respond to inquiries or to take the necessary actions related to the inquiry.

1.8. You visit our website

We use a variety of cookies on our website, through which we may also collect personal data. Depending on the purpose of collecting personal data, the legal basis for processing is our legitimate interest in ensuring the functionality of the website (GDPR Article 6(1)(f)) or your consent (GDPR Article 6(1)(a)).

More information about cookies can be found in the cookie preference panel displayed when entering Invego’s website. This panel can later be reopened by clicking on the cookie icon labelled “Consent Preferences” located in the corner of the website.

1.9. You are connected with us through any of the above situations

In addition to the above purposes, we may need to process personal data to protect our rights (e.g. in a legal dispute between us) or to resolve a request you have submitted as a data subject to exercise your rights related to your personal data.

The legal basis for processing personal data, in cases where it is necessary to protect rights, is the resulting legitimate interest (GDPR Article 6(1)(f)). Resolving a data subject’s request is mandatory for us under the GDPR, which is why we process personal data for this purpose to fulfil our legal obligation (GDPR Article 6(1)(c)).

We store personal data for as long as it is necessary to protect our rights or to fulfil our legal obligations.

Storage of personal data for the protection of rights and fulfilment of legal obligations

In addition to storing personal data based on the primary purpose of collection and processing of personal data, we may sometimes need to store personal data even after this purpose has been fulfilled to protect our rights (as a rule, for 3 years, based on the standard limitation period for claims) or to fulfil obligations arising from legal acts (to meet accounting and tax obligations, we store payment-related data for 7 years from the relevant financial year).

2. Who do we share personal data with?

In the course of our activities, we may also need to share personal data with third parties who process personal data, either as data processors on our behalf or as independent controllers. For example, personal data may be accessed in the course of the provision of their services by our IT service providers, client relationship management service provider, accounting service provider, targeted search service provider, our auditors, legal service providers, notaries, construction, maintenance and management partners, warranty partners, marketing service providers, and insurance service providers.

We may also need to provide access to personal data where this is appropriate in connection with Invego’s restructuring, merger, acquisition, sale, or other transaction or in connection with the assignment of claims.

We only share personal data with third parties where we have a legal basis to do so.

Invego does not generally process personal data outside the European Economic Area. However, if any of our service providers does so, we have entered into respective contractual arrangements and we implement safeguards consistent with the GDPR to ensure that your personal data is protected.

3. What are your rights concerning your personal data?

If you have any questions about the processing of your personal data or if you wish to exercise your rights, please contact us by e-mail at

Your rights in relation to your personal data are not absolute and we may not always be obliged or able to take the action you request.

When processing personal data based on legitimate interest, we have conducted a proper balancing of opposing interests beforehand, during which we assessed whether our interest in processing personal data outweighs your interests, rights, and freedoms for which personal data are protected. You always have the right to object to such processing.

If we process personal data based on your consent, you always have the right to withdraw the consent given. However, it should be noted that the withdrawal of consent does not affect the legality of the processing of personal data already carried out based on that consent.

Additionally, you have the right to:

• Request that we provide all personal data we process about you. For this, we ask you to clarify whether you would like confirmation of what personal data we hold about you and/or if you would like a copy of your personal data.
• Request the rectification of your personal data. The exercise of the right to rectify personal data requires that the personal data are incorrect or incomplete. If this is the case, we will rectify and/or complete the personal data. For this, we ask you to specify in your request which personal data need to be rectified.
• Request the erasure of your personal data. You may request the erasure of personal data if: (i) we no longer need the personal data for the purpose for which it was collected; (ii) you wish to withdraw your consent for the processing of personal data, and we have no other legal basis to continue processing the data; (iii) you object to the processing of your personal data, and we have no overriding legitimate grounds to continue processing the personal data; (iv) we have processed the personal data unlawfully; (v) erasure is required to fulfil a legal obligation. However, despite the above, if we need to continue processing personal data to fulfil our legal obligations or protect our rights, it may not be possible for us to erase the personal data. In any case, we will explain why we are unable to erase the personal data.
• Request the restriction of the processing of your personal data. This applies if: (i) you have pointed out that the personal data is incorrect, and we are verifying its accuracy; (ii) the processing of personal data is unlawful, but you do not wish the data to be erased and instead request the restriction of processing; (iii) we no longer need the personal data for processing purposes, but you and/or your company require it for the establishment, exercise, or defence of your legal claims; (iv) you have objected to the processing of personal data, and we are verifying whether our legitimate grounds for processing outweigh the reasons provided for ceasing the processing. Even if the processing of personal data has been restricted, we may process the personal data if (i) you have granted your consent for the processing; (ii) we need the data for the establishment or exercise of legal claims or for the defence of the claims submitted by us; (iii) we need the data for the protection of the rights of a natural or legal person; or (iv) the data must be processed for reasons of important public interest.
• Request the transfer of your personal data. You may request the provision of your personal data in a structured, commonly used, and machine-readable format and transfer the data to another data controller (or request that we transfer the data) if the processing of personal data is based on your consent or a contract between us, and the processing of personal data is carried out by automated means.

We will respond to your request within one month unless there are circumstances requiring additional time to provide a response. In any case, we will inform you of this within one month.

You also have the right to submit a complaint to the Estonian Data Protection Inspectorate if you find that the processing of personal data has not taken place in accordance with the applicable data protection laws and your rights have been infringed (address of the Data Protection Inspectorate is Tatari 39, 10134 Tallinn, telephone +372 627 4135, e-mail: ). If your permanent residence, workplace, or the place of infringement is in another Member State, you have the right to submit a complaint with the data protection supervisory authority of that country as well. However, we recommend that you first contact Invego in case of any issues.

4. Changes to the Privacy Notice

If we need to change the terms of the Privacy Notice, we will always notify of such changes via our website https://invego.ee/.

Privacy Notice last updated: 2 December 2024