Invego Luccaranna OÜ Privacy Notice

This privacy notice describes how Invego Luccaranna OÜ, registry code 12025985, address Telliskivi tn 51a, 10611, e-mail info@invego.ee (hereinafter the Developer) processes your personal data as a controller, or, together with Invego OÜ (hereinafter Invego; the Developer and Invego jointly hereinafter we), as joint controllers. Please note that personal data is any information relating to an identified or identifiable natural person (e.g. name, e-mail address, personal identification code), and the processing of personal data is any operation performed on personal data (e.g. modification, viewing, deletion, storage).

The Developer processes personal data in accordance with the applicable data protection legislation, including the General Data Protection Regulation of the European Union (GDPR).

The Developer processes your personal data as a controller if:

1. You would like an offer for the services of the Developer
2. You are a client of the Developer who is a natural person
3. You are an investor of the Developer or a representative or contact person of an investor
4. You are a representative or contact person of a service provider, cooperation partner or legal-person client of the Developer
5. You visit the website of the Developer

The Developer processes your personal data as a joint controller together with Invego if:

1. We send you news and notices about our activities or satisfaction surveys
2. You register for and attend our events
3. You contact us
4. In addition to the above, the sale of the development, client communication and marketing are organised for the Developer by Invego, which acts in those processing operations on behalf of the Developer and under its instructions as a processor, not as a joint controller.

1. Which personal data do we process as a controller, for what purposes and for how long?

1.1. You would like an offer for the services of the Developer

If you would like an offer for a service from the Developer and have submitted an enquiry for that purpose through the website of the Developer or by contacting a sales consultant, we process the personal data that you have provided to us in the enquiry and in the communication relating to the offer.

We process personal data in order to:

• identify you (first name and surname);
• contact you (contact details such as telephone number, e-mail address);
• make you a suitable offer (data on the product of interest and your preferences – e.g. number of rooms, price, size, interior finishing preferences).

The legal basis for the processing of personal data is the necessity to make you an offer in accordance with your wish, in order to prepare and conclude a contract (GDPR Article 6(1)(b)).

We retain personal data for as long as is necessary to make the offer and to reach the conclusion of a contract. If we conclude a contract, we retain the personal data thereafter in accordance with the rules applicable to the processing of clients’ personal data. If no contract is concluded as a result of the enquiry, we may process your personal data further in accordance with the personal data processing rules applicable to the sending of news and notices. If no contract is concluded and there is no basis for processing the data for another purpose, we retain the data relating to the enquiry for up to one year from the last communication.

1.2. You are a client of the Developer who is a natural person

If you are a private client of the Developer, we process the personal data that you have submitted to us before the conclusion of a contract for the purpose of making an offer, or that we have received from you within the client relationship, in connection with the contracts concluded with you or in connection with the provision of services to you.

We process personal data in order to:

• identify you (first name and surname, personal identification code or date of birth);
• contact you (contact details such as telephone number, e-mail address);
• create a user account for you on our artificial-intelligence-based home management platform;
• provide you with the service, perform the contract concluded and manage the contractual relationship (data relating to the services and the object of the contract, payment data, data on the performance of the contract, communication data).

The legal basis for the processing of personal data is the necessity to prepare and perform the contract to be concluded with you (GDPR Article 6(1)(b)) and our legitimate interest in managing the contractual relationship and organising the provision of services (GDPR Article 6(1)(f)). Also the necessity to comply with our accounting and tax obligations (GDPR Article 6(1)(c)).

We retain clients’ personal data for the duration of the contractual relationship and for five years after the end of the contractual relationship. If no contractual relationship arises, we retain the data for up to one year from the last communication. Data contained in accounting source documents is retained for seven years from the end of the financial year in which the business transaction was recorded in the accounting register.

1.3. You are an investor of the Developer or a representative or contact person of an investor

If you have invested in the Developer or in its development project, or are in another contractual relationship with the Developer as an investor, we process your personal data as a controller. If the investor is a legal person, we also process the personal data of its representative, contact person and beneficial owner.

We process personal data in order to:

• identify you and verify your identity (first name and surname, personal identification code or date of birth, citizenship, place of residence, identity document data and a copy thereof);
• contact you and organise investor communication (contact details, data concerning the right of representation, professional position, communication data);
• prepare, conclude and perform the contract related to the investment and pay out returns (contract data, size and terms of the investment, bank and payment details, data on payouts);
• comply with due diligence obligations arising from the prevention of money laundering and terrorist financing (beneficial owner data, politically exposed person status, data on the origin of funds and assets, results of international sanctions checks);
• comply with accounting, tax and reporting obligations and maintain lists required by law (payment data, tax residency data, data on holdings or claims).

In the case of an investor who is a natural person, the legal basis for the processing of personal data is the necessity to prepare and perform the contract related to the investment (GDPR Article 6(1)(b)). We process the personal data of the representative and contact person of an investor that is a legal person on the basis of our legitimate interest in performing and managing the contract concluded with the investor and in communicating with the investor (GDPR Article 6(1)(f)). For the application of due diligence measures and for the fulfilment of accounting, tax and reporting obligations, we process personal data in order to comply with a legal obligation (GDPR Article 6(1)(c)).

We may share the personal data of investors and their representatives with notaries, credit institutions, auditors, legal and accounting service providers, the operator of the securities register and supervisory and tax authorities, where there is a legal basis for doing so. The personal data of investors is processed by the Developer independently, and Invego does not process that data on behalf of the Developer unless otherwise agreed.

We retain the personal data of investors and their representatives for the duration of the investment relationship and for five years after the end of the relationship. Data collected in the course of applying due diligence measures and the underlying documents are retained for five years from the end of the business relationship on the basis of the Money Laundering and Terrorist Financing Prevention Act. Payment-related data is retained for the fulfilment of accounting and tax obligations for seven years from the relevant financial year.

1.4. You are a representative or contact person of a service provider, cooperation partner or legal-person client of the Developer

If, in your communication with the Developer, you represent a company related to you (e.g. you are its employee or representative), the Developer processes the personal data that you have submitted yourself or that has been submitted by the company related to you.

The Developer processes personal data such as first name and surname, business contact details, professional position and, where necessary, data concerning the right of representation, in order to perform and manage the contractual relationship established with the company related to you and to cooperate with the company (including to contact it).

The legal basis for the processing of personal data is the necessity to perform or manage the contract concluded with the company or to cooperate in another manner (GDPR Article 6(1)(f)).

The Developer retains the personal data of representatives or contact persons for the duration of the contractual relationship and for five years after the end of the contractual relationship. If no contractual relationship is entered into, we retain the data of the representative or contact person for up to one year from the last contact.

1.5. You visit the website of the Developer

The Developer uses various cookies on its website, through which personal data may also be collected. Strictly necessary cookies, without which the website does not function, do not require your consent under the Electronic Communications Act; the personal data collected through them is processed by the Developer on the basis of its legitimate interest in ensuring the security and functioning of the website (GDPR Article 6(1)(f)). All other cookies, including statistics, preference and marketing cookies, are used by us only with your prior consent (GDPR Article 6(1)(a)).

More information about cookies can be found in the cookie selection panel displayed when entering the website of the Developer and in the cookie notice. The cookie notice sets out the name, setter, purpose, type and validity period of each cookie and thus also the specific retention periods. You can withdraw or change the consent you have given at any time, as easily as you gave it. Some cookies are set by third parties (e.g. providers of web analytics and social media platforms), which may involve the transfer of personal data outside the European Economic Area; in such a case the Developer applies the safeguards described in this privacy notice.

2. Which personal data do we process as joint controllers, for what purposes and for how long?

In order to provide a higher-quality service, in certain cases the Developer processes your personal data together with Invego as joint controllers. In such a case both the Developer and Invego process your data in order to achieve the jointly determined purposes described below. For this we have jointly determined the scope, legal bases and duration of the processing of personal data. As joint controllers, both the Developer and Invego are responsible for the lawfulness and security of the processing of your personal data. To exercise your rights relating to your personal data, you may contact us at any time by sending an enquiry to the e-mail address given below. The information of data subjects about the processing of personal data (Articles 13 and 14 of the GDPR) is provided by Invego on behalf of the joint controllers. Irrespective of the allocation of obligations, you may exercise your rights relating to your personal data in respect of each joint controller.

2.1. We send you news and notices about our activities or satisfaction surveys

In order to send news and notices (including invitations to events) and satisfaction surveys, we use the personal data that you have disclosed to us if you have previously used the services we offer or shown an interest in them by sending us an enquiry or completing the relevant form at our event.

We process personal data such as first name and surname, e-mail address and the residential district you have been interested in, in order to send you interesting information about our activities and to invite you to our events. We may also use this data to send you satisfaction surveys about our services. We use the feedback to ensure and further develop the quality of our services.

If you are our client, we send you information about our activities and similar products on the basis of our legitimate interest (GDPR Article 6(1)(f)) and under the conditions laid down for direct marketing in the Electronic Communications Act. If you have submitted an enquiry to us or attended our event but are not our client, we send you news, notices and satisfaction surveys only on the basis of your prior consent (GDPR Article 6(1)(a)). We ask for consent separately and in a manner clearly distinguishable from other information, and you may withdraw it at any time as easily as you gave it. You may always refuse to receive news and notices from us already at the time your contact details are initially collected, or opt out of further news and notices in accordance with the instructions given at the end of the e-mail. We retain personal data for the purpose of sending news and notices until you have objected to such use of your contact details. We also review the consents given from time to time.

2.2. You register for and attend our events

If you register for our client days or other public events, we process the personal data about you that you have submitted to us yourself or that has been submitted by the company related to you.

When you register for and attend events, we process your first name and surname and e-mail address in order to better manage the organisation of the event and to enable you to attend it.

In such a case the legal basis for the processing of personal data is our legitimate interest in enabling you to attend the event if you so wish and in ensuring that the event is a success (GDPR Article 6(1)(f)).

Photographs and/or video recordings are sometimes taken at our events. The purpose of this is to keep a nice record of the event and to share information about our activities also outside our companies (e.g. on our social media channels, in the media, on our website). If photographing or filming takes place, we inform you of this before the event and on site at the event. You always have the right to refuse to be recorded by indicating this to the person recording the event. In such a case the legal basis is our legitimate interest in obtaining records of the events we organise (GDPR Article 6(1)(f)). In the case of recordings made for the purpose of disclosure at an event taking place in a public place, we additionally rely on § 11 of the Personal Data Protection Act. At closed events, including client days, we rely solely on legitimate interest and ensure that you have a genuine opportunity to refuse to be recorded.

We retain personal data for as long as it is necessary for the purpose of holding and covering the event. If you request the removal of a recording of yourself, we will remove it from the channels we manage without undue delay. Data on registration for and attendance at an event is generally retained for up to one month after the event.

2.3. You contact us

If you contact us (e.g. by e-mail, letter or telephone), we process the personal data that you have submitted to us (first name and surname, contact details, data on the content of the enquiry) in order to respond to your enquiry.

The legal basis for the processing of personal data is our legitimate interest in responding to and/or resolving the enquiry (GDPR Article 6(1)(f)). If your enquiry concerns the conclusion of a contract or the performance of an existing contract, the basis is the preparation or performance of the contract (GDPR Article 6(1)(b)).

We retain personal data for as long as it is necessary for managing and responding to enquiries or for taking the measures required by the enquiry. As a rule, we retain data on the enquiry and the related correspondence for up to three years from the enquiry, unless there is another legal basis for retaining it for longer.

3. Processing of personal data for the protection of rights and the fulfilment of legal obligations

In addition to the purposes set out above, the Developer may need to process personal data in order to protect the rights of the Developer (e.g. in a legal dispute), to comply with obligations arising from law or to resolve a request that you have submitted to the Developer as a data subject in order to exercise your rights relating to your personal data.

The legal basis for the processing of personal data is, where there is a need to protect rights, the legitimate interest arising therefrom (GDPR Article 6(1)(f)). Resolving a data subject’s request is mandatory for the Developer under the GDPR, and therefore we process personal data for that purpose in order to comply with a legal obligation (GDPR Article 6(1)(c)).

In addition to retaining personal data on the basis of the main purpose of its collection and processing, personal data must sometimes also be retained after that purpose has been fulfilled in order to protect our rights (in the case of a contractual relationship for 3 years, or 5 years in matters relating to structures, and in the case of a non-contractual relationship for 10 years, based on the general limitation period for claims) or in order to comply with obligations arising from law (in order to comply with accounting and tax obligations, the Developer retains payment-related data for 7 years from the relevant financial year). Data relating to the resolution of a data subject’s request is retained by the Developer for 10 years from the moment a possible claim arises.

4. Automated decision-making and profiling

The Developer does not take decisions in respect of you that are based solely on automated processing and that have a legal or other significant effect on you (Article 22 of the GDPR).

5. With whom does the Developer share personal data?

In the course of its activities, the Developer may also need to share personal data with third parties who process personal data either as processors on behalf of the Developer or as independent controllers. The Developer shares personal data with third parties only where there is a legal basis for doing so.

For example, access to personal data in the course of providing their services may be obtained by IT service providers, the home management platform service provider, the customer relationship management service provider, the accounting service provider, the executive search service provider, auditors, legal service providers, notaries, construction, maintenance and administration partners, partners carrying out warranty works and marketing service providers. Personal data may also be accessed by Invego, which organises sales, client communication and marketing for the Developer, by credit institutions where the financing of a transaction so requires and, in the case of investors, by the operator of the securities register, supervisory authorities and the Estonian Tax and Customs Board.

The Developer may also need to grant access to personal data where this is relevant in connection with the restructuring, merger, acquisition, sale or other transaction involving the Developer or in connection with the assignment of claims. The legal basis for such sharing is the legitimate interest of the Developer (GDPR Article 6(1)(f)).

The Developer and Invego also use service providers that process personal data outside the European Economic Area, mainly in the United States of America (e.g. providers of the customer management system, web analytics and marketing platforms). In such a case the Developer and Invego rely on the standard contractual clauses established by Commission Implementing Decision (EU) 2021/914, together with the necessary additional safeguards. You can obtain more detailed information about the safeguards applied by writing to info@invego.ee

6. How does the Developer protect personal data?

The Developer applies appropriate technical and organisational measures to protect personal data: for example, access to personal data is restricted on the basis of job duties, encrypted connections are used when transmitting data, internal rules relating to the processing of personal data have been established, and confidentiality agreements have been concluded with employees and partners.

Should a personal data breach occur, the Developer will notify the Data Protection Inspectorate thereof within 72 hours of becoming aware of the breach, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons, and, where the breach entails a high risk to your rights and freedoms, you will also be notified without undue delay (Articles 33–34 of the GDPR).

7. What are your rights in respect of your personal data?

If you have questions about the processing of your personal data or wish to exercise your rights, please contact us at the e-mail address info@invego.ee. However, please note that your rights in respect of your personal data are not absolute, and therefore we may not always be obliged or able to take the measures requested in an application.

When processing personal data on the basis of legitimate interest, we have previously carried out a proper balancing of the competing interests, in the course of which it has been assessed whether our interest in processing the personal data outweighs your interests and the rights and freedoms for the sake of which personal data is protected. You always have the right to object to such processing.

If we process personal data on the basis of your consent, you always have the right to withdraw the consent given. However, please note that the withdrawal of consent does not affect the lawfulness of the processing of personal data that has already taken place on that basis.

In addition, you have the right to:

• Request all personal data that the Developer processes about you. To do so, please clarify whether you wish to receive confirmation of what personal data the Developer holds about you and/or whether you wish to receive a copy of your personal data.
• Request the rectification of your personal data. Exercising the right to rectification presupposes that the personal data is inaccurate or incomplete. If this is the case, the Developer will rectify and/or complete the personal data. To do so, please specify in your request which personal data needs to be rectified. Where necessary, we may also ask you to submit relevant evidence.
• Request the erasure of your personal data. Erasure of personal data may be requested where (i) the Developer no longer needs the personal data for the purpose for which it was collected; (ii) you wish to withdraw your consent to the processing of personal data and the Developer has no other legal basis on which to continue processing it; (iii) you object to the processing of your personal data and the Developer has no overriding legitimate grounds for continuing the processing; (iv) the Developer has processed the personal data unlawfully; (v) erasure is required in order to comply with a legal obligation. However, if, notwithstanding the above, the Developer needs to continue processing the personal data in order to comply with a legal obligation or to protect its rights, it may not be possible to erase the personal data. In any such case we will explain why the Developer cannot erase the personal data.
• Request the restriction of the processing of your personal data. This applies where (i) you have drawn the attention of the Developer to the fact that the personal data is inaccurate and the Developer is verifying its accuracy; (ii) the processing of the personal data is unlawful but you do not wish the data to be erased and request restriction of the processing instead; (iii) the Developer no longer needs the personal data for the purposes of the processing, but you and/or the company related to you need it for the establishment, exercise or defence of legal claims; (iv) you have objected to the processing of the personal data and we are verifying whether the legitimate grounds of the Developer for processing the personal data override the grounds put forward for ceasing the processing. Even where the processing of personal data is restricted, the Developer may process such data where (i) you have given your consent thereto; (ii) the Developer needs the data for the establishment, exercise or defence of legal claims; (iii) the Developer needs the data for the protection of the rights of a natural or legal person; or (iv) the data needs to be processed in connection with an important public interest.
• Request the portability of your personal data. You may request that your personal data be issued in a structured, commonly used and machine-readable format and transmit that data to another controller (or request that the Developer transmit the data), where the processing of the personal data is based on consent or on a contract concluded with the Developer and the personal data is processed by automated means.
• Object to the processing of your personal data. If we process your personal data on the basis of our legitimate interest, you have the right to object to such processing at any time, setting out the grounds relating to your particular situation.

The Developer responds to a request submitted within one month, unless there are circumstances due to which we need more time to respond to the request. In any event, we will inform you of this within one month.

You also have the right to lodge a complaint with the Data Protection Inspectorate if you consider that the processing of personal data has not been carried out in accordance with the applicable data protection legislation and that your rights have been infringed (Data Protection Inspectorate, address Tatari 39, 10134 Tallinn, telephone +372 627 4135, e-mail: info@aki.ee). If your habitual residence, place of work or the place of the infringement is in another Member State, you also have the right to lodge a complaint with the data protection supervisory authority of that country. Nevertheless, in the event of any problems we recommend that you first contact the Developer.

8. Amendments to the privacy notice

If the Developer needs to amend the terms of this privacy notice, we will always inform you of such amendments via our website. Earlier versions of the privacy notice are available on request at the e-mail address info@invego.ee.

The privacy notice was last updated: 13.10.2026