Innovadata
Enter the portal

Privacy Policy

Last updated: 23 September 2026

1. Data Controller

Innovadata OÜ (registry code 17267954), registered at Harju maakond, Estonia, is the data controller responsible for your personal data.

Data protection contact: privacy@innovadata.eu

2. Data We Collect

We collect the following categories of personal data:

2.1 Order Data

When you place an order: full name, email address, phone number (optional), company name and registry code (for business customers), VAT number (optional). Legal basis: contract performance (GDPR Art. 6(1)(b)).

2.2 Analytics Data

With your consent: page views, session duration, browser language, screen resolution, referrer URL. We use our own self-hosted lightweight tracker plus third-party analytics (Google Analytics 4, Google Tag Manager, Microsoft Clarity) that may set third-party cookies and load only after you accept analytics cookies. Legal basis: consent (GDPR Art. 6(1)(a)).

2.3 Support Data

When you contact support: name, email address, message content. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) : to respond to your inquiry.

2.4 Technical Data

Server logs may temporarily record IP addresses, user-agent strings, and timestamps for security and error monitoring. These are deleted within 30 days. Legal basis: legitimate interest (GDPR Art. 6(1)(f)).

2.5 Product News and Offers

Only if you have ticked the separate marketing box at registration or switched it on in your account settings: your email address, your name and the account details a message refers to, to send you product news and offers, including reminders about expiring bonus credits, a low balance, an unfinished registration or a saved selection. Legal basis: consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal, with the unsubscribe link in every marketing email or in your account settings. Service emails (for example invoices, payment confirmations and the datasets and reports you ordered) are sent whether or not you give this consent.

3. Cookies and Similar Technologies

We use the following storage technologies:

3.1 Necessary (always active)

  • innovadata_lang : localStorage : stores your language preference (EN/ET).
  • innovadata_consent : localStorage : stores your cookie consent choices.

3.2 Analytics (requires consent)

  • _iv : localStorage : pseudonymous visitor identifier for analytics.
  • _is : sessionStorage : session identifier (resets when tab closes).

3.3 Marketing

Currently not used. No marketing cookies or third-party trackers are deployed.

You can manage your cookie preferences at any time by clicking the 🍪 cookie icon in the bottom-left corner of any page, or by using the "Manage Preferences" option in the cookie banner.

4. Purpose of Processing

  • Order fulfillment : to process your purchase, deliver data files, and send invoices.
  • Analytics : to understand site usage patterns and improve the service (with consent).
  • Customer support : to respond to your inquiries.
  • Legal compliance : to comply with tax, accounting, and other legal obligations.
  • Security : to protect the service against abuse and unauthorized access.

5. Data Sharing

We share the personal data of our customers and website visitors only with:

  • Montonio Finance OÜ : payment processing (acts as independent controller for payment data).
  • Email service provider : for sending invoices, order confirmations, the datasets you ordered and, with your consent, product news (data processing agreement in place).
  • Server hosting provider : infrastructure where data is stored (EU-based servers).
  • Google (Google Analytics 4, Google Tag Manager) and Microsoft (Clarity): analytics, only after you accept analytics cookies (see 2.2).

We do not sell, rent or trade the personal data of our customers and website visitors. The company datasets we sell can include personal data, such as the names and roles of board members and business contact details; section 13 describes this processing and its sources.

6. Data Retention

  • Order data : 7 years (Estonian accounting law requirements).
  • Analytics data : 26 months from last activity, then automatically deleted.
  • Support messages : 2 years from last communication.
  • Server logs : 30 days.

7. Your Rights (GDPR Art. 15–22)

You have the following rights regarding your personal data:

  • Right of access (Art. 15) : request a copy of all personal data we hold about you.
  • Right to rectification (Art. 16) : request correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17) : request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
  • Right to restriction (Art. 18) : request that we limit processing of your data.
  • Right to data portability (Art. 20) : receive your data in a machine-readable format.
  • Right to object (Art. 21) : object to processing based on legitimate interest.
  • Right to withdraw consent (Art. 7(3)) : withdraw consent at any time: for analytics via cookie settings, for product news and offers via the unsubscribe link or your account settings.

To exercise any of these rights, send an email to privacy@innovadata.eu with the subject line "Data Subject Request". We will respond within 30 days.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encrypted connections (TLS/HTTPS), access controls, regular security reviews, and secure server infrastructure within the European Union.

9. International Transfers

Order, support and technical data are stored and processed within the European Union / European Economic Area. Analytics data are shared with Google and Microsoft only with your consent; these providers may process data outside the EU/EEA under the transfer mechanisms approved by the European Commission.

10. Children's Data

Our service is intended for business professionals. We do not knowingly collect personal data from children under 16. If you believe a child has provided data, contact us for immediate deletion.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via a notice on our website. The "last updated" date at the top indicates the most recent revision.

12. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon):

13. Registry Data Subjects

The datasets we sell are compiled from official national business registers: the Estonian Business Register, the Latvian Register of Enterprises, the Lithuanian Registrų centras, the Finnish PRH, the Swedish SCB and Bolagsverket, the Norwegian Brønnøysund Register Centre and the Polish KRS/CEIDG. Besides company-level facts, these datasets can contain personal data that the registers themselves publish. This section explains that processing.

  • Categories of data : names and roles of board members, management and legal representatives, as published by the source register, and business contact details such as company email addresses, phone numbers and websites.
  • Sources : the official national registers listed above; other public registers and open data published by public authorities, including in Latvia the building-sector register (BIS), the Consumer Rights Protection Centre (PTAC), the Central Finance and Contracting Agency (CFLA) and the State Technical Supervision Agency (VTUA), and in Lithuania the Employment Service (Užimtumo tarnyba); Overture Maps open data; and business contact details that companies publish on their own websites, which we find through web search or collect from the website directly; and, for Latvian and Lithuanian companies, contact details collected earlier from publicly accessible business directories. All of these sources are publicly accessible.
  • Legal basis : legitimate interest (GDPR Art. 6(1)(f)) : providing structured access to business information that national disclosure rules make public.
  • Recipients : business customers who buy our datasets or use the API and MCP, for their own business purposes under our terms of use.
  • Retention : register data mirrors the source register, and when a register removes or changes a record, the change is applied at the next synchronization. Contact details from the other sources are kept while the company is in our database, until newer data replaces them or you ask us to remove them.
  • Objection and removal : if you are named in a register record and want to object to this processing or ask for removal from our datasets, email pavel@innovadata.eu. We will respond within 30 days.

14. Contact

For any privacy-related questions or data subject requests: