Privacy Notice
Last updated: 17 June 2026 · Effective: 17 June 2026
1. Who we are (Controller)
WDW Europe Trade OÜ(“we”, “our”, “us”) operates the brand Business Hub and the website businesshub.ee. We are the data controller for the personal data described in this notice.
- Registered office: Sepise tn 1, Lasnamäe, Tallinn 11415, Estonia
- Registry code: 10838112
- VAT number (KMKR): EE100751770
- Contact for data matters: privacy@businesshub.ee
2. What personal data we process
| Category | Examples |
|---|---|
| Identification data | Name, business email, business phone, job title |
| Company data | Estonian registry code, company name, share capital, legal address, board members, beneficial owners (publicly available from the Estonian Business Register) |
| Communication data | Emails you send us, replies, calendar booking details, call notes, Smart Assistant chat messages |
| Financial data | If you become a paying client: invoicing details, payment method (handled by Stripe), KMKR/VAT number |
| Operational data | Annual report status, tax debt at the Estonian Tax and Customs Board, compliance rulings (publicly available from Estonian registers) |
| Website data | IP address, device and browser, pages viewed, referrer — collected via analytics cookies only if you consent |
We do not process special-category data (health, religion, political views, etc.).
3. Why we process your data (Lawful basis)
| Processing activity | Lawful basis (GDPR Article 6) |
|---|---|
| Cold outreach to Estonian company founders based on public registry data | Legitimate interest (Art. 6(1)(f)) — our assessment is on file and available on request |
| Responding to your enquiry or booking a discovery call | Pre-contractual measures (Art. 6(1)(b)) |
| Smart Assistant chat — understanding and routing your message | Legitimate interest / pre-contractual measures (Art. 6(1)(f) / (b)) |
| Delivering paid services | Performance of contract (Art. 6(1)(b)) |
| Issuing invoices and tax records | Legal obligation under the Estonian Accounting Act (Art. 6(1)(c)) |
| Anti-money-laundering checks (Formation Pack, Director clients) | Legal obligation under RahaPTS (Art. 6(1)(c)) |
| Analytics & marketing cookies (Google Analytics, Meta Pixel) | Consent (Art. 6(1)(a)) — set only if you accept them in the cookie banner |
| Marketing emails to clients/subscribers (opt-in only) | Consent (Art. 6(1)(a)) |
You may object at any time to processing based on legitimate interest by writing to privacy@businesshub.ee.
4. Who we share data with (Sub-processors)
We use the following service providers to operate Business Hub. Each is bound by a Data Processing Agreement requiring GDPR-compliant handling:
| Sub-processor | Purpose | Location |
|---|---|---|
| Neon Inc. | Database hosting (Postgres) | EU (Frankfurt) |
| Vercel Inc. | Website + app hosting | EU (Frankfurt) |
| Cloudflare Inc. | DNS, CDN | Global edge |
| Google LLC (Workspace) | Email + calendar | EU |
| Cal.com Inc. | Booking scheduling | US (EU region for accounts) |
| Smartlead.ai | Cold email delivery | US |
| Brevo (Sendinblue SA) | Transactional email | EU (France) |
| Stripe Inc. | Payment processing | US/EU |
| Google LLC | Website analytics (Google Analytics) — only with your consent | US |
| Meta Platforms Ireland Ltd | Campaign measurement (Meta Pixel) — only with your consent | EU / US |
| OpenRouter Inc. | Smart Assistant chat — routes your message to a model (e.g. DeepSeek, Anthropic) to classify the situation | US |
| Telegram (Telegram FZ-LLC) | Internal lead / crisis alerting to our team | Non-EU |
| ImprovMX | Email forwarding | EU |
We do not sell your data. Other than the Meta Pixel — which loads only if you consent to marketing cookies — we do not share data with advertising networks.
5. International data transfers
Some of our sub-processors are based outside the EU/EEA (Vercel, Stripe, Smartlead, Cal.com, Google, Meta, OpenRouter, Telegram). For each, we rely on EU Standard Contractual Clauses (SCCs) as approved by the European Commission, and EU region routing wherever the vendor offers it (e.g., Neon EU-Frankfurt, Vercel EU-Frankfurt, Brevo EU-France). We have completed a Transfer Impact Assessment for each non-EU sub-processor.
6. How long we keep your data
| Data type | Retention period | Reason |
|---|---|---|
| Cold-outreach leads (no engagement) | 6 months from last contact | Reasonable necessity for legitimate interest |
| Suppression list (opt-out) | Permanently | To honour your opt-out — we never re-contact |
| Discovery-call notes (no engagement followed) | 12 months | Track if the conversation should resume |
| Active client engagement data | Engagement + 7 years | Estonian Accounting Act §12 |
| Invoicing & tax records | 7 years | Estonian Accounting Act §12 |
| AML/KYC records | 5 years after the business relationship ends | RahaPTS §47 |
| Analytics & marketing cookies | Up to 14 months (Google Analytics) / up to 90 days (Meta Pixel), or until you withdraw consent | Provider defaults; consent-based |
| Marketing-email subscribers | Until consent withdrawn | Consent-based processing |
After the retention period, data is permanently deleted from our active systems and, within 30 days, from backups.
7. Your rights under GDPR
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure (“right to be forgotten”) — request deletion, where applicable
- Restriction — request that we temporarily stop using your data
- Portability — receive your data in a machine-readable format
- Objection — to processing based on legitimate interest
- Withdrawal of consent — at any time, without affecting prior lawful processing
To exercise any right, email privacy@businesshub.ee. We respond within 30 days (extendable to 60 days for complex requests, with explanation).
You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): aki.ee · Tatari 39, 10134 Tallinn · info@aki.ee · +372 627 4135.
8. Security
- HTTPS/TLS encryption in transit
- Encrypted-at-rest databases (managed by sub-processors)
- Access controls with multi-factor authentication on admin accounts
- Audit logs of access to personal data
- Annual data-breach response drill
In case of a data breach, we will notify the Estonian Data Protection Inspectorate within 72 hours and affected individuals without undue delay, as required by GDPR.
9. Cookies
We use two kinds of cookies:
- Essential cookies — needed for the site to work (for example, remembering your language and your cookie choice). These are always on and do not require consent.
- Analytics & marketing cookies — set only if you accept them in our cookie banner. With your consent we use Google Analytics (to understand how the site is used) and the Meta Pixel (to measure our campaigns). If you decline, none of these are set.
On your first visit a banner lets you Accept or Decline non-essential cookies. You can change your choice at any time via “Cookie settings” in the site footer.
10. Children
Our services are for adult businesses. We do not knowingly process data of anyone under 18.
11. Updates to this notice
We may update this notice from time to time. Material changes will be communicated by email to active clients and posted on businesshub.ee with the updated effective date.
Contact
Email: privacy@businesshub.ee
Postal mail: WDW Europe Trade OÜ, Sepise tn 1, Lasnamäe, Tallinn 11415, Estonia