Privacy Policy

I.Introduction

By creating a personal account on the ESTO Website and (or) ordering ESTO Services, the Client confirms that they have carefully read this Privacy Policy on the processing of their data.

This ESTO Privacy Policy explains how ESTO collects, uses and protects Clients' personal data.

ESTO presents information about the processing of Clients' data as follows: first, the Client is given a concise summary of the key points, and upon selecting a specific topic, a detailed description of it is provided. This Privacy Policy addresses the following questions:

• How are the terms defined?
• Who is the data controller?
• What categories of Clients' personal data does ESTO collect and process, and from what sources is this data obtained?
• For what purposes and on what legal basis does ESTO process Clients' personal data?
• Does ESTO use automated decision-making or profiling when processing personal data?
• To whom and for what purposes does ESTO transfer personal data?
• Does ESTO transfer personal data outside the European Economic Area?
• How long does ESTO retain personal data?
• What data subject rights does the Client have?
• How may ESTO amend this Privacy Policy?
• Where can the Client turn with questions related to the processing of personal data, or to exercise their data subject rights?

II.Definitions

2.1.General Data Protection Regulation or GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

2.2.ESTO – UAB "ESTO", a company providing financial services, legal entity code 305219905, registered office address Lvivo g. 25, Vilnius, Lithuania.

2.3.ESTO Group of Companies – a group of companies consisting of ESTO and other companies controlled by ESTO Holdings OÜ, legal entity code: 14996345 (Estonia), including ESTO AS, legal entity code: 14180709 (Estonia), and ESTO LV AS, legal entity code: 40103050993 (Latvia).

2.4.Data – any information relating to an identified or identifiable natural person (a Data Subject).

2.5.Data Processing – any operation or set of operations performed on Data or sets of Data, whether or not by automated means, such as collection, recording, organisation, storage, alteration, retrieval, consultation, use, erasure, etc.

2.6.Data Processor – a person who processes Client Data on behalf of ESTO.

2.7.Data Controller – a natural or legal person who, alone or jointly with others, determines the purposes and means of data processing. ESTO is considered to be the Data Controller of Client Data.

2.8.Website – the ESTO Website located at www.esto.eu, through which the Client can access ESTO's self-service portal.

2.9.Client – a natural person who visits the ESTO Website, has expressed a wish to create an account on the ESTO Website and (or) wishes to apply for Services provided by ESTO, or who uses or has used ESTO Services.

2.10.Client Data – any information (including personal data) that ESTO holds about the Client.

2.11.Client Relationship – the legal relationship between ESTO and the Client that arises when the Client uses ESTO Services or approaches ESTO in order to use its Services.

2.12.Service – the payment and financial services provided by ESTO to the Client. An overview of the services offered by ESTO is available on the ESTO Website.

2.13.Policy – this Privacy Policy for Clients regarding the processing of their Data.

2.14.Agreement – the agreement between ESTO and the Client, under which ESTO provides the Service to the Client.

2.15.Third Party – any natural or legal person other than the Client, ESTO, a Data Processor, or persons authorised by ESTO or a Data Processor to process Client Data.

III.General principles and Data Controller's details

3.1.ESTO processes Client Data in accordance with the GDPR, the Law on Legal Protection of Personal Data of the Republic of Lithuania, other applicable legal acts, and this Policy. The conditions for processing Client Data may also be further specified in documents related to ESTO Services and in Agreements with Clients. In the event of a conflict, priority is always given to mandatory legal provisions and to the Client's rights as a data subject.Documents and Agreements related to the Services may establish additional processing conditions, but may not restrict the protection of Client Data established in this Policy and in applicable laws.

3.2.As a licensed provider of financial services, ESTO is considered a Data Controller as defined in the General Data Protection Regulation. If you have any questions about the processing of Client Data or wish to submit a request related to Data Processing, please contact us using the details provided in Section XI of this Policy.

3.3.ESTO and its employees are obliged to protect the confidentiality of Client Data and are liable for any breach of their duties. Only appropriately trained employees may access and process Client Data. Client Data is processed only to the extent necessary to perform the assigned functions and to fulfil obligations established by law.

3.4.The provision of part of the Client Data is a requirement established by law and (or) the Agreement, or a condition for concluding the Agreement (e.g., Data for identity verification, anti-money laundering and counter-terrorist financing prevention, and creditworthiness assessment). If the Client does not provide such Data, ESTO cannot conclude the Agreement or provide the relevant Service.

IV.Types and sources of Data

4.1.ESTO processes the following Client Data:

4.2.ESTO collects Client Data from the following sources:

4.2.1.Most Client Data is provided by the Client themselves, when they create an account on the Website, submit an application for a Service, or conclude an Agreement with ESTO;

4.2.2.From a service provider to whom ESTO has, in accordance with the law, entrusted the performance of certain functions. The service provider acts as an independent Data Controller when processing Client Data and processes it in accordance with its own rules;

4.2.3.From the merchant from whom the Client has purchased goods or services, having expressed a wish to pay for them using an ESTO Service;

4.2.4.From public registers and private sources (e.g., the Residents' Register, the Register of Legal Entities, the Information System of Participants of Legal Entities, CreditInfo), as well as from banks, credit unions, and other credit and financial institutions engaged in lending and (or) financial activities;

4.2.5.From companies of the ESTO Group.

V.Purpose and legal basis of processing

5.1.ESTO provides the table below, which summarises the methods of collecting Client Data, the purposes of processing Client Data, the legal bases for processing Client Data, and matters related to the retention of Client Data.

5.1.1.Purposes of Data processing related to the creation of an account on the Website

5.1.2.Purposes of Data processing related to ordering and providing Services

5.1.3.Contacting the ESTO Customer Service Centre

VI.Automated decisions and profiling

6.1.In providing Services, ESTO uses both Client profiling and automated decision-making in order to ensure the efficient provision of Services.

6.2.Profiling – any form of automated processing of Data where the Data is used to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.

6.3.ESTO uses profiling for the following purposes:

6.3.1.To prevent fraud and reduce risk;

6.3.2.To assess risks related to compliance with anti-money laundering and counter-terrorist financing prevention requirements;

6.3.3.To assess the likelihood of insolvency;

6.3.4.To provide personalised Services, including the customisation of content and recommendations.

6.4.Automated decision – a decision made entirely without any human intervention by ESTO employees, which has a significant effect on the rights or freedoms of the Client. Automating certain decisions helps to speed up the decision-making process and make it more objective and transparent.

6.5.ESTO uses automated decisions based on the profiling of the Client for the following purposes:

6.5.1.to assess the Client's financial situation and the likelihood of insolvency;

6.5.2.to identify possible risks of fraud or money laundering.

6.6.When making automated decisions, the Client's behaviour and financial situation are assessed against typical risk behaviour models and conditions. Various factors are combined by the automated decision-making model into an overall result (score), which is used to decide whether to provide the Services and on what conditions they will be provided to the Client.

6.7.ESTO applies automated decisions in the following cases:

6.7.1.when the Service is provided to the Client on the conditions set by ESTO;

6.7.2.when a decision is made not to provide the Client with ESTO Services;

6.7.3.when it is determined that the Client's actions pose a risk of fraud;

6.7.4.when it is determined that the Client's behaviour may pose a risk of money laundering, or that the Client is included in sanctions lists.

6.8.If the automated decision made by ESTO regarding the Client is negative, the Client cannot use the ESTO Service. In order to ensure the lawfulness and soundness of its decisions, ESTO applies safeguards, including regular reviews of its models and random checks.

6.9.Automated decisions and profiling are based on the Client Data held by ESTO, collected in accordance with the conditions established in this Policy. Such automated decision-making is carried out because it is necessary for the conclusion and performance of the Agreement with the Client, and because of ESTO's legal obligation to assess creditworthiness and comply with responsible lending requirements. Pursuant to Article 22(2) of the GDPR, such decision-making is permitted because it is authorised by applicable law (point (b)) and is necessary for entering into the Agreement (point (a)). ESTO applies the safeguards set out in Section 6.10 of this Policy.

6.10.The Client has the right to obtain an explanation of automated decisions and profiling, to express their point of view, and to contest the decision made. To do so, the Client must submit an appropriate request using the ESTO contact details provided in Section XI of this Policy.

VII.Transfer of Data

7.1.ESTO may transfer Client Data to Third Parties, which may be independent Data Controllers or Data Processors authorised by ESTO.

7.2.ESTO transfers Client Data to the following Third Parties:

VIII.Transfer of Data outside the European Economic Area

8.1.As a rule, ESTO does not transfer Data outside the European Economic Area. However, where Data must be transferred by Data Processors or Third Parties, this is done only after assessing their reliability and compliance with legal requirements, and while applying appropriate safeguards.

8.2.Where Client Data is transferred outside the European Economic Area, appropriate safeguards are applied, e.g., the Data is transferred to a country in respect of which the European Commission has adopted an adequacy decision, or the Data is transferred on the basis of standard contractual clauses.

8.3.Pursuant to Article 49(1) of the General Data Protection Regulation, Data may be transferred outside the European Economic Area without safeguards where this is necessary, for example, for the performance of the Agreement between the Client and ESTO, or for the implementation of pre-contractual measures taken at the Client's request, or for the conclusion or performance of an agreement between the Client and another person, or for the establishment, exercise or defence of legal claims.

IX.Client's rights

9.1.The Client has the following rights:

9.1.1.Right of access to Data – the Client has the right to know what Data of theirs is being processed, for what purpose, to whom it is disclosed, from what sources it was obtained, how long it is retained, and what rights they have.

9.1.2.Right to rectification of Data – the Client may request the correction of inaccurate or incomplete Data.

9.1.3.Right to erasure of Data ("right to be forgotten") – in certain cases, the Client has the right to require ESTO to erase their Data, for example, if the Client has withdrawn their consent for ESTO to process the Data and there is no other legal basis for further processing, or if ESTO has processed the Data unlawfully.

9.1.4.Right to restriction of Data processing – in certain cases, the Client has the right to prohibit or restrict the processing of their Data for a certain period (e.g., if the Client has objected to the processing of Data).

9.1.5.Right to object to processing – the Client has the right to object to their Data being processed on the basis of ESTO's legitimate interest, including profiling carried out on that legal basis. Upon receipt of an objection, ESTO must stop the processing, unless ESTO can demonstrate compelling legitimate grounds which override the interests and rights of the Data Subject, or that the processing is necessary for the establishment, exercise or defence of legal claims.

9.1.6.Right to data portability – the Client has the right to receive the Data they have provided in a structured, commonly used and machine-readable format, where the processing is based on consent or on an agreement and is carried out by automated means, and to request that the Data be transmitted directly to another service provider, where technically feasible.

9.1.7.Right to withdraw consent – if the legal basis for the processing of Data is the Client's consent (e.g., for sending direct marketing communications), the Client may withdraw their consent at any time. If the Client withdraws their consent, ESTO will no longer process their Data for the purposes specified in the consent form. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

9.1.8.Right to lodge a complaint – the Client has the right to lodge a complaint with the State Data Protection Inspectorate. ESTO recommends first contacting ESTO directly so that the matter can be resolved more quickly.

9.2.In order to exercise their rights as a Data Subject, the Client may contact ESTO using the contact details provided in this Policy. ESTO shall respond to the Client's request without undue delay and in any event within 1 (one) month of receipt of the request. Taking into account the complexity and number of requests, this period may be extended by a further 2 (two) months. ESTO shall inform the Client of any such extension and the reasons for the delay within 1 (one) month of receipt of the request.

X.Amendment and application of the Policy

10.1.ESTO has the right to unilaterally amend this Policy. Amendments are announced on the Website at least 1 month before they take effect, except where the amendments relate only to changes in legislation. If new purposes require the Client's consent, Data will be processed for such purposes only after prior consent has been obtained.

10.2.The latest version of the Policy is always published on the ESTO Website at www.esto.eu.

10.3.The Policy has been drawn up in the Lithuanian language and translated into English, Estonian and Russian. In the event of a dispute, the Lithuanian-language version of the Policy shall be legally binding.

XI.Contact details

11.If the Client wishes to obtain further information about the processing of their Data, submit complaints about Data processing, or exercise their rights related to Data processing, the Client may contact ESTO using the contact details provided below.