Last updated: 18.10.2026
This Privacy Policy explains how AnsonBaer Nordic OÜ (“we”, “us”) collects and uses personal data when we provide accounting, legal consulting and business consulting services, when you visit our website, and when you otherwise contact us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.
AnsonBaer Nordic OÜ, registry code 11365489, registered address Kentmanni 4, Tallinn 10116, Estonia.
Email: [email protected] · Phone: +372 53444518
We have not appointed a Data Protection Officer, as this is not required for our activities. Questions about personal data can be sent to the contact details above.
As a controller, we decide why and how personal data is used. This applies to data we use for our own purposes, such as managing our client relationships, anti-money-laundering checks, invoicing, recruitment, marketing and website operation.
As a processor, we process personal data on behalf of and on the instructions of our clients, for example when we handle payroll or bookkeeping that includes data about a client’s employees, customers or suppliers. In that case the client is the controller and is responsible for informing the individuals concerned. If you want to exercise your rights regarding such data, please contact the relevant client first; we will assist them as required.
We do not intentionally process special categories of personal data (for example health data) or data about criminal offences, and we ask you not to send us such data unless it is necessary for the engagement. Where such data is nevertheless contained in documents or required by law (for example in anti-money-laundering checks), we process it only to the extent necessary and with restricted access. We process personal identification codes only where a legal basis exists, for example for tax reporting, contracts and legally required identification.
| Purpose | Legal basis |
|---|---|
| Entering into and performing client contracts; providing accounting, legal and business consulting services | Performance of a contract (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f)) |
| Identifying clients and beneficial owners, risk assessment, sanctions and politically exposed person screening, reporting to authorities | Legal obligation (Art. 6(1)(c)), in particular the Money Laundering and Terrorist Financing Prevention Act |
| Keeping accounting records, tax reporting, responding to authority requests | Legal obligation (Art. 6(1)(c)), in particular the Accounting Act and tax legislation |
| Invoicing, payments and debt collection | Performance of a contract; legal obligation; legitimate interests |
| Establishing, exercising or defending legal claims | Legitimate interests (Art. 6(1)(f)) |
| Answering enquiries sent through the website, email or phone | Legitimate interests; steps prior to entering into a contract (Art. 6(1)(b)) |
| Recruitment | Steps prior to entering into a contract; consent if we keep your application for future vacancies |
| Newsletters and marketing messages | Consent (Art. 6(1)(a)); for existing clients, legitimate interests in informing them about similar services, with an opt-out in every message |
| Website analytics and non-essential cookies | Consent (Art. 6(1)(a)) |
| IT security, backups and preventing misuse of our systems | Legitimate interests; legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights and interests. You may ask us for more information on this assessment. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.
Mostly directly from you or from the client you represent. We also obtain data from public registers (for example the Estonian Business Register and the beneficial owners register), sanctions lists and, for our clients’ engagements, from our clients and their advisers, banks and authorities.
We share personal data only where necessary and only the data needed:
We do not sell personal data.
Some of our service providers are located in, or have operations in, the United States. We transfer personal data to such providers only where an appropriate safeguard under the GDPR applies: either the provider is certified under the EU–US Data Privacy Framework, which is recognised by the European Commission as providing an adequate level of protection, or we have concluded the European Commission’s Standard Contractual Clauses with the provider and, where needed, applied additional safeguards. You can request information about the safeguards we use by contacting us.
We keep personal data only as long as necessary for the purposes described above or as required by law. After that, data is deleted or irreversibly anonymised.
| Data | Retention period |
|---|---|
| Accounting source documents, ledgers and related records | 7 years from the end of the financial year in which the transaction was recorded (Accounting Act) |
| Client identification and due diligence data, and documents related to the business relationship, under anti-money-laundering rules | 5 years from the end of the business relationship |
| Engagement files, contracts and correspondence with clients | 3 years from the end of the engagement (general limitation period for claims), or longer where a legal obligation or a longer limitation period applies |
| Enquiries from people who do not become clients | 1 year from the last contact |
| Unsuccessful job applications | 6 months after the recruitment ends; longer only with your consent |
| Newsletter subscriptions | Until you withdraw consent or unsubscribe, or after 2 years of inactivity |
| Website and cookie data | As stated in our Cookie Policy |
| Records of data subject requests and security incidents | 3 years |
You have the right to:
To exercise your rights, write to [email protected]. We may ask you to verify your identity. We respond within one month; for complex or numerous requests this may be extended by up to two further months, and we will tell you if so. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive. Some rights may be limited where we are required by law to keep or disclose data, or where this is necessary to protect the rights of others or our professional confidentiality obligations.
We protect personal data with appropriate technical and organisational measures, including access controls limited to staff who need the data, encryption, secure backups, and confidentiality undertakings for everyone working with client information. Our staff are bound by confidentiality obligations that continue after their employment ends. If a personal data breach occurs that is likely to result in a risk to individuals, we notify the Estonian Data Protection Inspectorate within 72 hours, and, where the risk is high, the individuals concerned without undue delay.
Our website uses cookies. Strictly necessary cookies are used without consent; analytics, marketing and other non-essential cookies are used only if you accept them in the cookie banner, and you can change your choice at any time. For details, see our Cookie Policy. We send marketing emails only with your consent or, to existing clients, about similar services, and you can unsubscribe at any time using the link in each message or by writing to us.
If you have a question or concern, please contact us first at [email protected]. You also have the right to lodge a complaint with the supervisory authority:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39, 10134 Tallinn, Estonia
Phone: +372 627 4135 · Email: [email protected] · www.aki.ee
We review this policy regularly and update it when our activities or the law change. The current version is always available on this page, with the date of the latest update at the top.
