Privacy policy
Last updated:
About this policy
This policy explains how Jagelski & Partners OÜ collects, uses, shares, and protects personal data when a person visits this website, uses Emma, submits written scoping information, asks for a specialist introduction, or subscribes to updates. It applies to every individual whose personal data the firm processes as a controller. It is published in compliance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus, “IKS”).
It sits alongside the Disclaimer, the Terms of service, and the Cookie policy, which together form the firm’s website legal framework.
Who is the controller
The data controller is Jagelski & Partners OÜ, an Estonian private limited company (osaühing) registered in the Estonian Commercial Register (Äriregister). Full registration details (registry code, VAT identification, registered office, and management board) are published in the Legal Notice on the Disclaimer page.
References in this policy to “the firm”, “we”, “us”, and “our” mean the data controller.
For privacy questions, requests by data subjects, and complaints, please use:
- Email: privacy@jagelski.com
- Telephone: +372 669 2066
- Postal mail: see registered office in the Legal Notice on the Disclaimer page.
Data protection officer
Privacy matters are handled by the firm’s management using the contact details above.
Personal data we collect
The firm collects different categories of personal data depending on how an individual interacts with it.
Website visitors. We process IP addresses, approximate location, device and browser information, requested and referring URLs, timestamps, cookie choices, and records of page views, interactions, errors, and security events. Hosting and security processing occurs regardless of cookie choices. Analytics and advertising services may also process online identifiers, campaign details, and page interactions, including session replays where Microsoft Clarity is enabled. Cookieless measurement still involves technical data. The tools, consent settings, and storage used are explained in the Cookie policy.
Enquiries and lead-form submissions. We collect names, email addresses, telephone numbers or messenger handles, preferred contact channels, company and role details, services and jurisdictions of interest, business activities and stage, timing, form answers, free-text notes, and other information you supply. Enquiry records can include language, approximate country, source and referring pages, campaign and advertising click identifiers, submission times, consent or contact-request records, and an assessment of the enquiry’s relevance. Current-visit referral details can accompany an enquiry regardless of cookie choices; remembering them between visits uses the marketing storage described in the Cookie policy.
Emma (AI assistant) conversations. We process and retain messages, replies, conversation history, summaries, language, timestamps, session and channel identifiers, and technical and diagnostic records. These can include personal or business information you provide. Website conversation records also include the connecting IP address; Telegram interactions include chat or account identifiers and available profile information. We use these records to answer and qualify enquiries, arrange requested introductions, review service quality, improve answers, troubleshoot failures, and prevent misuse. Relevant conversation history, instructions, retrieved information, and tool results are sent to an external AI model provider to produce replies and summaries.
Voice interactions. Calls to Emma involve processing your voice, caller number where available, call identifiers, transcribed speech, responses, and call diagnostics through telephone, speech-recognition, speech-synthesis, AI, and hosting providers. Transcripts and diagnostic logs can contain what you say, including contact details. Caller information may also form part of the AI context and an enquiry record. If you choose microphone input on the website, your browser’s speech service may process audio; the resulting text is used for search or sent to Emma.
Service review records. We retain interaction counts, response and error information, conversation outcomes, and selected questions with obvious contact details removed to assess and improve the service. Such records may remain linked to a conversation or contain information that identifies someone indirectly.
Marketing communications. Where you request updates or otherwise receive lawful business marketing, we may process your contact details, interests, preferences, and consent or opt-out records. Submitting an enquiry does not by itself amount to consent to unrelated marketing.
Prospects and introductions. For written scoping and matching, the firm may collect contact details, company and role information, services of interest, target jurisdictions, business type and stage, desired timeline, current account or company status, selected form answers, and any context the person chooses to provide. Where proportionate before an introduction, the firm may also record limited ownership, sanctions, politically-exposed-person, adverse-media, business-model, and geographic eligibility information.
Communications and matching records. The firm retains written business correspondence, enquiry summaries, internal matching notes, introduction records, and communications needed to follow up on the requested introduction. Jagelski & Partners does not host or attend calls between a prospect and an Independent Specialist and does not record their content.
Sources of data
Most personal data is provided directly by the data subject or by the business they represent. Limited technical and approximate country data may be derived from the website request. Where screening is proportionate, data may also come from third-party screening providers and public records, including commercial registers, regulator websites, and sanctions lists. An Independent Specialist may provide limited follow-up information where lawful and necessary to administer an introduction or referral arrangement.
Please provide only information relevant to your enquiry and ensure you are entitled to share information about others. Contact details and enough information to understand the request are needed to handle an enquiry or arrange an introduction; without them, we may be unable to proceed. Browsing does not require you to submit an enquiry. Do not send special-category data, such as health or biometric information, or criminal-conviction information unless specifically requested through an appropriate process. Any processing of such information requires the additional conditions imposed by Articles 9 or 10 GDPR, as applicable.
Why we use your data, and the legal basis for using it
| Purpose | Categories of data | Lawful basis |
|---|---|---|
| Responding to enquiries, preparing written scoping summaries, and related communications | Enquiry, contact, business, service-interest, and communication data | Article 6(1)(b) GDPR where necessary to take requested steps towards, or perform, a contract with the individual; Article 6(1)(f) for our legitimate interest in handling business enquiries and communicating with representatives of organisations |
| Matching prospects, sharing relevant information with the specialist network, and making requested introductions | Contact, company, role, service-interest, jurisdiction, form-answer, and communication data | Article 6(1)(b) GDPR for a requested service contracted with the individual; otherwise Article 6(1)(f) for our legitimate interest in handling the business’s requested introduction. Where a disclosure requires consent, Article 6(1)(a) |
| Sanctions, integrity, and eligibility screening before an introduction | Limited identification, ownership, geographic, and screening data | Compliance with an applicable legal obligation where one applies, and our legitimate interest in avoiding unlawful or unsuitable referrals: Article 6(1)(c) and (f) GDPR |
| Permitted direct marketing to business contacts | Contact, interest, and preference data | Consent under Article 6(1)(a) GDPR where required by electronic-communications law; otherwise Article 6(1)(f) for our legitimate interest in relevant business marketing where that law permits it. You may object to direct marketing at any time, free of charge |
| Newsletter and consent-based marketing communications | Email and preference data | Consent: Article 6(1)(a) GDPR |
| Website analytics, advertising measurement, and campaign attribution | Technical, usage, interaction, cookie, campaign, and enquiry-source data | Consent under Article 6(1)(a) GDPR for analytics and marketing cookies and associated processing; Article 6(1)(f), where permitted, for our legitimate interest in cookieless measurement of site use and of the source and effectiveness of enquiries. The Cookie policy explains the consent settings and the measurement that continues without cookies |
| Website and communications operation, security, duplicate prevention, error diagnosis, and misuse prevention | Technical and contact data, request and session identifiers, activity counters, security and diagnostic logs | Article 6(1)(f) GDPR: our legitimate interest in maintaining a reliable service, preventing duplicate processing, and protecting the firm, its providers, and users; Article 6(1)(c) where a specific legal obligation applies |
| Operating Emma across website, Telegram, and telephone channels; assessing enquiries, reviewing quality, and improving answers | Audio for speech processing, conversation content, transcripts, contact and caller data, identifiers, inferred interests, outcomes, and diagnostic records | Article 6(1)(f) GDPR: our legitimate interest in answering and qualifying enquiries, improving service quality, diagnosing failures, and preventing misuse. Enquiry handling and introductions use the bases stated above |
| Establishing, exercising, or defending legal claims | All relevant categories | Our legitimate interest, and where applicable, legal obligations: Article 6(1)(c) and (f) GDPR |
| Referral-remuneration, tax, accounting, and statutory record-keeping | Independent-Specialist contact, referral, payment, and counterparty data | Compliance with legal obligations, including the Estonian Accounting Act (Raamatupidamise seadus): Article 6(1)(c) GDPR |
Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. Where we rely on legitimate interests, the processing must be necessary and balanced against your rights and interests. You may object on grounds relating to your situation; an objection to direct marketing requires no justification.
Who we share your data with
We share personal data where necessary for the purposes and lawful bases described above. Specialist identities vary with the requested introduction and are not published on this page. Data subjects may request information about recipients, including their identities where the GDPR requires it.
The categories of recipients are:
- vetted partners in the firm’s partner network who are bound by confidentiality obligations, to identify a suitable Independent Specialist;
- the Independent Specialist selected for a requested introduction, which may include a regulated banking or payment institution, corporate formation or licensing specialist, or professional adviser;
- hosting, cloud storage, security, technical support, AI model, telephone, speech-recognition, speech-synthesis, email, messaging, and business-record service providers, acting as processors where they process data on our instructions;
- analytics and advertising-measurement providers, such as Google and Microsoft, within the cookie choices described in the Cookie policy;
- sanctions, politically-exposed-person, adverse-media, and eligibility-screening providers;
- regulatory authorities, courts, tax authorities, and law-enforcement agencies, where disclosure is required by law or by a binding order; and
- prospective acquirers and their advisers in connection with a corporate transaction involving the firm, subject to appropriate confidentiality.
Lead details and enquiry summaries may be sent through Telegram to the people handling matching and the relevant independent specialists. A summary copy may be sent to the email address you provide through an email-delivery provider. Telegram and other communication platforms also process data under their own terms and privacy policies; specialists generally act as separate controllers for their own work. Providers processing data on our instructions require the safeguards in Article 28 GDPR.
International data transfers
The firm operates internationally. Where personal data is transferred outside the European Economic Area, transfers are made on one of the following bases:
- to a country recognised by the European Commission as offering an adequate level of protection;
- under the European Commission’s Standard Contractual Clauses, supplemented where necessary by additional technical, organisational, and contractual measures, following a transfer impact assessment; or
- in the limited circumstances permitted by Article 49 GDPR, including with explicit consent where its strict conditions are met, or for the establishment, exercise, or defence of legal claims.
You may request information about the safeguards applicable to a transfer, or a copy of them, using the contact details above. Information may be redacted where permitted by law to protect the rights of others or confidential information.
How long we keep your data
We retain enquiry, lead, correspondence, and conversation records for the purposes described in this policy. Retention depends on whether an enquiry or introduction remains active, the need to administer referral relationships, the usefulness and necessity of records for quality or security review, applicable claim periods, and legal or accounting requirements. Lead records and full chat and telephone text logs have no automatic expiry; deletion is handled manually when retention is no longer justified or erasure is required by law. Cookie expiry and starting a new conversation do not delete those records.
Short-lived operational records, such as duplicate-prevention, usage and abuse-control, working conversation-history, referral-link and service-review records, are kept for periods ranging from minutes to several months, according to their function. Copies included in retained enquiry or conversation records follow the criteria above. Hosting logs and providers’ own records follow their applicable service settings and legal requirements; analytics storage is described in the Cookie policy.
Your rights
Subject to the conditions in the GDPR, every data subject has the right to:
- access their personal data and request a copy;
- request correction of inaccurate or incomplete data;
- request erasure of data that is no longer necessary or that is processed unlawfully;
- request restriction of processing in defined circumstances;
- receive certain data in a portable, machine-readable format and have it transmitted to another controller;
- object to processing carried out on the basis of legitimate interest, including direct marketing;
- withdraw consent at any time, where processing is based on consent; and
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
Automated tools assess the subject and apparent relevance of enquiries, validate contact details, detect duplicates and misuse, and adjust Emma’s replies or temporarily restrict access. These assessments may affect the detail offered or whether an automated conversation continues. They are not decisions on eligibility for a licence, bank account, or other specialist service. You can contact the firm in writing if an automated restriction prevents an enquiry. The firm does not use these tools to make solely automated decisions with legal or similarly significant effects within Article 22 GDPR.
To exercise a right, please email privacy@jagelski.com or write to the registered office. The firm responds within one month, with a possible extension of two further months for complex or numerous requests, in which case the data subject is informed of the extension and the reasons for it. The firm may need to verify identity before responding, particularly where the request relates to sensitive data.
If a data subject believes the firm has not handled personal data correctly, the data subject has the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, “AKI”):
- Address: Tatari 39, 10134 Tallinn, Estonia
- Email: info@aki.ee
- Telephone (general): +372 627 4135
- Advisory line: +372 5620 2341 (Mon to Thu, 13:00 to 16:00)
- Website: aki.ee
A data subject may also approach the supervisory authority of their EU country of residence, or take the matter to a competent court.
How we keep data secure
The firm uses technical and organisational measures appropriate to the nature of the data and the risks of processing, in accordance with Article 32 GDPR. No website or communication method can guarantee absolute security.
We use Cloudflare Turnstile to protect the contact form and Emma from automated abuse. Its processing is described in Cloudflare’s Turnstile Privacy Addendum.
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the firm notifies the Estonian Data Protection Inspectorate without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in line with Article 33 GDPR. Where the breach is likely to result in a high risk, affected data subjects are notified without undue delay under Article 34 GDPR.
Children
The website and Lead-Generation Service are intended for adults acting for business purposes. They are not offered to children. If you believe a child has provided personal data, contact us so that we can assess the appropriate action, including erasure where required.
Cookies and similar technologies
Cookies and comparable technologies on this website are described in detail in the Cookie policy, including the categories used, retention periods, third-party processors, and the mechanisms for managing or withdrawing consent.
Changes to this policy
The firm may update this policy to reflect legal, regulatory, or operational changes. The current version is published on this page, with the last-updated date shown above. Where a change requires a new lawful basis, the firm seeks consent or another appropriate basis before relying on it.
Contact
For privacy questions and rights requests:
Jagelski & Partners OÜ
Email: privacy@jagelski.com
Telephone: +372 669 2066
Registered office and registry details: see Legal Notice on the Disclaimer page.
This policy is published in English and translated for convenience into the other languages offered on this site. In the event of any discrepancy between the English text and a translation, the English text prevails.