Privacy Policy

Last updated: 21.05.2026

This Privacy Notice describes how the companies belonging to the Endover group (for the purposes of this Privacy Notice, Osaühing Endover, registry code 10308874, address Maakri 19/1, 10145 Tallinn, Republic of Estonia, its subsidiaries and affiliated companies operating under the ‘Endover’ brand; hereinafter we, Endover) process the personal data of potential and existing clients, persons related to them, sales contacts, website visitors and other data subjects who come into contact with Endover in the course of the provision of its services (hereinafter you). This Privacy Notice applies if you use, have used or have expressed an intention to use our services, including if you have visited our website, provided us with your email address in order to receive newsletters, or submitted an application or expression of interest for employment with us.

In the cases described, we act as the controller of your personal data and are responsible for its processing.

Collection of your personal data.

We collect your personal data in the following ways:

• you provide your personal data to us yourself (for example, by contacting us by telephone, email or through the website, through social media channels, at our office, as a result of entering into a reservation agreement with us via the website, at our client days or other public events organised by us, through other online channels, or by uploading your CV on our website);
• your personal data is provided to us by a third party (for example, a broker or where a third-party payment service provider confirms whether or not your payment was successful);
• we have collected your personal data ourselves, including automatically. In this respect, please also see our Cookie Policy.

Personal data processed.

We process the following personal data of the following categories of data subjects:

• When you subscribe to the newsletter or join the Premium Club on our website, we process data concerning your name and contact details (email).
• When you register on our website for the list of persons interested in development projects, we process data concerning your name and contact details (telephone number and email), as well as your preferences regarding the apartment ownership of interest to you (size, price).
• In the case of persons registered for and participating in our client days, we process your name and contact details (address, telephone number and email), as well as your preferences regarding the apartment ownership of interest to you (size, price).
• When entering into an agreement with us (including entering into a reservation agreement via the website), we process data concerning your name, personal identification code, contact details (address, telephone number and email) and marital status; we also process the corresponding data (except data concerning marital status) relating to your authorised representative.
• In the case of persons applying for employment with us, we process your name and contact details (address, telephone number and email), as well as data concerning your education, professional skills, previous employment and similar information.
• If you participate in our client days or other public events organised by us, we may process your image (video and photographic material).
• If you are present on the territory of our development site, at our office, in a sales area or in another area covered by video surveillance, we process your image and other personal data and activities that fall within the field of view of the video surveillance camera.

Purpose and legal basis of processing.

We process your personal data for the following purposes and on the following legal bases:

• for entering into, performing and ensuring the performance of an agreement, including entering into a reservation agreement via the website, confirming a reservation and fulfilling contractual or statutory obligations;
• on the basis of our legitimate interest, for example to contact you for marketing purposes where, on the basis of our previous contact, it may be assumed that you are interested in the relevant offer and you have not expressed dissatisfaction or objected to such contact;
• for identifying and evidencing breaches of an agreement or legislation, and for submitting or defending claims;
• for collecting website traffic data, statistics on the use of services and other technical information concerning the use of the website, with the aim of improving the website and services;
• for carrying out customer satisfaction surveys and requesting feedback, provided that you have not expressed dissatisfaction or objected to such contact;
• for complying with our statutory obligations.

Your personal data may also be processed where this is necessary in a specific case for the legitimate interests of us or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require the protection of personal data, as well as where this is necessary to protect your vital interests or those of another natural person.

As a rule, we do not process special categories of personal data. If the processing of special categories of personal data becomes exceptionally necessary, we will do so only where there is a clear legal basis for this, such as your explicit consent or a statutory obligation.

Processing based on consent.

We may also process your personal data on the basis of your consent (for example, for sending newsletters for direct marketing purposes, using certain marketing and analytics cookies, or retaining recruitment data for a longer period). If processing is based on consent, you may withdraw your consent at any time by contacting us using the contact details below or by clicking the ‘unsubscribe’ link at the end of each email. We note that withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Processors.

We use carefully selected service providers (processors) for the processing of your personal data. In doing so, we remain fully responsible for your personal data.

We use the following categories of processors: data storage service providers, email service providers, customer relationship management service providers, brokerage service providers, construction service providers, marketing service providers, payment service providers, recruitment service providers, video surveillance and security service providers.

If you would like more detailed information about our processors (for example, their names and locations), please contact us using the contact details below.

Third parties.

We share your personal data with third parties only where this is provided for in this Privacy Notice, where this is required under applicable law (for example, where we are required to share personal data with public authorities) or with your consent.

We may share your personal data with companies belonging to the Endover group, our auditors, legal advisers, notaries, banks, payment service providers and other cooperation partners to the extent necessary for entering into or performing an agreement, complying with a legal obligation or protecting our legitimate interests. We do not sell your personal data to third parties.

Transfer of personal data outside the European Economic Area.

Our processors may, in certain cases, process your personal data outside the European Economic Area, including in the United States of America. We transfer your personal data outside the European Economic Area only where we have a lawful basis for doing so and appropriate safeguards have been implemented, including where the recipient is located in a country in respect of which the European Commission has decided that an adequate level of protection of personal data is ensured, where the recipient is certified under the EU–U.S. Data Privacy Framework, or where the transfer is carried out on the basis of the European Commission’s standard contractual clauses or another safeguard provided for in the General Data Protection Regulation.

If you would like more detailed information about the transfer of your personal data outside the European Economic Area (for example, the names of the recipients and the lawful basis for the transfer), please contact us using the contact details below.

Security.

We implement technical and organisational security measures to protect your personal data, taking into account (i) the state of the art, (ii) the costs of implementation, (iii) the nature, scope, context and purposes of processing, and (iv) the risks to you. Such security measures include, among other things, access management, employee training, two-factor authentication, data encryption and backups.

Data retention.

We retain your personal data for as long as this is necessary for the purpose for which it was collected, for as long as this is necessary to protect our interests, or for as long as required by applicable legislation.

If you have entered into an agreement with us, we retain your personal data as follows:

• in accordance with Estonian accounting and tax legislation, we retain information related to accounting documents for 7 years from the end of the relevant financial year;
• in accordance with limitation periods provided for under Estonian law, we retain personal data related to contractual claims for a maximum of 10 years from the date on which the claim becomes due.

If you have registered your interest in one of our products, we retain your personal data for 5 years from the date on which we last had contact with you.

If you have participated in our client day and have not entered into any agreement with us, your personal data will be retained for 5 years from the date of the relevant client day. We retain photographic and video material recorded by us for 5 years from the recording of the relevant material, unless longer retention is necessary for the protection of legal claims or you have consented to longer use.

If you have applied for employment with us but your application is unsuccessful, we retain your personal data for up to 6 months from the end of the recruitment process, unless you have consented to the retention of the data for a longer period for future recruitment processes or longer retention is necessary for the resolution of possible claims.

Video surveillance recordings are generally retained for up to 30 days, unless it is necessary to retain a recording for a longer period due to a security incident, legal claim, proceeding or other legitimate reason.

We retain information obtained through cookies on our website in accordance with the Cookie Policy or the cookie consent manager.

Your rights.

You have all data subject rights in relation to your personal data to the extent required by applicable data protection legislation. These rights include:

• requesting access to your personal data;
• receiving a copy of your personal data;
• rectifying inaccurate or incomplete personal data;
• erasing personal data;
• restricting the processing of personal data;
• data portability;
• objecting to the processing of personal data based on legitimate interest;
• objecting to the processing of personal data for direct marketing purposes;
• withdrawing consent where processing is based on consent.

In order to exercise your rights, please contact us using the contact details below. If you believe that your rights have been infringed, you also have the right to lodge a complaint with the Estonian Data Protection Inspectorate or bring an action before a court.

Amendment of the Privacy Notice.

If our personal data processing practices change, or if we need to amend the Privacy Notice due to applicable data protection legislation, other legislation, case law or guidelines or practices issued by competent authorities, we have the right to amend the Privacy Notice unilaterally at any time. The current Privacy Notice is always available on our website. Where necessary, we will notify you of material changes by email, through the website or by another appropriate channel.

Applicable law.

As we are a company registered in the Republic of Estonia, the processing of your personal data is governed by the law of the Republic of Estonia and European Union law.

Contact details.

If you have any questions regarding the processing of your personal data or if you wish to exercise your rights as a data subject, please contact us using the following contact details: address Maakri 19/1, 10145 Tallinn, email address or telephone +372 666 0620. Estonian Data Protection Inspectorate: www.aki.ee.