Data protection
Last updated: 13.08.2026
This document explains how KONTABASE processes company contact data contained in the business databases we compile and used in the email marketing service. For data about our own customers and website visitors, see the Privacy Policy.
We process data in accordance with the General Data Protection Regulation (GDPR, EU 2016/679), the Data Protection Act and electronic communications rules.
1. What this document is about
KONTABASE sells business databases to entrepreneurs and offers an email marketing service. The databases consist mainly of company data (business name, registry code, field of activity, address, general contacts). Some of this data may be linked to an individual (e.g. a contact person's name or a personal email address) and is therefore considered personal data.
2. Data sources
We process data from lawful and generally public sources, including national business registers; publicly available company contact data (e.g. company websites, public directories); other lawful data sources. We do not collect or sell individuals' personal data for consumer marketing. The focus is on B2B (business-to-business) contacts.
3. What data we process
company name and registry code; field of activity, region, registration date; company contact details (general email, phone, address, website); where applicable, contact person's name and role-based email address.
4. Legal basis
4.1. For processing business contacts for B2B direct marketing, we rely on legitimate interest (GDPR Art 6(1)(f)) – our and our clients' interest in reaching entrepreneurs with relevant business offers. 4.2. We have weighed the legitimate interest against the rights and interests of data subjects (balancing test). Since we process mainly business-related contact data and always offer the possibility to object, we consider that the processing does not disproportionately harm the rights of data subjects. 4.3. Where legislation requires consent in a specific case (e.g. for sending certain types of electronic marketing messages), we process the data on the basis of such consent.
5. Purposes of processing
compiling and delivering business databases to clients; providing the email marketing service (sending marketing messages on behalf of clients); keeping data up to date and ensuring quality; managing opt-out requests.
6. Roles: controller and processor
6.1. When collecting data and compiling the database, KONTABASE acts as the controller. 6.2. When the database is delivered to the client, the client becomes an independent controller for the received data and is responsible for its further lawful use (see Terms of Use, clause 9). 6.3. In the email marketing service, where KONTABASE sends messages according to the client's instructions and for the client's campaign, KONTABASE generally acts as the client's processor and the client is the controller. In that case, the relationship is governed by a data processing agreement.
7. Transfer of data to clients
7.1. The client receives the data for use in its own business activity in accordance with the Terms of Use. 7.2. The client undertakes to process the data in accordance with the GDPR, including: having a lawful basis for processing; informing data subjects about its data processing where required by law; providing an opt-out from direct marketing in every message; respecting the rights of data subjects.
8. Data subject rights
Every individual whose data we process has the right to: receive information about the processing of their data; access their data; request correction of inaccurate data; request erasure of data; restrict processing; object to direct marketing at any time – in which case we will immediately stop using the person's data for marketing. To exercise your rights or have your data removed (opt-out), contact: info@kontabase.ee.
9. Objection and opt-out
9.1. If you do not want your or your company's contact data to be used in our marketing or sold in databases, notify us at info@kontabase.ee and we will remove the data. 9.2. Every marketing message we send includes a simple opt-out option. 9.3. We maintain a record of opt-out requests (suppression list) to prevent further messages from being sent.
10. Retention and updating
We retain data for as long as is necessary to provide the service and keep the database up to date. We update data regularly from public sources. We retain opt-out requests for as long as is necessary to ensure they are honoured.
11. Security measures
We apply reasonable technical and organisational measures to protect data against unauthorised access, alteration and disclosure, including access restrictions, secure storage and the use of trusted service providers.
12. Contact and complaints
For data protection matters: Kliima Eksperdid24 OÜ. Email: info@kontabase.ee. Address: Pirni 12, Tallinn.