Privacy Notice
Last updated: 27 August 2026
1. Who we are
Expat Insurance Brokerage OÜ (registry code 17416288, registered office Tornimäe tn 5, Kesklinna linnaosa, Tallinn, Harju maakond, Estonia) operates the website expatinsurance.ee. We are the controller of the personal data described in this notice.
Contact for all privacy matters: team@expatinsurance.ee
We have not appointed a data protection officer. The nature and scale of our processing do not require one.
2. What this website does
This website provides information about Expat Insurance Brokerage OÜ and its regulatory status. It does not offer, sell, compare, or arrange insurance. It contains no forms, no login, and no online purchase functions.
The website sets no cookies and uses no tracking technologies.
3. What personal data we collect
3.1 Email correspondence
If you email us at team@expatinsurance.ee, we receive and store the personal data you include in your message. This typically means your name, your email address, and the content of your message.
3.2 Technical data from your visit
Our hosting provider records standard technical data when your browser requests a page. This includes your IP address, browser type, device type, date and time of the request, and the page requested. This data is used to deliver the website, keep it secure, and diagnose faults.
We do not combine technical data with email correspondence and we do not use it to identify individual visitors.
4. Why we process your data and on what legal basis
| Purpose | Data | Legal basis under GDPR |
|---|---|---|
| Responding to your email enquiry | Correspondence data | Article 6(1)(f), our legitimate interest in answering people who contact us |
| Operating and securing the website | Technical data | Article 6(1)(f), our legitimate interest in keeping the website available and secure |
| Complying with legal obligations | Correspondence and technical data as relevant | Article 6(1)(c), where a law requires us to retain or disclose data |
We do not process special categories of personal data through this website. If you include health or other sensitive information in an email, we will use it only to respond to you and will delete it when the correspondence ends, unless a law requires otherwise.
We do not use automated decision making or profiling.
5. Who receives your data
We share personal data only with service providers who process it on our instructions under written data processing agreements:
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Website hosting and delivery | United States |
| Google LLC (Google Workspace) | Email hosting for team@expatinsurance.ee | United States |
We do not sell personal data. We do not share personal data with advertisers.
We may disclose personal data to public authorities, courts, or regulators where a law requires it.
6. Transfers outside the European Economic Area
Vercel Inc. and Google LLC are established in the United States. Both are certified under the EU-US Data Privacy Framework, which the European Commission recognises as providing adequate protection for personal data transferred from the EU. Our Google Workspace account is protected by two-factor authentication on all user accounts and is covered by a Google Workspace Business Associate Agreement.
7. How long we keep your data
| Data | Retention |
|---|---|
| Email correspondence | 24 months after the last message in the exchange, then deleted, unless a legal obligation requires longer retention |
| Technical data | As set by our hosting provider's log retention, not exceeding 90 days |
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted where there is no overriding reason to keep it;
- restrict processing in certain circumstances;
- object to processing based on legitimate interest;
- receive your data in a portable format where processing is based on consent or contract;
- lodge a complaint with a supervisory authority.
To exercise any of these rights, email team@expatinsurance.ee. We will respond within one month. We may ask you to confirm your identity before acting on a request.
9. Supervisory authority
The Estonian supervisory authority is:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) Tatari 39, 10134 Tallinn, Estonia info@aki.ee www.aki.ee
You may also complain to the supervisory authority in the EU member state where you live or work.
10. Children
This website is not directed at people under 18 and we do not knowingly collect personal data from them.
11. Security
We use encrypted connections (HTTPS) for all traffic to this website. Access to correspondence is limited to staff who need it to respond to you. All staff accounts require two-factor authentication.
12. Changes to this notice
We may update this notice when the website or our processing changes. The date at the top shows the current version. Material changes will be flagged on this page.