Privacy Policy

Last updated: 1 November 2026

This policy explains how Buckthorn OÜ handles personal data in connection with this website (buckthorn.eu) and with enquiries sent to us.

Who we are

The controller is Buckthorn OÜ, registry code 16453040, Merekalju tn 8-4, 13521 Tallinn, Estonia. For any question about this policy or your personal data, write to info@buckthorn.eu.

We are a small practice and have not appointed a data protection officer; we are not required to.

What we collect and why

Enquiries. If you write to us, we receive your name, email address, any other contact details you give, and the content of your message and attachments. We use this to reply, to check for conflicts of interest and to decide whether we can act for you. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in answering correspondence and avoiding conflicts (Article 6(1)(f)).

Clients. If we go on to act for you, we process the data needed to provide the services, to identify the client where the law requires it (including under the Estonian Money Laundering and Terrorist Financing Prevention Act where it applies) and to invoice. The legal bases are the contract (Article 6(1)(b)) and our legal obligations (Article 6(1)(c)). The terms of the engagement letter apply in addition to this policy.

Visiting the website. Our hosting provider’s servers record technical data when the site is visited: IP address, date and time, the page requested, browser type and referring address. These logs are used to keep the site secure and working (Article 6(1)(f)). We do not use them to identify visitors.

Please do not send special categories of personal data (for example health data) or confidential information about a matter until we have confirmed that we can act for you.

Cookies

The website currently uses one cookie:

The consent tool also offers functional, analytics, performance and advertising categories, but no cookies in those categories are currently set and the site loads no analytics, advertising or social media scripts. Your consent choices may be recorded by the consent tool as proof of consent. If we add such cookies in future, we will ask for your consent first and update this table. You can change your choice at any time through the cookie settings link on the site or in your browser.

Who receives the data

We do not sell personal data. It is shared only with service providers who process it on our behalf, under data processing terms:

• the website host, Zone Media OÜ (Estonia);
• our email provider, Telia Eesti AS (Estonia);
• our accounting and IT service providers, where needed;

and, where a matter requires it, with courts, authorities, counterparties or other advisers involved in the matter, or where the law obliges us to disclose it.

Transfers outside the EEA

Some of our work involves clients and counsel in the United States. Where we transfer personal data outside the European Economic Area, we rely on an adequacy decision (such as the EU–US Data Privacy Framework for certified recipients), the European Commission’s standard contractual clauses, or, for an individual matter, the necessity of the transfer for a contract or legal claim (Article 49 GDPR).

How long we keep it

• Enquiries that do not lead to an engagement: up to 12 months after the last contact, then deleted.
• Client files: for the duration of the engagement and then for as long as needed to establish or defend legal claims, normally up to 10 years after the matter closes.
• Accounting records: 7 years, as required by the Estonian Accounting Act.
• Customer due diligence records, where required: 5 years after the end of the business relationship.
• Server logs: kept by the host for a short period, in line with its own retention policy.

Your rights

You have the right to ask for access to your personal data, and for its correction or deletion; to restrict or object to processing based on legitimate interest; to data portability; and, where processing is based on consent, to withdraw consent at any time. Some rights are limited where we must keep data by law or where it is subject to professional confidentiality. To exercise a right, write to info@buckthorn.eu. We will reply within one month.

Complaints

If you think we have not handled your data lawfully, please tell us first so we can put it right. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee, or to the supervisory authority in your own EU country.

Changes

We may update this policy. The current version is always on this page, with the date of the last update.