Privacy and your data
Last updated 4 October 2026 · Version 1.2 (who at VendiGroup can see your business data, section 10)
Fill in the form. We send a link to your e-mail to confirm it was you, and answer within 30 days.
1. Who we are
VendiGroup OÜ, registry code 17467908 in the Estonian Commercial Register, Tallinn, Estonia, is responsible (the controller) for the personal data described here. We run this website, a marketplace where businesses buy from and sell to each other, an online shop for consumers, and a business register with the tools our sellers and staff use.
For anything about your data, use the form above. We have not appointed a data protection officer.
2. The data we process, where it comes from, and why
Data you give us
| Who | Data | Why | Legal basis |
|---|---|---|---|
| Customers | name, e-mail, phone, delivery and invoice address; for businesses: company name, registration and VAT number, Peppol ID; orders, payments, returns; security settings (passkeys, two-step sign-in) | your account, delivering and invoicing your order, returns, keeping your account secure | contract (art. 6(1)(b)); legal obligation for accounting (art. 6(1)(c)) |
| Sellers | name, e-mail, role, sign-in history and IP addresses used to sign in | access and security | contract; legitimate interest in security (art. 6(1)(f)) |
| Sellers' tax details | legal name, address, tax identification number, VAT number, date of birth (sole traders only), bank account (encrypted) | we must report sellers' sales to the Estonian Tax and Customs Board (Council Directive 2021/514, "DAC7") | legal obligation (art. 6(1)(c)) |
| Companies' chat channels | a Signal, Threema, WhatsApp or Telegram number, username or link that a company enters itself (off unless it does) | so that companies which already do business can reach each other in the app they prefer; shown to another company only after an order, an accepted quotation or a reply; we store only the link and send nothing to these apps | legitimate interest (art. 6(1)(f)); for a private number, your own choice to add it, which you can remove at any time |
| Anyone who contacts us | name, e-mail, your message | to answer you | legitimate interest in replying (art. 6(1)(f)) |
| Employees | employment and payroll data | employment | contract; legal obligation |
Data we collect automatically
Cookies (section 9): only what sign-in, the basket, security and your language need. No advertising or analytics cookies. Security logs: IP address and browser type when you sign in, send a request, or when an automated visitor reaches the site, to stop abuse. Searches in the shops, linked to your account if you are signed in, kept 90 days to improve search.
Data from other sources: the business register
To help businesses find suppliers and customers we keep a register of companies across Europe, built from information that companies or authorities have already made public: official business registers (the national registers of the EU and EEA states, the UK's Companies House, GLEIF), companies' own websites (contact and imprint pages, read by our crawler, which respects robots.txt), trade-fair exhibitor lists, public procurement notices, product-responsibility registers, and documents companies publish such as certificates and brochures.
Most of it is about companies. Some of it is personal data: a sole trader is a person, and work contact details such as a named e-mail address can identify someone. We do not collect board members, owners or private details.
Purpose: to let businesses find and contact suitable suppliers and customers. Legal basis: our legitimate interest and that of the businesses using the register (art. 6(1)(f)). You can object at any time with the form above. When we contact a business, the first message says where we found its details and how to object.
3. Marketing e-mail
We send business offers only to business addresses, and only where the law of the recipient's country allows it; in several countries we do not write to sole traders without consent. Every message has a one-click unsubscribe, and an unsubscribed address is never written to again. Consumers receive marketing only if they have agreed to it.
4. Artificial intelligence and translation
We use AI to read company websites and documents, draft texts and translate: our own models on our own servers, Mistral AI (France) and eTranslation, the European Commission's translation service. None of them uses your data to train its models. No decision with legal or similarly significant effects is made about you by automated means alone.
5. Who receives the data
| Recipient | Role | Location |
|---|---|---|
| Hetzner Online GmbH | servers and encrypted backups | Germany and Finland |
| Scaleway SAS | sending our e-mail | France |
| Proton AG | our e-mail inboxes | Switzerland (section 6) |
| XADI (EmailConnect) | receiving replies to our e-mails | the Netherlands |
| Mistral AI | AI processing (section 4) | France |
| European Commission | eTranslation; checking VAT numbers (VIES) | EU |
| Photon / komoot | address suggestions as you type | Germany |
| Estonian Tax and Customs Board | seller reporting (DAC7) and tax | Estonia |
| Carriers and payment providers | delivering and paying for your order | as named at checkout |
| Sellers on our marketplace | the seller of what you buy receives your order and delivery details — the seller is the one who sells to you | EU |
6. Transfers outside the EU/EEA
Our e-mail inboxes are hosted by Proton AG in Switzerland. The European Commission has decided that Switzerland protects personal data adequately (Decision 2000/518/EC), so no further safeguards are needed. If we move our mailboxes to another provider, this section and section 5 are updated before the move. We transfer personal data to no other country outside the EU/EEA.
7. How long we keep data
| Data | Kept for |
|---|---|
| Invoices and accounting records | 7 years (Estonian Accounting Act § 12; VAT Directive art. 233) |
| Seller tax records (DAC7) | 10 years |
| Customer account and order history | 7 years after the last order (accounting), or until you delete the account where no order must be kept |
| Messages and support cases | 2 years after the case is closed |
| Business-register entries | while the source still publishes them; your personal details are removed when you object |
| Sign-in security records (IP address) | 12 months |
| Logs of automated visitors | 30 days |
| Your searches in the shops | 90 days |
| Requests about your rights | 5 years, to show that we answered |
| Audit log of administrative actions | 10 years |
| Backups | 50 days, plus one monthly copy kept 12 months, encrypted |
8. Your rights
You may see your data and get a copy, have wrong data corrected, have data deleted, limit how we use it, get it in a file, and object — in particular to the business register and to marketing. Use the form at the top; we answer within one month. With a customer account you can also delete the account yourself under My account. Withdrawing consent does not affect what was done before.
9. Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
_vg_jwt | keeps you signed in | 7 days |
_vg_cart_id | your basket | 7 days |
_vg_2fa, _vg_2fa_device | two-step sign-in; remembering this device if you choose to | 12 hours / 30 days |
_vg_cache_id, _vg_locale | your region and language | 24 hours / 12 months |
connect.sid, __Host-vg_2fa* | sign-in for sellers and staff | session / 12 hours / 30 days |
They are needed for the service to work, so we do not ask for consent. We use no analytics, advertising or third-party cookies.
10. Security
All traffic is encrypted (HTTPS). Bank details and two-step secrets are encrypted in the database, and backups are encrypted. Staff and sellers sign in with two-step verification, access is limited by role, and administrative actions are logged.
Who at VendiGroup can see your business data
Your company’s own data on the platform — your customers, suppliers, prices, orders, purchases, notes and the lists you import — is closed to our staff. The public company register (names, registry numbers, industries, public contact details) is not your business data and stays open.
- Only when you say so. Your administrator can give our support access under Settings → VendiGroup’s access, for 1 hour, 24 hours or 7 days. It closes by itself, and you can close it at any time.
- You see every read. Every time someone at VendiGroup opens your data, it appears in your log: who, when, what, and under which access.
- Emergencies need two people. In cases of fraud, an order from an authority or a security incident, access without your consent needs a written reason and the approval of a second person, and lasts at most 24 hours. We tell you at once, unless a law forbids it; then we tell you as soon as it no longer does.
- The same rule for everyone, our CEO included.
Systems that run without a person — billing, sanctions screening, matching — process only what their task needs, and no person reads your data through them.
11. Complaints
You can complain to the Estonian data protection authority, Andmekaitse Inspektsioon (Data Protection Inspectorate), www.aki.ee, or to the authority in your own country. We would be glad if you used the form first, so we can put it right.
12. Changes
We publish every change here and update the date at the top. If a change matters to you, we tell you before it takes effect.