Privacy Note

This privacy notification describes how OÜ Metropoli Ehitus, registry code 12765305, address Tartu Road 2, 10145 Tallinn, Republic of Estonia; hereinafter we or Metropoli) processes the personal data of potential and existing clients (contractual customers) and other persons associated with them, cooperation partners, website users and other data subjects with whom Metropoli comes into contact when providing services to them (hereinafter you). This privacy notification is applicable whenever you use or have used or have expressed the intent to use our services, including visiting our website, providing us with your data.

In the above cases we are the controller responsible for processing your personal data.

Collection of personal data. We collect your personal data in the following ways:

  • your personal data that you yourself have transmitted to us (for example, when contacting us by phone or e-mail or via our website, at our office)
  • your personal data transmitted to us by a third party (for example, a broker with whom you have made an agreement to obtain property)
  • your personal data we have collected ourselves, including by automatic means. Read also our Cookies Policy.

Processing of personal data. We process the following kinds of personal data:

  • When making an agreement with us, your or your authorized representative’s name, personal ID code, birth time and contact information (address, phone and e-mail address); in some cases we also process information regarding your or your authorized representative’s position
  • When conducting after service works (incl. transferring data via webpage), your name and contact information (address, phone and e-mail) and the data concerning the property you either use or own
  • When visiting our development sites, images of you as well as all other kinds of personal data and activities visible in the area under video surveillance.
  • When applying for a vacancy, your name, contact information (address, phone and e-mail address) and information regarding your education, professional skills, professional history, etc.

Purpose of and legal basis for processing. We process your personal data for the following purposes and we have the following legal basis for processing it:

  • to make an agreement with you or to fulfil an agreement made with you;
  • our legitimate interest, for example:
    • to contact you and to provide after service works,
    • to ensure that an agreement made with you is fulfilled, including the identification of a violation of an agreement or applicable law, proving it and lodging a claim. If you have violated an agreement or applicable law, your interests or rights do not outweigh our legitimate interest.
    • to collect information on our website traffic, service usage statistics and other non-personalized technical information on our website usage in order to improve our website and services;
    • to contact you to request feedback on our products and services in order to be able to conduct customer satisfaction surveys, provided that you have not expressed discontent with or objected to such contact.
  • to fulfil our legal obligations.

We may also process your personal data when, under specific circumstances, it is necessary for the purposes of our or third-party legitimate interest, except when such interest is outweighed by your interests or fundamental rights and freedoms with regard to the protection of personal data as well as under circumstances in which it is necessary to protect your vital interests or those of any other natural person.

We do not process special categories of personal data.

Processing on the basis of your consent. We can process your personal data on the basis of your consent. When processing is based on your consent, you can withdraw your consent at any time by using the contact information below. Please keep in mind that the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Authorized processors. To process your personal data, we rely on carefully selected service providers (authorized processors). However, it is still us who are fully responsible for your personal data.

We use processors in the following areas: providers of construction service, data storage, e-mail, customer relationship management, job placement services.

For further information on processors (e.g. their names and addresses), please contact us using the information below.

Third parties. We share your personal data with third parties only for the purposes established in this privacy notification, when this is required by applicable law (for example, when we are obliged to share personal data with authorities) or with your consent.

We can share your personal data with OÜ Endover KVB, registry code 10308874, or with other business entities functioning under the “Endover” brand, our auditors and legal consultants. Legitimate basis for such sharing is our relevant legal obligation or legitimate interest.

Personal data transfer outside the EU. Our authorized processors may process your personal data outside the EU (including in the US). We transfer your personal data outside the EU only when we have a legitimate basis for doing so, including to data recipients: i) who are located in countries which, according to the Commission’s evaluation, offer an adequate level of data protection (includes Privacy Shield-certified organisations); or ii) under an agreement which complies with EU requirements on personal data transfer to processors not established in the EU.

For further information on personal data transfer outside the EU (for example, processors’ names and legal basis for transfer), contact us using the information below.

Data security. We implement technical and organizational security measures to protect your data, taking into account (i) technological developments, (ii) the cost of implementation, (iii) the nature, scope, context and purposes of processing, and (iv) risks to you. Such security measures include, among others, data access management, employee training, two-factor authentication and data encryption.

Data storage. We store your personal data for as long as necessary to achieve the purposes for which it is collected, to protect our interests or to comply with applicable law.

If you have made an agreement with us, we store the following personal data:

  • according to Estonian accounting and tax laws, we store information regarding accounting documents for 7 years from the end of the relevant financial year;
  • according to limitation periods established in Estonian laws, we store personal data regarding contractual claims for up to 10 years from the date a claim becomes chargeable.

If you have unsuccessfully applied for a vacancy with us, we store your personal data for 1 month after officially filling the position you applied for. On the basis of your separate consent, we store relevant data for up to 6 months from the end of the recruitment process. If you have provided us with your contact information and uploaded your CV on our website, we store your personal data for up to 6 months after making it available to us.

Photo and video imagery recorded by us is stored for 7 years after recording them.

Data collected by cookies used on our website is stored according to the provisions of our Cookies Policy.

Your rights. Concerning your personal data, you are granted all rights held by data subjects to the extent compatible with applicable data protection laws. Regarding your personal data, these include the right to:

  • request access to your personal data;
  • obtain a copy of your personal data;
  • rectification of inaccurate or incomplete personal data;
  • erasure;
  • restriction of processing;
  • data portability;
  • objecting to the processing of personal data based on legitimate interest.

To exercise your rights, contact us using the information below.

If you believe that your rights have been violated, file a complaint with the Estonian Data Protection Inspectorate or take legal action.

Changes to the privacy notification. When the need arises to make changes to our data processing policy or the privacy notification due to applicable data protection laws, other legislation, case law or guidelines or regulations issued by competent authorities, we have the right to make changes to the privacy notification unilaterally and at any time. In this case we will inform you within a reasonable period of time before the changes enter into force.

Applicable law. Because our company is registered in the Republic of Estonia, the processing of your personal data is governed by Estonian law.

Contact information. If you have any questions about the processing of your personal data or if you seek to exercise the rights you have as a data subject, please contact us by visiting our office at Tartu Road 2, Tallinn 10145, e-mailing us at or calling us at +372 666 0620.