FOR DATA PRIVACY AND FREEDOM OF INFORMATION
Yours: 29.11.2021 nr
Our: 24.01.2022 nr 2.1.-1/21/2207
Termination Of Proceedings
The Estonian Data Protection Inspectorate received a complaint:
„Complainant registered online at the company called “ ” for financial services.
Before actually using these services, complainant asked for deletion of its account and erasure of
its personal data on 15 December 2020. The erasure has been confirmed by data controller on 7
January 2021, however, data subject received an Italian and a Hungarian language newsletter
from “ ” to its registered email address on 19 January 2021 and 28 January 2021
that did not specify a particular legal person sender, which makes the erasure questionable.
Therefore complainant submitted a complaint at the Hungarian DPA on 8 February 2021
requesting an authority procedure. The mail sent by the Hungarian DPA to the Hungarian
commercial presence of specified as sender in the reply emails
sent to Complainant’s complaints – among others for the purpose of clarifying who is the data
controller for the company group – returned first as “did not seek”, and upon second attempt as
“address cannot be identified”. Therefore the Hungarian DPA reviewed the company registry and
found that the Hungarian commercial presence was deleted as of 14 April 2021. The service is still
available at website in Hungarian language ( ) and
based on the privacy policy and company chart found on that website, the company group
operating in numerous EU member states is owned 100% by the Estonian company
(new name according to online company register: ;
registered office:
which is the presumed main establishment in the EU, because according to the above available
information this entity makes the ultimate decisions is all data processing issues for the entire
company group. No Hungarian entity can be identified, who could provide further information.“
On the 17th of November 2021 the EDPI started proceedings and sent out several questions to
. On the 29th of November 2021 responded as follows:
1. Does the Hungarian office of still exist? If so, under what business
name?
„The representative office of closed down in Hungary on 14.04.2021.
The agency operated under the following name:
(registration number Cg. ).“
2. If there is no Hungarian office, what is the role of ?
„Due to the fact that has a very large number of clients residing in the
Republic of Hungary and it is important that the investment firm has a website through which it is
possible to continue to serve existing clients. The business plan of does not
envisage the admission of new Hungarian clients to the investment firm
“
3. Who is / was the controller in Hungary?
"The controller in this case is , an investment firm licensed in the United
Kingdom, because it was the person who wanted to enter into a contractual relationship with that
investment firm."
4. Why wasn’t the applicant's personal data deleted even though the deletion was confirmed?
„ confirms that the data deletion request was fulfilled on the basis of the
GDPR on 05.01.2021. We consider it important to note that the identification of the applicant was
not completed because the person had not submitted any documents that would have confirmed his
identity. In this case, the client can enter the investment environment, but they can only open a
demo account. cannot rule out that a person has registered with another name or email
and therefore received marketing communications. If a person who has not been fully identified
submits a request for deletion of personal data by e-mail, only the personal data related to the
demo account registered by e-mail from which the respective request came will be deleted.“
5. Has the applicant's personal data been deleted to date? Please issue a deletion log file
(deletion date).
„The log file is attached as Appendix 1. “
6. Why is outdated? (eg reference to ) If
any of the websites still have outdated information, it should be
updated.
„ started changing the trademark in March 2021, due to which there may be
outdated information in the translations of the websites. is actively working to keep all
websites up to date. We will make corrections to the website no
later than 10.12.2021. “
Taking into account the facts that confirmed the data deletion on the 5th of
January 2021 and the deletion of Hungarian representative Office, we are closing the proceedings.
Kind regards
lawyer
Estonian Data Protection Inspectorate
APPENDIXES
Appendix 1 – Data deletion log