Last updated: 6 October 2026
1. Overview
This Privacy Policy & Cookie Policy explains how LEI System OÜ ("LEI System", "we", "us" or "our") collects, uses, shares and safeguards personal data, and how we use cookies and similar technologies on leisystem.com and all of its country-specific and language-specific websites (together, the "Websites").
This Policy applies to all Websites operated by LEI System, regardless of the country domain or language version through which you access our services.
LEI System processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection and privacy laws.
The data controller is:
LEI System OÜ
A. H. Tammsaare tee 60
11316 Tallinn, Estonia
Estonian Commercial Register number: 16966880
Email: support@leisystem.com
2. Personal Data We Process
Depending on how you interact with us, we may process the following personal data:
- your name and contact details, such as email address, telephone number and postal address;
- information about your relationship with, or authority to represent, a legal entity;
- information provided when registering, renewing or transferring an LEI;
- order, transaction and payment-related information;
- communications with LEI System;
- technical information, such as IP address, browser and device information;
- website usage, advertising and conversion information; and
- other information you provide directly to us.
We do not intentionally collect more personal data than is reasonably necessary for the relevant purpose.
2.1 Sources of Personal Data
We collect most personal data directly from you. Where an order is placed on behalf of a legal entity, personal data about directors, authorised representatives or other connected persons may be provided by the person placing the order or obtained from public business registers and other official sources used for LEI validation.
2.2 Whether You Must Provide Personal Data
Providing personal data is generally voluntary. However, certain information is required to register, renew or transfer an LEI, to process payments and to comply with our legal obligations. If you do not provide this information, we may be unable to provide the requested service.
3. Purposes and Legal Bases for Processing
3.1 Providing LEI Services
We process personal data where necessary to provide LEI registration, renewal, transfer and related services, administer orders, communicate with customers and representatives, and provide customer support.
Depending on the circumstances, the legal basis is the performance of a contract or taking steps prior to entering into a contract (GDPR Article 6(1)(b)), our legitimate interests in providing and administering our services (GDPR Article 6(1)(f)), or compliance with a legal obligation (GDPR Article 6(1)(c)).
3.2 Legal Entity Representatives
Where an order is placed on behalf of a legal entity, we may process personal data relating to directors, authorised representatives, employees, agents or other persons connected with that entity.
We process such information where necessary for the provision and validation of LEI services and for our legitimate interests in verifying authority, administering the customer relationship and ensuring the accuracy and integrity of LEI-related information.
3.3 Customer Communications and Marketing
We use your contact details to communicate with you about your orders, LEI status, renewals, service-related matters and other information relevant to the services you use.
Where permitted by applicable law, we may also send information about our services and related offers. We rely on consent where consent is required and, where legally permitted, on our legitimate interests in communicating with existing customers about similar services.
You may opt out of direct marketing communications at any time, free of charge, by using the unsubscribe link in our messages or by contacting us.
3.4 Service Providers and Partners
We do not sell personal data.
Where personal data is shared with a business partner or service provider, we do so only where there is an appropriate legal basis and where the sharing is reasonably necessary for the relevant purpose.
3.5 Compliance, Security and Legal Obligations
We may process personal data to:
- comply with accounting, tax and other legal obligations;
- respond to lawful requests from public authorities;
- comply with applicable sanctions, anti-money laundering or other regulatory requirements;
- prevent fraud, misuse and security incidents;
- establish, exercise or defend legal claims; and
- protect our rights, customers and services.
The legal basis is compliance with legal obligations (GDPR Article 6(1)(c)) and, where applicable, our legitimate interests (GDPR Article 6(1)(f)).
4. LEI Data and Third-Party Data Sharing
To issue, renew, transfer and maintain LEIs, we share relevant legal entity information with our accredited Local Operating Unit partner, Ubisecure Oy (RapidLEI), and through it with the Global Legal Entity Identifier Foundation (GLEIF).
This may include the legal entity name, registration number, registered address, incorporation details, ownership or relationship information and other information required for LEI validation and issuance.
LEI reference data is published in the Global LEI System and is publicly accessible in accordance with the rules applicable to the LEI system.
We also use service providers that support our Websites, IT infrastructure, payments, customer support, communications, analytics, advertising and other business operations. These providers receive personal data only to the extent necessary for the relevant service and subject to applicable data protection requirements.
5. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected and as required by applicable law.
Customer and service-related data is retained for the duration of the customer relationship and afterwards where necessary for legal, accounting, dispute-resolution or legitimate business purposes.
Accounting and financial records are retained for the period required by law, currently seven years under the Estonian Accounting Act.
Where processing is based on consent, the relevant data is processed until consent is withdrawn, unless another legal basis requires or permits further retention.
6. International Data Transfers
Personal data is primarily processed within the European Economic Area (EEA).
Some of our service providers, including Google, Microsoft and Hotjar, may process data outside the EEA. Where personal data is transferred to a country that is not recognised as providing an adequate level of protection, we rely on safeguards required by applicable data protection law, such as European Commission adequacy decisions (including the EU-U.S. Data Privacy Framework for certified recipients), Standard Contractual Clauses or other recognised transfer mechanisms.
7. Your Data Protection Rights
Subject to the conditions and limitations provided by applicable law, you have the right to:
- access personal data we hold about you;
- request correction of inaccurate or incomplete personal data;
- request deletion of personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- object to direct marketing at any time;
- withdraw consent at any time where processing is based on consent; and
- request data portability where applicable.
To exercise your rights, contact us at support@leisystem.com. We respond within one month of receiving your request, unless applicable law allows an extension.
8. Complaints and Automated Decision-Making
You have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or with the data protection supervisory authority in your country of residence, place of work or place of the alleged infringement.
We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning you.
9. Cookies and Similar Technologies
Cookies are small files stored in your browser or on your device when you visit a website. They can enable essential website functionality, remember preferences, help us understand how a website is used and measure advertising performance.
We also use technologies that perform similar functions, including browser storage, pixels, tags and identifiers.
Session cookies expire when you close your browser. Persistent cookies remain on your device for a defined period or until you delete them. First-party cookies are set through our own domain; third-party cookies are set or accessed by external service providers.
10. Categories of Technologies We Use
10.1 Strictly Necessary Technologies
These technologies are required for the operation, security and essential functionality of our Websites. They are used, for example, to maintain secure sessions, process transactions, prevent fraud and abuse, remember your privacy and cookie choices, and provide functionality you have requested, such as the country, language and currency you have selected.
Where legally permitted, these technologies are used without consent because they are necessary to provide the service you have requested.
10.2 Analytics Technologies
With your consent, we use Google Analytics 4 ("GA4"), provided by Google, to understand how visitors use our Websites and to improve our services.
GA4 may process information such as pages visited, interactions and events, approximate location, browser and device information, referring website or traffic source, session information, cookie and device identifiers, and information about completed transactions or other conversion events.
10.3 Advertising and Conversion Measurement Technologies
With your consent, we use Google Ads to measure the effectiveness of our advertising campaigns.
Google Ads technologies may process advertising click identifiers, information about the advertisements that led you to our Websites, website interactions, conversion events, browser and device information, IP address and approximate location, and cookie or device identifiers.
These technologies help us determine whether advertising resulted in actions such as an LEI registration, renewal, transfer or enquiry. We use remarketing or personalised advertising only if you have consented to it.
10.4 Product Analytics and Session Analysis
With your consent, we use Microsoft Clarity, provided by Microsoft, and Hotjar, provided by Hotjar Ltd, to understand how our Websites are actually used and where visitors encounter difficulty.
These tools record how a page is used during a visit. They may process information such as pages visited, clicks, scrolling, mouse movement, taps and other interactions, the order in which pages are viewed, approximate location, browser, device and screen information, referring website, and a randomly generated identifier that allows separate visits by the same browser to be recognised. This information may be presented as a recording of the visit or as aggregated heatmaps.
Both tools suppress the content of form fields by default. We do not use them to read what you type, to build profiles of individual visitors, or for advertising.
11. Enhanced Conversions and User-Provided Data
Where you have given the required consent, we use Google's Enhanced Conversions and user-provided data functionality to improve conversion measurement.
When you submit an application, complete an order or submit another eligible form, the following information may be used for this purpose: your email address and your telephone number.
This information is normalised and converted using a secure one-way hashing algorithm (SHA-256) before transmission to Google, so that it never leaves your browser in readable form. Google may compare the hashed information with information associated with signed-in Google accounts to determine whether a conversion on our Websites can be attributed to an interaction with our advertising.
We use this functionality only for advertising measurement, conversion attribution and improving the accuracy of campaign performance measurement.
We do not send names, postal addresses, payment card information, passwords, government identification numbers or other sensitive credentials to Google through Enhanced Conversions.
12. Google Consent Mode
We use Google Consent Mode to communicate your privacy choices to Google services. This includes consent signals for analytics storage, advertising storage, advertising user data and advertising personalisation.
If you do not consent to a category, Google tags do not set or read cookies for that purpose. Depending on our Consent Mode configuration, Google may receive limited cookieless signals, such as consent status and basic technical information, for aggregated measurement and modelling.
User-provided data for Enhanced Conversions is not sent where consent for advertising user data has not been granted.
13. Google as a Service Provider
Depending on the service, our configuration and your privacy choices, Google may receive your IP address, website URL, browser and device information, advertising and cookie identifiers, website activity and conversion information. Where Enhanced Conversions is enabled with your consent, Google may also receive hashed customer information as described in section 11.
Google processes this information under the contractual terms applicable to the Google services we use and in accordance with its own privacy documentation, available at policies.google.com/privacy.
14. Cookies Currently Used
The exact cookies used may vary according to your device, browser, location, consent choices and the services active on the Website you visit. Typical cookies include:
| Cookie | Provider | Purpose | Type | Typical lifetime |
|---|---|---|---|---|
| site_consent | LEI System | Stores your cookie choices | Strictly necessary, first-party | 6 months |
| site_host | LEI System | Remembers which of our Websites you are using | Strictly necessary, first-party | 12 months |
| site_jurisdiction | LEI System | Remembers the jurisdiction you selected | Strictly necessary, first-party | 12 months |
| site_lang | LEI System | Remembers the language you selected | Strictly necessary, first-party | 12 months |
| site_currency | LEI System | Remembers the currency you selected | Strictly necessary, first-party | 12 months |
| lei_ref, lei_origin | LEI System | Record which partner or referral an order belongs to, so that orders are attributed and commissions paid correctly. Not used for advertising or profiling. | Strictly necessary, first-party | 30 days |
| lei_customer_session | LEI System | Keeps you signed in to your customer account | Strictly necessary, first-party | 30 days |
| lei_oauth_state | LEI System | Protects sign-in with Google, Apple or Facebook against cross-site request forgery | Strictly necessary, first-party | 10 minutes |
| _ga | Google Analytics | Distinguishes website users | Analytics, first-party | Up to 2 years |
| _ga_<ID> | Google Analytics | Maintains session state | Analytics, first-party | Up to 2 years |
| _clck | Microsoft Clarity | Recognises separate visits by the same browser for usage analysis | Analytics, first-party | Up to 1 year |
| _hjSessionUser_<ID> | Hotjar | Recognises separate visits by the same browser for usage analysis | Analytics, first-party | Up to 1 year |
| _gcl_au | Google Ads / Google tag | Supports advertising conversion attribution | Advertising, first-party | 90 days |
Microsoft Clarity and Hotjar may set additional cookies of their own during a visit. Your browser's settings show the full list of cookies stored for this Website at any moment.
15. Managing Your Cookie Choices
You can accept or reject optional technologies, select individual categories, or change or withdraw your consent at any time by reopening the cookie management tool through the Cookie Settings link on our Websites.
Withdrawing consent does not affect processing that took place lawfully before consent was withdrawn.
You can also configure your browser to delete or block cookies. Browser-level restrictions may affect the operation of certain website features.
16. Region-Specific Information
This Policy applies to users of all our Websites worldwide. As LEI System is established in the European Union, we process personal data in accordance with the GDPR where it applies to our processing activities. Where the law of your country gives you additional rights, those rights also apply.
16.1 United Kingdom
If you are located in the United Kingdom, we process your personal data in accordance with the UK GDPR and the Data Protection Act 2018. You have the rights described in section 7 and may lodge a complaint with the Information Commissioner's Office (ico.org.uk).
16.2 Switzerland
If you are located in Switzerland, we process your personal data in accordance with the Swiss Federal Act on Data Protection (FADP). You have the rights described in section 7 and may lodge a complaint with the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
16.3 Other Countries
If you are located outside the EEA, the United Kingdom and Switzerland, you may have rights under your local data protection law, such as rights to access, correct or delete your personal data, or to withdraw consent. You can exercise these rights by contacting us at support@leisystem.com, and you may also contact the data protection authority in your country.
By using our services, your personal data will be processed in the European Union and, where described in section 6, in other countries.
17. Language Versions
This Policy may be made available in several languages. In the event of any inconsistency between language versions, the English version prevails.
18. Updates to this Policy
We may update this Policy when our services, Websites, technologies, service providers or legal requirements change. The date at the beginning of this Policy shows when it was last updated. Material changes will be reflected in the version published on our Websites.
19. Contact
For questions about this Policy, the processing of your personal data, cookies or tracking technologies, or to exercise your rights, please contact:
LEI System OÜ
A. H. Tammsaare tee 60
11316 Tallinn, Estonia
Estonian Commercial Register number: 16966880
Email: support@leisystem.com