Privacy Policy

LEI Universal OÜ (hereinafter “LEI Universal”) takes your privacy very seriously. This privacy policy explains what personal data we collect, how we use it and what rights you have.

We process your data in accordance with the EU General Data Protection Regulation (GDPR), the Estonian Personal Data Protection Act and other privacy laws that apply to our services, including India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

Data controller

For any privacy questions, you can contact us at the email address above.

What data we collect

We collect data both directly from you (for example, when you apply for an LEI number) and automatically when you visit our website.

• Personal data — first name and surname, email address, postal address, phone number and the history of our communication.
• Company data — the legal entity’s name, address, legal form, registration number (for example, the Corporate Identification Number (CIN) issued by the Ministry of Corporate Affairs) and information about any parent company. For LEI registration, this data is shared with the LEI issuer (LOU) and GLEIF.
• Payment data — the transaction amount and reference number. We do not store card details (such as the card number) — these are processed in a secure environment by our payment service provider.
• Technical data — IP address, browser type and version, pages visited, time of visit and other log data sent by your browser.
• Letter of Authorisation (LoA) signing data — the signatory’s first name and surname, email address and position, the electronic signature submitted, signature stroke data, the time of signing, IP address, browser information, the wording of the consent statement, the signed Letter of Authorisation and its audit log.

Why and on what legal basis we process data

We always process personal data on a legal basis. The main ones are:

• Performance of a contract (GDPR Art. 6(1)(b)) — registering, renewing and transferring LEI numbers, signing the Letter of Authorisation and communicating with clients.
• Legal obligation (GDPR Art. 6(1)(c)) — providing the data required by GLEIF and meeting accounting and tax obligations.
• Legitimate interests (GDPR Art. 6(1)(f)) — keeping our website secure, preventing fraud and improving our services.
• Consent (GDPR Art. 6(1)(a)) — the use of analytics and advertising cookies and the sending of marketing communications. You can withdraw your consent at any time.

Who we share data with

We share your data with third parties only in the cases listed below and only to the extent necessary:

• LEI issuer (LOU) — depending on the issuer responsible for the application, WM Datenservice (Germany) or RapidLEI (Ubisecure Oy, Finland). Company data and, where required, the signed Letter of Authorisation and its audit log are shared for the registration, transfer and administration of the LEI number.
• GLEIF — the foundation that administers the global LEI system (Basel, Switzerland). LEI data is published in GLEIF’s public global register.
• Payment service provider — Stripe. Transaction data is shared for payment processing.
• IT and infrastructure service providers — providers of server hosting, website analytics and customer management tools.
• Public authorities — where required by law.

Some of our service providers (for example, Stripe and Google) may process data outside the European Economic Area (EEA). In such cases, we ensure the appropriate safeguards required by the GDPR, such as the Standard Contractual Clauses approved by the European Commission.

How long we keep data

• LEI data — kept for the entire validity period of the LEI number. Data linked to an LEI number remains in the public GLEIF register permanently.
• Accounting records — 7 years, as required by the Estonian Accounting Act.
• Signed Letter of Authorisation and audit log — for as long as necessary to prove the authority to represent, perform the contract and handle any claims, taking into account the applicable limitation and retention periods.
• Client communication history — up to 3 years from the last contact.
• Contact form data — up to 1 year if no client relationship follows.
• Cookies and website logs — in line with the settings of the service concerned (Google Analytics up to 14 months, server logs up to 12 months).

Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Access your data — you can request a copy of the data we hold about you.
• Rectify your data — you can ask us to correct inaccurate data or complete incomplete data.
• Erase your data — in certain circumstances, you can ask us to delete your data.
• Restrict processing — in certain circumstances, you can ask us to restrict the processing of your data.
• Data portability — you can receive your data in a structured, commonly used format and ask for it to be sent to another controller.
• Object — you can object to the processing of your data based on legitimate interests, including direct marketing.
• Withdraw consent — you can withdraw consent you have given at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, email us at [email protected]. We will respond to your request within one month at the latest.

If you believe that your data is being processed in breach of privacy law, you have the right to lodge a complaint with a supervisory authority:

• In India — Data Protection Board of India, established under the DPDP Act, meity.gov.in.
• In Estonia — Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI), aki.ee, Tatari 39, 10134 Tallinn.

Data security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, misuse or alteration. Please note that no method of transmitting data over the internet is 100% secure.

Use of cookies

The leiuniversal.in website uses cookies — small text files that are stored on your device when you visit our website. Cookies remember your actions and preferences, which makes the website easier to use.

Types of cookies we use

• Functional cookies — needed for the website to work properly (for example, to keep your shopping cart and remember your consent choices). No consent is required for these cookies.
• Analytics cookies — help us understand how visitors use our website. We use this information to improve our services. We ask for your consent for these cookies.
• Advertising cookies — help us measure the results of our advertising campaigns, including conversions from Google Ads. We ask for your consent for these cookies.

Services that use cookies on our website

• WordPress and WooCommerce — our website and online shop platforms, which use functional cookies for core features.
• Cookie consent tool — stores your consent choices.
• Google Analytics — website analytics, used only after you have given your consent.
• Google Ads — measurement of advertising results, used only after you have given your consent.
• Stripe — a payment service provider that may use strictly necessary cookies for secure transaction processing and fraud prevention.

Managing consent

When you first visit our website, a cookie notice is shown in which you can accept or reject analytics and advertising cookies. You can change your choices at any time using the cookie settings link in the footer.

Links to other websites

Our website may contain links to other websites. We do not control third-party websites and are not responsible for their content or privacy policies.

Changes to this privacy policy

We reserve the right to update this privacy policy when necessary. We will notify you of significant changes by email or with a clearly visible notice on the website. For minor changes, we will only update the date below.