Legal
Privacy policy
Last updated 10 November 2026.
In short
When you place an order, the order form collects your name, phone number and email address and the services you select. After the order, before the service, we ask by email for the further details the service needs: the identity, address and document data of the persons concerned, the details of a shareholder that is a company, and the invoice details. When you ask for a service recommendation through the Business Navigator we collect your name, email address and country of residence, your answers to the questions (a free-text description is no longer asked for since 21 October 2026; one written earlier is kept and deleted on the same terms), the wording and version of the consent you gave, the time and your IP address.
1. Controller
- Company
- LexorCorp Global OÜ
- Registry code
- 12233761
- Address
- Punane 6, Tallinn 13619, Estonia
- Licence
- FIU000117, Estonian Financial Intelligence Unit
- info@micaconsult.com
2. What we collect
When you place an order, the order form collects your name, phone number and email address and the services you select. After the order, before the service, we ask by email for the further details the service needs: the identity, address and document data of the persons concerned, the details of a shareholder that is a company, and the invoice details.
When you ask for a service recommendation through the Business Navigator we collect your name, email address and country of residence, your answers to the questions (a free-text description is no longer asked for since 21 October 2026; one written earlier is kept and deleted on the same terms), the wording and version of the consent you gave, the time and your IP address. We ask for a phone number only if you request a written offer, a PDF or a reservation. We use this to send you the recommendation you asked for and to answer you (your consent, GDPR Art. 6(1)(a)); you can withdraw the consent at any time by writing to us.
When you ask to be told about a ready-made company (the form under the list of companies for sale), we store your email address, your wishes, the language, the wording and time of your consent and a keyed hash of your IP address (only to limit abuse; the address itself is not stored). We use them only to email you the matching companies (your consent, GDPR Art. 6(1)(a)). The request ends by itself after 6 months, or at once with the link in every email; an ended request is deleted 30 days later.
When you ask us to email you your selection from the order form, we store your email address, the link of the selection, the language, the wording and time of your consent and a keyed hash of your IP address (only to limit abuse). We send that one email and nothing else (your consent, GDPR Art. 6(1)(a)); the record is deleted after 30 days.
When you ask us to remind you of a company's annual report deadline, we store the registry code of the company, your email address, the language, the wording and time of your consent and a keyed hash of your IP address (only to limit abuse). We email you 45 and 14 days before 30 June with the prices of our annual report services and nothing else (your consent, GDPR Art. 6(1)(a)); every email has a link that ends the reminder. The reminder ends by itself after 13 months and the record is deleted 30 days after it ends.
When you ask us to email you an overview from the company search, the VAT number check or the business name check, we store your email address, what you checked (the registry code, the VAT number or the name), the language, the wording and time of your consent and a keyed hash of your IP address (only to limit abuse). We send that one email and nothing else (your consent, GDPR Art. 6(1)(a)); the record is deleted after 30 days. Registry codes, VAT numbers and company names are public business data.
When you use the search of this site (the header search, the company search, the VAT number check or the name check), we store what you typed, the kind of search, its result, the services it showed, which of them you clicked and, if you then order, the order's reference — not your IP address and nothing that identifies your device. We use it to see which services the searches lead to (legitimate interest, GDPR Art. 6(1)(f)). What you typed is deleted after 90 days; only the counts stay.
Our web server keeps standard technical logs (IP address, time, requested page, browser type) for security and troubleshooting.
3. Why we use it
- To prepare and perform the services you order (contract, GDPR Art. 6(1)(b)).
- To meet our legal obligations, including customer due diligence under the Estonian Money Laundering and Terrorist Financing Prevention Act (GDPR Art. 6(1)(c)).
- To keep the website secure (legitimate interest, GDPR Art. 6(1)(f)).
4. Who receives it
Your order is delivered to us by email through our email service provider. Card payments are processed by Revolut; we do not see or store your card details. Where a service requires it, data is shared with Estonian public registers, notaries and authorities.
5. How long we keep it
Order and client data is kept for as long as the law requires, including the retention periods of the Money Laundering and Terrorist Financing Prevention Act (generally 5 years after the end of the business relationship) and accounting rules (7 years). Enquiries that lead neither to an order nor to any further correspondence are deleted once they are more than 12 months old; the deletion runs once a month. Messages that turn out to be advertising addressed to us are deleted sooner.
6. Cookies and visitor statistics
This website does not use analytics, advertising or tracking cookies. The payment page run by Revolut may set cookies needed for the payment.
If you leave your email address in the offer window, we store that address, the page and the time, and send you the one email you asked for; a link in that email lets you opt out. To avoid showing the window again, your browser keeps a single note of the date until which it stays closed (local storage, not a cookie, no identifier).
We count visits with Umami, an open-source statistics tool that runs on our own server. It sets no cookie and stores nothing on your device, does not keep your IP address and does not build a profile of you. It records only anonymous, aggregated data: the page viewed, the referring website, the country, and the type of device, browser and operating system. No data is sent to any third party, and a browser's "Do Not Track" setting is respected.
When you choose services in the order form, your selection (the services, options and listed company you chose, and the company name if you typed one) is kept for 30 days so that you can continue where you left off: in your browser (local storage) and on our server under a random session cookie (mica_sel), which is valid only for the order form's address and is used for nothing else. It holds no name, email address or other contact details and is deleted when you start over, send the order or pay. This storage is needed for the order form you use (Estonian Electronic Communications Act § 102(4)).
7. Your rights
You may request access to, correction or deletion of your data, restrict or object to processing, and receive your data in a portable format, by writing to info@micaconsult.com. You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).