Data Retention Principles and Periods
Inforegister • Storybook • 1Contact • Kreedix
This guide explains how long and why business information, business-related personal data, customer and contract documents, and technical data are retained. For business history, a distinction is made between the publicly accessible and reviewable history of an active entrepreneur and the situation where a person no longer has any active business relationships.
Comprehensive overview of services and solutions for companies: https://voimalused.inforegister.ee/
1. Core retention principles
- Purpose limitation: Every data category must have a reason for retention. Data is not retained merely because it once entered the system.
- Data minimisation: We retain the data necessary to identify a person and a company correctly, preserve business history, provide services, assess risks, fulfil contractual obligations, or protect rights.
- Accuracy and currency: Data concerning active business relationships is updated on the basis of source registers and other lawful sources. Historical data is not converted into “current” information; it is treated as historical business information.
- Storage limitation: When a specific processing purpose ends and there is no new or continuing legal basis, retention of data in personally identifiable form is discontinued.
- Security: Retained data is protected by access controls, authentication, logging, backups, and other technical and organisational measures.
2. Retention periods by data type
The table below describes the main retention periods and the rationale behind them. Where several legal grounds apply to the same data, the longer lawful retention need is applied.
| Data category | Retention period | Reason / legal basis |
|---|---|---|
| Active management board, shareholder, beneficial-owner or other business relationship | For the entire duration of the active relationship | Keeping business information current, correctly linking the person and the company, and enabling assessment of business history and management patterns. If a person has at least one active business relationship, their earlier business relationships are also retained as historical background without a separate five-year visibility limit. |
| Historical business relationships where the person no longer has any active business relationship | Public search discoverability is discontinued; historical information remains in the historical view for logged-in users. Further restriction of visibility is generally assessed after 5 years have passed since the relevant management board role ended. | Preserving business history, covering the period relevant to potential legal claims and management liability, and preserving the historical context of business and payment behaviour. Under § 187(4) of the Estonian Commercial Code, the limitation period for a claim against a management board member is five years. |
| Source accounting documents | 7 years from the end of the financial year in which the document was recorded in the accounts | § 12 of the Accounting Act. |
| Accounting registers, contracts and other business documents evidencing transactions | 7 years from the end of the relevant financial year | § 12 of the Accounting Act. |
| Business documents relating to long-term obligations or rights | 7 years after the end of their period of validity | § 12 of the Accounting Act. |
| Contact and service data required for a customer or contractual relationship | For the duration of the contract or customer relationship and thereafter for as long as necessary for legal claims, accounting, or other obligations | Performance of a contract, legitimate interests, protection of legal claims, and statutory obligations. |
| Data-protection and customer-support correspondence | For as long as the request is being handled and thereafter for as long as necessary to evidence the response, actions taken, and legal claims | Demonstrating accountability, resolving potential disputes, and protecting rights. |
| Technical logs and security-event data | According to the documented technical retention schedule; only for as long as required for security and incident analysis | Information-system security, prevention of misuse, incident analysis, and auditability. |
| Backups | For the duration of the backup and recovery cycle; expired copies are replaced or deleted in accordance with the backup policy | Service resilience and recoverability. A backup is not a separate public data product and is not used for a new purpose. |
| Debt-collection or claims-management data in Kreedix | For the duration of the proceedings and thereafter for as long as necessary to manage the claim, payments, evidence, and potential legal claims | Claims handling, contractual and legitimate interests, protection of legal claims, and, where applicable, statutory obligations. |
3. Business history: why is an ended role not deleted immediately?
The end of a business role means that the role is no longer active. It does not mean that the historical fact becomes inaccurate or loses its economic relevance.
If a person remains active in at least one company as a management board member, shareholder, beneficial owner, or in another business-related role, their previous business relationships are retained as historical background. No separate five-year visibility limit applies to that history while the person has an active business relationship.
The reason is the need to assess an entrepreneur’s management and payment-behaviour patterns over time, rather than only their current situation. Companies can be established, terminated, enter bankruptcy proceedings, or be removed from the register at different times, and a single current company record does not always provide a sufficient picture of business risk or past management behaviour.
Historical information makes it possible, for example, to verify which companies a person has previously been connected with, when roles began and ended, and how those companies performed during the relevant periods. Company credit, payment and risk indicators remain indicators of the company; the purpose of historical relationships is not to assign a separate personal credit score to the natural person.
If a person no longer has any active business relationship, their historical personal profile is not normally discoverable through search engines. Historical information remains available for review to a logged-in user in the historical view.
After a management board role ends, a five-year period is relevant, among other things, in relation to potential legal claims and management liability. Under § 187(4) of the Estonian Commercial Code, the limitation period for a claim against a member of the management board is five years. After that period, further restriction of the visibility of a historical relationship may be assessed where the person has no active business relationship and there is no other continuing legal or business-information purpose.
4. Public registers, business information and retention
Inforegister and related services use, among other sources, data from the Estonian e-Business Register and other lawful public or official sources when creating business information. The origin of register data and Inforegister’s own retention decision are, however, separate matters.
- The fact that data originates from a public register does not mean that it is retained indefinitely without assessing our own purpose.
- While a business role is active, processing the relationship is necessary to provide current business information.
- After a role ends, the relationship is treated as historical business information. If the person has another active business relationship, the previous relationship remains part of their reviewable business history. If there are no active relationships, public search discoverability is discontinued and the history remains visible to a logged-in user in the historical view.
- If an incorrect entry is corrected in the source register, the corresponding correction must also be assessed in the related services.
5. Restricting profile visibility is not the same as deleting data
Restricting the public visibility of a personal profile primarily concerns the public discoverability of the separate personal profile. It does not automatically end all processing of the underlying data or make accurate business history cease to exist.
- a current management or ownership relationship shown on a company profile;
- a historical business relationship for an active entrepreneur and, after active relationships end, in the historical view available to a logged-in user in accordance with the retention and visibility rules;
- accounting and contract documents that must be retained by law;
- data required for the establishment, exercise or defence of legal claims;
- technical logs and backups for the duration of their own retention cycle.
- Request to Restrict Personal Profile Visibility:
- https://www.inforegister.ee/en/profile_restriction/
6. When is data deleted or anonymised?
Data is deleted, anonymised, or processing in a form linked to the person is discontinued when:
- the retention purpose has been fulfilled;
- there is no continuing legal basis;
- the statutory retention period has expired;
- the need to protect legal claims has ended;
- the data has proved inaccurate and cannot be corrected in a way that preserves accurate historical information;
- retention in anonymised form is sufficient to fulfil the purpose.
7. What should you do if data is incorrect or outdated?
If a person believes that incorrect business information concerning them is displayed or processed, they should, where possible, identify the specific URL and data field. This makes it possible to distinguish between an error in the source register, a technical delay, accurate historical information, and genuinely incorrect processing.
The existence of a historical role is not itself an error if the role actually existed during the relevant period. An error may, for example, consist of a company being linked to the wrong person, an incorrect role, an incorrect start or end date, or contact information being associated with the wrong person.
8. Related documents and sources
- Privacy Policy:
- https://group.kreedix.ee/en/privacy-policy/
- Legitimate Interests Assessment:
- https://group.kreedix.ee/en/legitimate-interests-assessment/
- Procedure for Restricting the Visibility of a Personal Profile:
- https://group.kreedix.ee/en/procedure-for-restricting-the-visibility-of-a-personal-profile/
- Recipients of Personal Data:
- https://group.kreedix.ee/en/recipients-of-personal-data/
- Comprehensive overview of services and solutions for companies:
- https://voimalused.inforegister.ee/
- Riigi Teataja – Estonian Commercial Code:
- https://www.riigiteataja.ee/en/eli/ee/502042026001/consolide
- Riigi Teataja – Accounting Act:
- https://www.riigiteataja.ee/en/eli/ee/524012024002/consolide
- Estonian Data Protection Inspectorate – principles of personal data processing (in Estonian):
- https://www.aki.ee/isikuandmed/andmetootlejale/andmetootluse-pohimotted