Answer to request

ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST

Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee

Registrikood 70004235

Marina Bouqueniaux

Kindred Group

[email protected]

Yours: 04.09.2025 Ours: 10.09.2025 nr 2.2.-5/25/26d-2

Answer to request Estonian Data Protection Inspectorate (DPI) has received your request:

„I am writing on behalf of Kindred, where I serve as Privacy Manager. As part of our ongoing compliance

efforts under the General Data Protection Regulation (GDPR) and relevant national laws, we are

conducting a review of our records with the supervisory authorities in the jurisdictions in which we

operate.In this regard, I would like to kindly request confirmation as to whether our company has a Data

Protection Officer (DPO) formally registered or notified with your authority, in accordance with your

requirements. If possible, we would also appreciate information on the process to verify or update these

records should any changes be necessary.Below is the list of our companies to facilitate your research :

Kindres Estonia OÜ and Relax Tech Services OÜ. Please let me know if you require further details from

our side in order to facilitate this request.“

At the moment it seems that DPI has not been informed about the data protection officer/officers

(DPO) of the companies mentioned. The system for notifying about DPO will be changing in the

near future. When changes happen, it will be published on our website www.aki.ee. Below, I will

describe the current notification options available.

DPO can be appointed by company´s legal representative, who is marked in E-business register.

Legal representatives can also authorize another person to appoint a DPO.

The easiest way to report about DPO is to do it through the Estonian e-Business Register. The

notice can be entered in the register by a person who is represented in the register and has the legal

representation right. In this case, it is not necessary to send a separate notice to the DPI.

If that is not possible, you can send us a signed notification via regular mail or digitally (if the said

digital signature is valid according to eIDAS regulation - regulation (EU) no 910/2014 of the

European Parliament and of the Council). Notification must contain DPO’s name, the beginning

and end of the term1, personal ID code or date of birth, citizenship, contact e-mail.

DPO, who is designated for the company, would be the contact person for the supervisory authority

and for the data subjects. This means that intense and thorough communication between parties

would be in the local language. The language of public administration, but also the communication

with public and data subjects shall be in Estonian according to the Estonian Language Act.

1 If there is no end, we assume that it is an open-ended position.

2 (2)

More information in Estonian is available here Data protection officer. In English, information is

available here Data protection officer | Andmekaitse Inspektsioon.

Based on the above, to notify the DPO, company has two options, either board member does it in

the e-business register or you forward a signed notification by authorized representative to the

DPI.

Hope my answer finds you well and if you have more questions don´t hesitate to ask.

Respectfully

Liina Kroonberg

lawyer

authorized by Director General