Data requests from authorities

Which data this is about

We hold two kinds of personal data. First, the contact details of people who have responded to one of our clients' ads – the client is their controller and we are the processor. Second, the data of our own clients, agent users and people who contact us, plus the results data we receive from ad platforms – for these, R.J. RADIANT OÜ is the controller.

A more detailed internal procedure applies within our team; this page reflects its content.

We release nothing before checking

No data request is acted on until a management board member has reviewed it and recorded the decision in writing. Every time, we check:

• whether the requesting authority is competent, and whether the official is acting within their powers;
• whether the request names a specific legal basis – "assisting an investigation" is not a legal basis;
• whether that provision actually extends to a company like ours and to this kind of data;
• whether the request comes from outside the EU – see below.

We also always verify that the requester is who they claim to be, through the authority's own published contact details – never the ones in the request. Impersonating officials is a known way of obtaining personal data, so we never skip this step, not even when a request is urgent.

Requests from non-EU countries

Under Article 48 of the General Data Protection Regulation, a judgment or decision of a court or authority of a third country is not in itself a basis for transferring personal data. Such a request can only be met if it rests on an international agreement in force, such as a mutual legal assistance treaty. A direct approach from an authority outside the EU without such a channel is not complied with, and we tell the authority which route it should use.

When we refuse

If a request is unlawful, disproportionate or incomplete, we don't comply. We first ask the authority to correct or narrow it; if that doesn't help, we refuse in writing with reasons; where needed we object, turn to the supervising prosecutor or an administrative court, and involve legal counsel. On questions of principle we consult the Estonian Data Protection Inspectorate.

We are prepared to bear reasonable costs to challenge a request we consider unlawful. Quietly complying because arguing is inconvenient is not an acceptable option for us.

We release the minimum

If releasing data is lawful and mandatory, we give only what satisfies the request: only the people and kinds of data named in it, limited to the period in question, with irrelevant fields removed – and we prefer a written answer to a specific question over handing over a data set. We never answer a request about one person with a database extract.

We give no authority standing, direct or automatic access to our systems.

Who we notify

If the data belongs to a client, we notify the client before releasing it so they can exercise their rights as controller. If we are the controller, we notify the person themselves. In both cases we stay silent only if the law explicitly forbids notification – and then we record the prohibition and its legal basis, and notify as soon as it ends.

If a non-disclosure order looks broader or longer than the law allows, we challenge that too.

We log every request

We keep a register of all requests from authorities – including those we didn't comply with or that were withdrawn. Each entry records the requesting authority, the legal basis cited, our assessment of each check, the decision and its reasons, exactly what was and wasn't released, and whether and whom we notified. We keep the register for seven years.

Urgent requests

The only situation in which we compress the usual order is an immediate threat to someone's life or health. Even then a board member decides, even then we verify the requester's identity, and we release only what is needed to avert the threat. We complete the full review and record it within five working days. An authority's own deadlines, or a general claim that something is urgent, are not an emergency.

For authorities: how to submit a request

Send the request in writing, on official letterhead, to info@pilgud.com. Please state the authority, the official and their position, the specific provision the request relies on, the kinds of data and people requested, and the time period. We confirm receipt, review the request and reply. We don't act on requests made orally or by phone.

Contact

R.J. RADIANT OÜ (registry code 17343069) · info@pilgud.com · pilgud.com. For personal data processing in general, see the privacy policy.