Answer to request

ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST Marina Bouqueniaux Yours: 04.09.2025 Kindred Group [email protected] Ours: 10.09.2025 nr 2.2.-5/25/26d-2 Answer to request Estonian Data Protection Inspectorate (DPI) has received your request: „I am writing on behalf of Kindred, where I serve as Privacy Manager. As part of our ongoing compliance efforts under the General Data Protection Regulation (GDPR) and relevant national laws, we are conducting a review of our records with the supervisory authorities in the jurisdictions in which we operate.In this regard, I would like to kindly request confirmation as to whether our company has a Data Protection Officer (DPO) formally registered or notified with your authority, in accordance with your requirements. If possible, we would also appreciate information on the process to verify or update these records should any changes be necessary.Below is the list of our companies to facilitate your research : Kindres Estonia OÜ and Relax Tech Services OÜ. Please let me know if you require further details from our side in order to facilitate this request.“ At the moment it seems that DPI has not been informed about the data protection officer/officers (DPO) of the companies mentioned. The system for notifying about DPO will be changing in the near future. When changes happen, it will be published on our website www.aki.ee. Below, I will describe the current notification options available. DPO can be appointed by company´s legal representative, who is marked in E-business register. Legal representatives can also authorize another person to appoint a DPO. The easiest way to report about DPO is to do it through the Estonian e-Business Register. The notice can be entered in the register by a person who is represented in the register and has the legal representation right. In this case, it is not necessary to send a separate notice to the DPI. If that is not possible, you can send us a signed notification via regular mail or digitally (if the said digital signature is valid according to eIDAS regulation - regulation (EU) no 910/2014 of the European Parliament and of the Council). Notification must contain DPO’s name, the beginning and end of the term1, personal ID code or date of birth, citizenship, contact e-mail. DPO, who is designated for the company, would be the contact person for the supervisory authority and for the data subjects. This means that intense and thorough communication between parties would be in the local language. The language of public administration, but also the communication with public and data subjects shall be in Estonian according to the Estonian Language Act. 1 If there is no end, we assume that it is an open-ended position. Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee Registrikood 70004235 More information in Estonian is available here Data protection officer. In English, information is available here Data protection officer | Andmekaitse Inspektsioon. Based on the above, to notify the DPO, company has two options, either board member does it in the e-business register or you forward a signed notification by authorized representative to the DPI. Hope my answer finds you well and if you have more questions don´t hesitate to ask. Respectfully Liina Kroonberg lawyer authorized by Director General 2 (2)