Legal

Privacy Policy

Last updated: 24 October 2026

Who controls your data

NestEgg OÜ, trading as ICOS, controls personal data collected through this public website, account sign-up, customer enquiries, product accounts and billing.

Where an organisation uses ICOS Due Diligence to manage counterparty due diligence, that organisation will normally control the case data and NestEgg OÜ will process it on the organisation’s instructions under a separate data processing agreement.

Data we collect

Depending on how you use the website or the product, we may collect:

• Account data: the email address and password hash for your account, consent records and sign-up time
• Communications: your contact details and information you include when you email or call us
• Product account data: account identity, organisation, role, authentication events, product activity and support records
• Billing preparation data: legal name, billing address, country, billing email, VAT number and validation result
• Payment metadata: transaction references, payment status, amount and provider identifiers; ICOS does not store full card or online-banking credentials
• Technical and security data: IP address, browser information, service logs and anti-abuse verification data
• Essential browser storage: session data and a local flag recording that the cookie notice was dismissed

Why we use it

We use your email address with your consent to send material product updates. You can withdraw consent at any time by emailing support@icosstudio.com.

We use enquiry and product account data to respond, provide the service, secure accounts and investigate faults. We rely on steps requested before a contract and our legitimate interests in operating and protecting the service.

We use billing and transaction records to perform customer contracts, manage payments and meet tax, accounting, fraud-prevention and other legal obligations.

International transfers

Some providers may process data outside the European Economic Area. Where required, we rely on a recognised transfer safeguard, such as an adequacy decision or the European Commission’s Standard Contractual Clauses.

Retention

We keep account data while your account remains active and for a limited period afterwards. We keep correspondence only as long as needed to answer the enquiry and maintain reasonable business records.

Account, activity and payment records are kept while the account remains active and for a limited period afterwards for security, fault investigation and audit. Invoice and transaction records are kept for the period required by tax and accounting law. Customer due diligence data follows the customer contract, data processing agreement and applicable legal duties.

Cookies and local storage

We use only essential cookies and similar browser storage. These support authorised sessions, site security and the cookie-notice preference. We do not use analytics or advertising cookies.

Your rights

Subject to applicable data protection law, you may:

• Ask for access to or correction of your personal data
• Ask us to erase or restrict the use of your data
• Withdraw marketing consent at any time
• Object to processing based on legitimate interests
• Ask for a portable copy where the right applies
• Complain to your local data protection authority

Contact and changes

Contact support@icosstudio.com with a privacy request. We may update this policy as the service changes. The date at the top shows the latest revision.

NestEgg OÜ, trading as ICOS. Registered in Estonia under number 14509210. VAT number EE102647646.

Registered address: Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 10151, Estonia.

Contact: support@icosstudio.com · +356 9999 4554