Last updated: 25 October 2026
This notice explains how AML Certification Centre OÜ uses personal data when you visit our website, amlcertification.com, send us an enquiry or book a call with our team. The AML Learning Platform at learn.amlcertification.com, where you study and take examinations, has its own privacy policy.
1. Who we are
| Controller | AML Certification Centre OÜ |
|---|---|
| Registry code | 16718573 |
| VAT number | EE102618918 |
| Registered office | Lõõtsa tn 2a, 11415 Tallinn, Estonia |
| Privacy contact | [email protected] |
| General contact | [email protected] |
Our supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): www.aki.ee.
2. What we collect
Enquiries
When you send us an enquiry through a form on the website, we receive your name, email address and organisation (optional); the options you choose, such as your interest, team size, markets, delivery format or timing; your message; and the page you sent it from and the language of the form.
With your enquiry we also receive:
- the campaign details in the link that brought you to the website, the first page you landed on and the website that referred you;
- your IP address, which we use to stop abuse of our forms, and the country it belongs to;
- whether you accepted statistics and marketing cookies;
- the identifier of our visitor tag, which links your enquiry to the pages you viewed before.
Calls you book
If you book a call with our team, Calendly receives your name, email address and anything else you enter, and passes the booking to us. The call takes place on Google Meet.
When you browse
Our website host, Cloudflare, processes your IP address and technical data such as your browser and the pages you request, to deliver the website and protect it from attacks.
Our own visitor tag records the pages you view so that we can link them to an enquiry, or to an account if you later register on the AML Learning Platform. It runs on our legitimate interest; you can object to it at any time by writing to [email protected].
If you accept them:
- statistics cookies: Google Analytics and Microsoft Clarity record the pages you view, your clicks and scrolling, and your device and browser. Clarity also records how you move through a page;
- marketing cookies: the Meta pixel and the LinkedIn Insight Tag record your visit and the ad you came from, so that Meta and LinkedIn can measure our advertising and show you our ads.
Our Cookie Policy lists each cookie with its provider, purpose and duration.
We do not ask for special categories of personal data, such as health data, and we do not sell personal data.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR Article 6(1)) |
|---|---|
| Answering your enquiry or chat and following it up, for example with a proposal or a call you book | Steps at your request before a contract (point (b)), and our legitimate interest in responding to business enquiries (point (f)) |
| Keeping the website and its forms secure | Our legitimate interest in protecting the website (point (f)) |
| Recording which campaign brought you to us, with your enquiry | Our legitimate interest in knowing which of our campaigns lead to enquiries (point (f)). You can object at any time |
| Our visitor tag: linking the pages you viewed to an enquiry or a later account | Our legitimate interest in understanding how our website leads to enquiries and registrations (point (f)). You can object at any time |
| Statistics: Google Analytics and Microsoft Clarity | Your consent, given through the cookie banner (point (a)) |
| Advertising: the Meta pixel and the LinkedIn Insight Tag | Your consent, given through the cookie banner (point (a)) |
| Our newsletter and webinar invitations, if you ask for them in a chat | Your consent (point (a)). You can withdraw it with the unsubscribe link in any email |
You can withdraw your consent at any time with Cookie settings at the bottom of every page. Withdrawing does not affect what we did before.
4. Who receives it
- Our own CRM, hosted by Railway (United States; servers in the EU). It stores your enquiry and the pages your visitor tag recorded.
- Cloudflare, which hosts the website, protects it and passes your enquiry to our CRM.
- Cookiebot by Usercentrics (Denmark), which records your cookie choices.
- Google (Google Ireland Limited): Gmail, which we use for email; Google Analytics, only with your consent; and Google Meet for calls you book.
- Microsoft: Microsoft Clarity, only with your consent.
- Meta (Meta Platforms Ireland Limited): the Meta pixel, only with your consent. For collecting the data on our website and sending it to Meta, Meta and we are joint controllers under Meta's controller addendum: we are responsible for the collection on our website and for this notice, and Meta for what it does with the data afterwards, which it decides under its own privacy policy. You can exercise your rights with either of us.
- LinkedIn (LinkedIn Ireland Unlimited Company): the LinkedIn Insight Tag, only with your consent. LinkedIn uses the data under its own privacy policy.
- Calendly (Calendly, LLC, United States), for calls you book.
- LiveChat (Text, Inc., United States), for chats you start.
- MailerLite (Lithuania), which sends our newsletter if you sign up for it.
These providers work on our behalf under data-processing terms, except where this notice says they use the data for their own purposes.
5. Transfers outside the EU
Cloudflare, Google, Microsoft, Meta, LinkedIn, Calendly, LiveChat and Railway may process data in the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy at [email protected].
6. How long we keep it
| Data | How long |
|---|---|
| Enquiries, chats and call bookings | 24 months after our last contact with you about the enquiry. If it leads to a contract, as long as the records of that contract |
| Pages recorded by our visitor tag | 14 months |
| Statistics and advertising data | Google Analytics: 14 months. Microsoft Clarity: session recordings for 30 days. Meta and LinkedIn: under their own policies |
| Your cookie choices | 12 months; the banner then asks again |
| Newsletter | Until you unsubscribe |
7. Your rights
You can ask us for a copy of your personal data, and ask us to correct or delete it, to restrict its use, or to give it to you in a portable format. You can object at any time to any use based on our legitimate interests, and withdraw any consent you gave. You can also object at any time to direct marketing, including any profiling for it, and we will then stop.
Write to [email protected]. We reply within one month. If a request is complex, or we receive many, we may take up to two more months; if so, we tell you why within the first month.
You can also complain to the Estonian Data Protection Inspectorate (www.aki.ee, [email protected], Tatari 39, 10134 Tallinn, Estonia) or to the data protection authority where you live.
8. Children
The website is for professionals and is not directed at children.
9. Changes to this notice
We update this notice when what we do changes. The date at the top shows the current version, and we point out significant changes on the website.