LEGAL / PRIVACY
Privacy Policy
This Privacy Policy explains how CG Investments OÜ, trading as Silver Peanut, collects and uses personal data when you visit silverpeanut.com, request an Automation Audit, book a call or correspond with us.
Last updated: 29 September 2026
1. Who is responsible for your data
The controller of your personal data is CG Investments OÜ, registry code 16500041, Parda tn 6, 10151 Tallinn, Estonia ("Silver Peanut", "we", "us"). For any privacy question or request, contact us at hello@silverpeanut.com.
This policy does not cover personal data we process on behalf of clients while delivering our services, such as contacts held in a client's CRM. There we act as a processor under a data processing agreement, and the client's own privacy notice applies.
2. What personal data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Contact and professional details | Full name, email address, job title, company name, company website | You, via the Automation Audit form or email |
| Business qualification details | Annual revenue, number of employees, marketing and sales team sizes, annual marketing department costs, annual performance marketing spend, main challenge, technology stack, growth objective | You, via the Automation Audit form |
| Booking details | Chosen date and time, time zone, meeting link, attendance, rescheduling or cancellation | You, via our calendar booking tool |
| Communications | Emails and messages exchanged with us, notes taken during calls | You and our team |
| Technical and usage data | IP address, browser and device type, pages viewed, referring source, cookie identifiers, approximate location derived from your IP address | Your device, via cookies and similar technologies (section 9) |
| Publicly available professional information | Your role, company and professional profile, for example from your company website or LinkedIn | Public sources, or a person who referred you to us |
- Category
- Contact and professional details
- What it includes
- Full name, email address, job title, company name, company website
- Where it comes from
- You, via the Automation Audit form or email
- Category
- Business qualification details
- What it includes
- Annual revenue, number of employees, marketing and sales team sizes, annual marketing department costs, annual performance marketing spend, main challenge, technology stack, growth objective
- Where it comes from
- You, via the Automation Audit form
- Category
- Booking details
- What it includes
- Chosen date and time, time zone, meeting link, attendance, rescheduling or cancellation
- Where it comes from
- You, via our calendar booking tool
- Category
- Communications
- What it includes
- Emails and messages exchanged with us, notes taken during calls
- Where it comes from
- You and our team
- Category
- Technical and usage data
- What it includes
- IP address, browser and device type, pages viewed, referring source, cookie identifiers, approximate location derived from your IP address
- Where it comes from
- Your device, via cookies and similar technologies (section 9)
- Category
- Publicly available professional information
- What it includes
- Your role, company and professional profile, for example from your company website or LinkedIn
- Where it comes from
- Public sources, or a person who referred you to us
Business qualification details mainly describe your company. They are personal data only where they can be linked to you, for example because they sit alongside your name.
Fields marked as required on the form are needed to assess your enquiry and schedule the call. Without them, we may not be able to book an Automation Audit. Please do not send us special categories of personal data, such as health data.
We do not record calls unless we tell you in advance and, where required, obtain your consent.
3. Why we use your data and our legal basis
| Purpose | Legal basis under the GDPR |
|---|---|
| Responding to your enquiry, assessing fit, and scheduling and conducting the Automation Audit | Legitimate interests (Art. 6(1)(f)) in handling business enquiries; where you act in your own name, steps taken at your request before entering into a contract (Art. 6(1)(b)) |
| Sending booking confirmations, reminders and other messages about your enquiry | Legitimate interests (Art. 6(1)(f)); Art. 6(1)(b) where applicable |
| Preparing proposals and entering into and performing a services agreement | Contract or pre-contractual steps (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) where the contract is with your company |
| Following up and sending occasional updates about our services | Legitimate interests (Art. 6(1)(f)) in business-to-business marketing, or consent (Art. 6(1)(a)) where the law requires it |
| Contacting business decision-makers identified from public sources about our services | Legitimate interests (Art. 6(1)(f)) |
| Keeping business records in our CRM | Legitimate interests (Art. 6(1)(f)) |
| Operating, securing and improving the Website | Legitimate interests (Art. 6(1)(f)) |
| Analytics and measuring advertising performance with non-essential cookies | Consent (Art. 6(1)(a)) |
| Complying with accounting, tax and other legal obligations | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Legitimate interests (Art. 6(1)(f)) |
- Purpose
- Responding to your enquiry, assessing fit, and scheduling and conducting the Automation Audit
- Legal basis under the GDPR
- Legitimate interests (Art. 6(1)(f)) in handling business enquiries; where you act in your own name, steps taken at your request before entering into a contract (Art. 6(1)(b))
- Purpose
- Sending booking confirmations, reminders and other messages about your enquiry
- Legal basis under the GDPR
- Legitimate interests (Art. 6(1)(f)); Art. 6(1)(b) where applicable
- Purpose
- Preparing proposals and entering into and performing a services agreement
- Legal basis under the GDPR
- Contract or pre-contractual steps (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) where the contract is with your company
- Purpose
- Following up and sending occasional updates about our services
- Legal basis under the GDPR
- Legitimate interests (Art. 6(1)(f)) in business-to-business marketing, or consent (Art. 6(1)(a)) where the law requires it
- Purpose
- Contacting business decision-makers identified from public sources about our services
- Legal basis under the GDPR
- Legitimate interests (Art. 6(1)(f))
- Purpose
- Keeping business records in our CRM
- Legal basis under the GDPR
- Legitimate interests (Art. 6(1)(f))
- Purpose
- Operating, securing and improving the Website
- Legal basis under the GDPR
- Legitimate interests (Art. 6(1)(f))
- Purpose
- Analytics and measuring advertising performance with non-essential cookies
- Legal basis under the GDPR
- Consent (Art. 6(1)(a))
- Purpose
- Complying with accounting, tax and other legal obligations
- Legal basis under the GDPR
- Legal obligation (Art. 6(1)(c))
- Purpose
- Establishing, exercising or defending legal claims
- Legal basis under the GDPR
- Legitimate interests (Art. 6(1)(f))
You can opt out of marketing and object to processing based on legitimate interests at any time (section 8). Where we rely on legitimate interests, we have balanced them against your rights, and you can ask us for details of that assessment.
4. Automated tools and AI
We may use automated tools, including AI, to organise, summarise and prioritise enquiries and to prepare for calls. A member of our team reviews every enquiry. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
We use AI providers only as processors under contract, and we do not permit them to use your data to train their models.
5. Who we share your data with
We share personal data only as needed for the purposes above:
- Service providers acting on our behalf under data processing agreements, including Cloudflare (website hosting, content delivery and security), Google (calendar booking via Google Calendar), Customer.io (email communications and contact management), and providers of analytics, video hosting and AI tools.
- Our team and contractors working on Silver Peanut in Spain, the United States and Brazil, on a need-to-know basis and under confidentiality obligations.
- Advertising and analytics partners, only where you have consented to the relevant cookies.
- Professional advisers, such as lawyers, accountants and auditors, under confidentiality obligations.
- Authorities, courts and regulators, where required by law or to protect our legal rights.
- A buyer or successor, if our business or assets are reorganised, merged or sold.
We do not sell your personal data.
6. International transfers
Some of our team members work from the United States and Brazil, and some service providers are based outside the European Economic Area (EEA). When personal data is transferred outside the EEA, we rely on a European Commission adequacy decision, such as the EU–US Data Privacy Framework for certified US recipients, or on Standard Contractual Clauses with additional safeguards where needed.
You can request a copy of the relevant safeguards by contacting us.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Enquiries and bookings that do not lead to an engagement | Up to 24 months after our last contact |
| Client and contract records | For the engagement, then as required by law (generally 7 years for accounting records in Estonia) |
| Marketing preferences | Until you opt out; we then keep a minimal record so that we respect your opt-out |
| Website analytics data | Up to 14 months |
| Server and security logs | Up to 90 days |
- Data
- Enquiries and bookings that do not lead to an engagement
- Retention period
- Up to 24 months after our last contact
- Data
- Client and contract records
- Retention period
- For the engagement, then as required by law (generally 7 years for accounting records in Estonia)
- Data
- Marketing preferences
- Retention period
- Until you opt out; we then keep a minimal record so that we respect your opt-out
- Data
- Website analytics data
- Retention period
- Up to 14 months
- Data
- Server and security logs
- Retention period
- Up to 90 days
After these periods, we delete or anonymise your data.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict our processing in certain circumstances;
- receive data you gave us in a portable format;
- object to processing based on our legitimate interests, and object at any time to direct marketing;
- withdraw your consent at any time, without affecting processing that took place before withdrawal.
To exercise your rights, email hello@silverpeanut.com. We will reply within one month, which may be extended by two further months for complex requests. We may ask you to confirm your identity first. Every marketing email also includes an unsubscribe link.
You have the right to lodge a complaint with a supervisory authority. In Estonia, where we are registered, this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari tn 39, 10134 Tallinn, info@aki.ee, www.aki.ee. You may also complain to the authority in the EU country where you live or work, such as the Spanish Data Protection Agency (AEPD).
9. Cookies and similar technologies
Strictly necessary cookies are set without consent because the Website cannot work properly without them. All other cookies are set only after you accept them in our cookie banner, which lists the individual cookies and providers in each category.
| Type | Purpose | Consent needed | Providers |
|---|---|---|---|
| Strictly necessary | Security, remembering your cookie choices, running the booking form | No | Cloudflare and our consent management tool |
| Analytics | Understanding how visitors use the Website so we can improve it | Yes | As listed in our cookie banner |
| Marketing and conversion tracking | Measuring the performance of our advertising and showing relevant ads on other platforms | Yes | As listed in our cookie banner |
| Embedded content | Playing videos and showing the booking calendar within the Website | Yes, where the provider sets non-essential cookies | Google Calendar and our video hosting provider |
- Type
- Strictly necessary
- Purpose
- Security, remembering your cookie choices, running the booking form
- Consent needed
- No
- Providers
- Cloudflare and our consent management tool
- Type
- Analytics
- Purpose
- Understanding how visitors use the Website so we can improve it
- Consent needed
- Yes
- Providers
- As listed in our cookie banner
- Type
- Marketing and conversion tracking
- Purpose
- Measuring the performance of our advertising and showing relevant ads on other platforms
- Consent needed
- Yes
- Providers
- As listed in our cookie banner
- Type
- Embedded content
- Purpose
- Playing videos and showing the booking calendar within the Website
- Consent needed
- Yes, where the provider sets non-essential cookies
- Providers
- Google Calendar and our video hosting provider
You can change or withdraw your consent at any time via the Cookie settings link in the Website footer, or by clearing cookies in your browser.
10. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls and multi-factor authentication on our business systems. No method of transmission or storage is completely secure, but we review our measures regularly.
11. Additional information for Brazil and the United States
If you are in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD). These include confirmation of processing, access, correction, anonymisation, blocking or deletion, portability, information about who we share data with, and withdrawal of consent. You can exercise them by contacting us, and you may complain to the Autoridade Nacional de Proteção de Dados (ANPD).
If you are in the United States, you may have rights under your state's privacy law. These can include accessing, correcting and deleting your personal information and opting out of targeted advertising. You can exercise them by contacting us, and we will not discriminate against you for doing so.
12. Children
The Website is intended for business professionals and is not directed at anyone under 18. We do not knowingly collect personal data from children.
13. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version on this page with a new "Last updated" date and, where changes are significant, notify you by email where appropriate.
14. Contact
CG Investments OÜ (Silver Peanut) · Parda tn 6, 10151 Tallinn, Estonia · Registry code 16500041 · hello@silverpeanut.com
