DATA PROTECTION POLICY (PRIVACY POLICY) AND DATA PROCESSORS

 

INTRODUCTION

AS Delfi Meedia (Delfi Meedia, hereinafter also: we) processes the personal data of data subjects in accordance with the principles set out in the data protection policy and in the legislation applicable to the processing of personal data.

Data subject (hereinafter also: you) in terms of the data protection policy is a natural person whose personal data are processed by Delfi Meedia. Among other things, a data subject is, for example, a subscriber to a publication by Delfi Meedia, a visitor of the website, a user of the sales platform, a registered user of the website, a candidate for a job.

Personal data are data which identify or allow the identification of a natural person, such as the name and contact details of the person.

The purpose of the data protection policy is to explain the principles of processing personal data, including the types of personal data collected by Delfi Meedia and the purpose of collection, and the rights of the data subjects in relation to the processing of their personal data by Delfi Meedia.

Delfi Meedia has the right to change the data protection policy if necessary (e.g. due to changes to legislation or the data processing procedure). In such a case, Delfi Meedia will give you reasonable advance notice before the changes are implemented.

 

PROCESSORS OF PERSONAL DATA

Controller

The controller is a legal person who determines the purposes and means of processing the personal data.

Controller: AS Delfi Meedia

Registry code: 10586863

Address: Narva mnt 13, 10151 Tallinn

Contacts: 669 8080, [email protected]

Processor

As a rule, Delfi Meedia will not disclose personal data to third parties. However, this may be required if the obligation to disclose the data arises from legislation or is necessary for the performance of a contract. Also, when the data subject has given permission to do so.

The processor of personal data is a natural or legal person, a public authority, an institution or any other organisation that processes personal data on behalf of the controller (Delfi Meedia). Delfi Meedia may authorise the processors to use the personal data. Processors are the cooperation partners of Delfi Meedia whose data are available in section 10 and who process the data, among other things:

• to provide a service;
• to maintain a structured database of subscribers;
• for service and marketing purposes, except where the person has decided otherwise or has later withdrawn his or her consent, by notifying thereof in a form which permits written reproduction;
• to fulfil legal obligations (e.g. transmission of data to a research organisation).

Processors process personal data for the performance of the tasks given by Delfi Meedia.

 

PERSONAL DATA PROCESSING AT DELFI MEEDIA, AND THE PRINCIPLES OF PROCESSING

Delfi Meedia only processes personal data for the purposes stated herein and on a legal basis.

In processing personal data, Delfi Meedia always complies with the following principles:

Transparency – Delfi Meedia processes personal data in a fair and transparent manner and only when permitted by law.

Purpose limitation – Delfi Meedia collects your personal data for specific, explicit and legitimate purposes. The purposes of processing may change due to legislation or your authorisation. In any case, we will notify you thereof in advance.

Data minimisation – Delfi Meedia ensures that the personal data processed are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

Accuracy – Delfi Meedia ensures that your personal data are accurate and relevant. We will delete or correct inaccurate personal data at the first opportunity.

Storage limitation – in storing personal data, Delfi Meedia observes the need for processing the personal data, i.e. the data that allow identification of a natural person are stored until it is necessary to achieve the purpose of the processing. In determining the storage period, Delfi Meedia complies with legal requirements, the limits agreed in binding contracts or the deadlines necessary for the performance of legal obligations.

Integrity and confidentiality – Delfi Meedia processes your personal data in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing. Delfi Meedia maintains the confidentiality of all personal data disclosed to us and protects personal data from unlawful disclosure to third parties by implementing effective security measures, including information technology, technical and organisational measures.

Data protection by design and by default – in developing, selecting and using products and services which require the processing of personal data, Delfi Meedia considers the need to protect the personal data.

 

PROCESSED PERSONAL DATA AND THE PURPOSES OF PROCESSING

Delfi Meedia mainly processes the personal data that you provide to it or that are collected on the basis of your activities when you use the products, services or websites of Delfi Meedia.

We process your personal data primarily for providing you with the service, newsletters or offers, and for creating news stories.

In doing so, we mainly process the following types of data concerning you:

• Basic personal data such as first name and family name and personal identification code, for the performance and enforcement of a contract.
• If the customer has ordered a publication by subscribing to an e-invoice standing order agreement, the identification code of the customer is required, among other things.
• Additional personal data for other personal identification purposes, such as information on education, professional experience and personal characteristics when applying for a job.
• Contact details, such as the address of the place of residence, e-mail address and telephone number, are necessary for the performance of a contract. They are also used for direct marketing purposes, if the data subject has consented.
• The address of the place of residence is necessary for the performance of a contract signed for ordering products on paper; otherwise it will not be possible to perform the contract, i.e. to deliver the order.
• E-mail address is necessary for the performance and enforcement of a contract and for invoicing.
• Telephone number is necessary for the performance and enforcement of a contract, including for the transmission of messages in case of the unavailability of the service.
• Payment details, such as your bank account number, are necessary for the provision of the service.
• Surveillance camera recordings. If you visit us, the rooms reserved for the reception of visitors may be equipped with video surveillance systems.
• Web identifiers, such as the IP-address of your device when you visit our websites. Read more about our cookie policy here.

 

You have the right to obtain access to the personal data held about you (see section 9 for more details). However, please bear in mind that the processing of certain personal data is a prerequisite for the provision of a service to you. For example, if you do not provide us with your basic personal data or contact details, we will not be able to provide you with the service or deliver the publications you have ordered.

 

LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Delfi Meedia may process personal data on the following legal grounds:

Performance of a contract – we rely on this legal ground to establish a contractual relationship and to comply with the terms and conditions agreed with our customers and partners. For example, to deliver the publications you have ordered.

Legal obligation – we rely on this legal ground to fulfil our legal obligations. For example, to respond to requests from law enforcement authorities.

Consent – we rely on consent to process personal data to send you promotional materials such as newsletters and offers.

Legitimate interest – we rely on this legal ground to prepare and make sales offers.

 

PROFILING

Delfi Meedia may profile your personal data to provide its products by combining personal data for direct marketing decisions. We do this primarily by taking into account your previous service use history, age, address and gender, to map the target group to which we offer specifically targeted products and services.

You have the right to object to the use of your personal data for profiling purposes.

• To target advertising, visitor behaviour patterns are summarised and target groups are identified on this basis thereof with the help of external partners (the list of processors authorised by Delfi Meedia is given in section 10).

Behaviour patterns are summarised according to user activity – viewing pages, viewing galleries, answering questions, ordering, etc. Membership in any target groups of Delfi Meedia is not recorded, nor can individuals be identified in target groups because the information is summarised.

 

PERSONAL DATA RETENTION

Delfi Meedia only retains the personal data until this is necessary for achievement of the purpose for which the personal data are processed or until the end of the limitation period for claims arising from the law and until the legal deadline for the retention of a document.

For different data, this means different retention periods. For example:

• we retain the contact details for customers until this is necessary for the provision of personalised services under a contract;
• we retain the personal data necessary for accounting purposes for 7 years as required by law;
• we retain the personal data provided on the basis of consent until the consent is withdrawn.

 

RIGHTS OF THE DATA SUBJECT

Delfi Meedia places high value on the right of the data subjects to privacy.

Your rights as a data subject are as follows:

• Right of access to your personal data processed by Delfi Meedia about you.
• Right to rectification or supplementation of personal data if your personal data are not up-to-date, are inaccurate or need to be corrected.
• Right to erasure. In certain cases and if you want, you can use the right to be forgotten. We will delete your data unless there is another legal ground for processing the personal data, such as a legal obligation.
• Right to restriction of processing. If you wish to restrict or prohibit the processing of your personal data, Delfi Meedia will only continue to process your personal data for the purposes of retention, if required by other legal grounds.
• Right to object to the processing of your personal data if Delfi Meedia uses your personal data for profiling or direct marketing, for example.
• Right to data portability if you wish to have the personal data you have transmitted to Delfi Meedia to be transmitted to another controller in a machine-readable format. Express Meedia can do so if the transmission is technically possible.
• Right to withdraw consent. If your personal data are processed based on your consent, you have the right to withdraw the consent at any time. For this purpose, all promotional notifications sent to your e-mail address contain instructions for opting out. You can also withdraw your consent given to promotional notifications by sending an e-mail to Delfi Meedia to [email protected].
• Right to contact a supervisory authority. You have the right to lodge a complaint about the processing of the personal data concerning you with the Estonian Data Protection Inspectorate.

 

IMPLEMENTING PROVISION

Delfi Meedia regularly reviews the data protection policy and applies the policy in accordance with any changes in the processing of personal data.

In any questions concerning the data protection policy or the processing of personal data, please contact [email protected].

 

PROCESSORS

Delfi Meedia processes the personal data relating to a data subject in the manner specified in the terms of use. If required by law, Delfi Meedia may grant the right to use the data only to its cooperation partners who are authorised processors and have the right to use the data only for the purposes specified by Delfi Meedia and on the basis of a contract concluded for this purpose. Delfi Meedia will only transmit the personal data of a data subject to the cooperation partners who provide sufficient guarantees that they will implement appropriate technical and organisational measures so that the processing of the data subject’s personal data complies with the law and guarantees the protection of the data subject’s rights. Where Delfi Meedia processes a data subject’s personal data on the basis of the data subject’s consent, information on the processors of the data subject’s personal data must be communicated, among other things, to the data subject as required by law.

 

Our main partners are:

Sales, marketing, services

Adform; Sporto st. 18, LT-09238 Vilnius, Leedu; (+370) 5212 3063, [email protected]

Cxense ASA; Karenslyst Allé 4, N-0278 Oslo, Norra; [email protected]

Ekspress Finants AS (rg-kood 14944294); Parda 6, 10151 Tallinn; [email protected]

Facebook Inc; 1601 Willow Road, Menlo Park, California 94025, USA; [email protected]

Gemius Eesti OÜ (rg-kood 11309321); Tartu mnt 18-51, 10115 Tallinn; (+372) 565 1055, [email protected]

Girf OÜ (rg-kood 12486864); Mäealuse 2/1, 12618 Tallinn; (+372) 651 0440, [email protected]

Google LLC; 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Hybrid Ad Tech SP Z OO; Street. Janka Muzykanta 60, 02-188 Warsaw, Poola

Infira OÜ (rg-kood 12127504); Kodusalu tee 5 Tänassilma küla, Saku vald, 76406 Harjumaa; (+372) 5622 9124, [email protected]

Instapage Inc; 118 King St. Suite 450, San Francisco, CA 94107, USA; [email protected]

Itella Estonia OÜ (rg-kood 10891224); Loomäe tee 13 Lehmja küla, Rae vald, 75306 Harjumaa; (+372) 699 0431, [email protected]

KE Ajakirjanduse OÜ (rg-kood 10022971); Filmi 6-47, 10152 Tallinn; (+372) 641 1753, [email protected]

Müügimeistrite AS (rg-kood 10181899); Pirni 7, 10617 Tallinn; (+372) 619 1375, [email protected]

OneSignal; 2194 Esperanca Avenue, Santa Clara, CA 95054, USA; [email protected]

Prominion OÜ (rg-kood 10859769); Mustamäe tee 16, 10617 Tallinn; (+372) 699 9099, [email protected]

ReadPeak OY (rg-kood FI26155115); Itälahdenkatu 22b, 00210 Helsinki, Soome; [email protected]

SendGrid Inc; 1801 California Street, Suite 500, Denver, Colorado 80202, USA

Sendsmaily OÜ (rg-kood 12837097); Paldiski mnt 29, 10612 Tallinn; (+372) 5656 8987, [email protected]

Production

Lehepunkt OÜ (rg-kood 12113637); Lõõtsa 1A, 11415 Tallinn; (+372) 633 6081, [email protected]

Printall AS (rg-kood 10092701); Tala 4, 11415 Tallinn; (+372) 669 8400, [email protected]

Home delivery

Eesti Post AS (rg-kood 10328799); Pallasti 28, 10001 Tallinn; (+372) 661 6616, [email protected]

Express Post AS (rg-kood 10354213); Peterburi tee 34/5, 11415 Tallinn; (+372) 617 7700, [email protected]

e-invoices and paper invoices

Unifiedpost AS (rg-kood 10179336); Tartu mnt 43, 10128 Tallinn; (+372) 651 9000, [email protected]

Software development

CRM-Service OY (rg-kood FI21324530); WTC Helsinki Airport, Lentäjäntie 3, 01530 Vantaa, Soome; (+358) 10 324 5000, [email protected]

Ekspress Grupp AS (rg-kood 10004677); Parda 6, 10151 Tallinn; (+372) 669 8381, [email protected]

Fontakt OÜ (rg-kood 11091789); Tondi 51-12, 11316 Tallinn; (+372) 5340 0030, [email protected]

Scoro Software OÜ (rg-kood 10806081); Endla 15, 10122 Tallinn; (+372) 611 6671; [email protected]

SIA Biļešu paradīze (rg-kood 40003394937); 3 Duntes street, Riga, LV-1013 Läti; (+371) 9000 2000, [email protected]

Uptime OÜ (rg-kood 10308733); Pärnu mnt 158, 11317 Tallinn; (+372) 603 1700, [email protected]

Payments

Coop Pank AS (rg-kood 10237832); Narva mnt 4, 15014 Tallinn; (+372) 669 0966, [email protected]

EveryPay AS (rg-kood 12280690); Väike-Karja 12, 10140 Tallinn; (+372) 644 2201, [email protected]

LHV Finance AS (rg-kood 12417231); Tartu mnt 2, 10145 Tallinn; (+372) 680 2700, [email protected]

Luminor Bank AS (rg-kood 11315936); Liivalaia 45, 10145 Tallinn; (+372) 628 3300, [email protected]

SEB Pank AS (rg-kood 10004252); Tornimäe 2, 15010 Tallinn; (+372) 665 5100, [email protected]

Swedbank AS (rg-kood 10060701); Liivalaia 8, 15040 Tallinn; (+372) 631 0310, [email protected]

Zlick LTD (rg-kood 9453485); 2.05 12-18 Hoxton Street, London, N1 6NG, Suurbritannia; (+372) 505 9229, [email protected]