Privacy Policy

Definitions

In order for You to better understand the terms of processing of personal data, we will explain the main terms related to privacy and data protection that we use.

GDPR or the General Data Protection Regulation (in English: general data protection regulation, (EU) 2016/679) was adopted on April 25, 2018 and is observed in all Member States of the European Union.

Personal data is any information about an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing is any automated or non-automated operation or set of operations which is performed on personal data or on sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Data Controller is a person, agency or other body that determines the purposes and means of processing personal data.

Data Processor is a person, public sector authority, agency or other body that processes personal data on behalf of the controller.

These personal data processing terms apply if: you use VITS services on behalf of a client; you are a client’s or cooperation partner’s representative or contact person; you provide us with information via our website or by e-mail.

1. Controller of Personal Data

VITS Solutions Eesti OÜ

Registry code: 16549739

Address: L. Koidula 16, Haapsalu 90502, Läänemaa, Eesti

E-mail: info@vits.ee

2. What type of personal data do we collect and from what sources do we get it?

We process Your personal data primarily for the purpose of providing services in communication with a client – You are the representative of a client who communicates with us or vice versa.

When using our services, we typically process the following data: Your first and last name, e-mail address, telephone number and geographic location. You can provide us with information when you register as a user of our services, when you use our website or mobile application, when you give us feedback or send us a message, or when you contact us in any other way.

We assume that the data provided is intended for business communication and does not include private contact information.

Automatically collected data: When you use our services as a user or visit our website, our technology automatically saves certain information about how you use the services. The automatically collected data may include the following: IP address (to determine the user’s location), information about the web browser and user’s device, referring sites, pages viewed on our website, what you view in our services, what you search for, the length and date of your visit, and access to or use of the service.

Data from public sources: We may also receive information (including personal data) from public sources, for example from business registers, the Internet and third parties, such as credit registers, from credit background and credit information analysis services.

Data collected on behalf of a VITS client: When using the services, our clients (i.e. companies that you represent/work for) upload and process various data (including the personal data of their employees, clients, business partners, etc.) through our services and platform. In such a case, the personal data is under the control of our client and VITS processes the personal data only for the purpose and to the extent necessary for the provision of services to the client. In such a case, VITS acts in accordance with the data processing agreement concluded with the client and as an authorized data processor.

3. For what purpose and on what legal basis do we process Your data?

As explained above, we process Your data primarily for the purpose of providing the service, i.e. to represent the client, to fulfill an order, and in communication with clients, to represent the client with whom we have a contract to use the services. For this reason, we process Your data in our business activities (service management, maintenance, ensuring functionality, handling client inquiries, etc.), (ii) in business development (statistics, preferences, analysis of the direction of development of new services and products), (iii) in marketing (in connection with new services and products, including related news and offers).

VITS processes your personal data for the specified purposes primarily based on a legitimate interest in business activities, which is based on our need – we have to communicate with legal entities and in order for the services to work, we are represented by the client, we ensure that there is a balance between our and your interests, rights and freedoms. The processing of Your personal data is based on a legitimate interest, and it is always subjective that you submit Your details as a representative. Upon submission, we assume your willingness to receive our new contact offers or comments in another way for our response.

In connection with Your work or area of responsibility, we may from time to time send You direct marketing offers and notifications, for example, if the company that is Your employer is our client or if you have previously ordered our services as a representative of your company. Such direct marketing activities are also based on the legitimate interest of VITS. If you receive such direct marketing messages from us, you always have the right to refuse them by clicking on the unsubscribe link at the end of the message.

4. To whom may we disclose Your data?

Your data at VITS is accessible only to those employees who need the data to perform their work tasks (on a need-to-know basis). Outside of VITS, we may share Your personal data with the following service providers in the following cases:

Service providers: Your data may also be accessible to persons who provide us with services (authorized processors) and process Your data on our behalf, but only to the extent necessary for the provision of their respective services. Such parties include for example data storage and distribution service providers; accounting, invoicing, analysis and statistics service providers; development and security service providers.

Public authorities and government institutions (e.g. PPA, Data Protection Inspectorate): we will only disclose Your data if and to the extent required by applicable law.

Professional advisors: We may also need to share Your data with our professional advisors such as auditors, lawyers.

Third parties in connection with a corporate transaction: We may share Your data with third parties in connection with a corporate transaction, for example, in the case of a sale of VITS or part of it to another company. In the context of establishing a joint venture, merger or other similar business arrangement.

We do not store or transfer your personal data outside the European Economic Area.

5. How long do we store Your data?

We store Your data for as long as it is necessary for the purposes described in these personal data processing conditions and for the fulfillment of our legal obligations: we store the user account and data connected to it as long as the client is an active user and for 1 year after; we follow occupational health and safety laws where data retention periods are set for documents. Specific retention periods are brought out in the service data processing agreement.

In addition, we may process aggregated and/or anonymized data for analytical and statistical purposes to improve and develop our service. If you would like more information about data retention, you can contact us at the email address provided in point 1 of these personal data processing terms.

6. What are your rights regarding your data?

Right of access to data – You have the right to know what data we hold about you, for what purposes we process it, to whom we disclose the data, how long we store the data and what are your rights regarding the restriction, rectification, erasure and processing of your personal data. To respond to your request, we must first verify your identity to avoid disclosing your data to unauthorized persons. We have the right to respond to your request within 30 days.

Right to rectification of data – You have the right to request the rectification of your personal data if it is incorrect or incomplete.

Right to erasure of data – You have the right in certain cases to request that we erase your personal data, for example when You have withdrawn your consent for the processing of your data and you have withdrawn your consent.

Right to restriction of processing – You have the right in certain cases to prohibit or restrict the processing of your personal data for a certain period of time (e.g. if you have objected to the processing of your data).

Right to object – You have the right to object to the processing of your data if the basis for the processing of your data is a legitimate interest. Upon receipt of an objection, VITS will weigh Your and our legitimate interests, on which basis we will decide whether to terminate the processing of your personal data. In addition, you have the right at any time to object to the processing of your personal data for direct marketing purposes. Upon receipt of such an objection, we will immediately stop processing your personal data for direct marketing purposes.

Right to data portability – If the processing of your personal data is based on your consent or an agreement with us and the data is processed automatically, you have the right to receive the personal data you have provided to us in a structured, commonly used format and in a machine-readable form. You also have the right to request that VITS transfer the data directly to another service provider, if this is technically feasible (i.e. the other service provider is able to receive the data).

If you wish to use the rights mentioned above, please contact us at the email address provided in point 1 of these personal data processing terms.

For the sake of clarity, point 6 of this document does not apply to personal data that VITS processes on behalf of a client as an authorized processor, for example, data that the client enters into the online software provided by us when using VITS services. In such a case, the controller of your personal data is the VITS client and the personal data is processed in accordance with the data protection conditions of the VITS client. Therefore, all corresponding data subject requests should be submitted directly to the VITS client.

7. Right to lodge a complaint with the Data Protection Inspectorate and the court

If you would like additional information regarding your personal data or the exercise of your rights, please contact us at the e-mail address provided in point 1 of the terms of processing of personal data.

If you find that the processing of your personal data violates the requirements of the GDPR, you have the right to turn to the Data Protection Inspectorate or the court to protect your rights and interests.