1. Controller and contact person
Name: Tallinna Optika OÜ, registration code 10011223
Address: Tartu mnt 6, Tallinn 10145, Estonia
Tel.: +372 66 12 106
Contact person: Mika Meronen, firstname.lastname@example.org
2. Data protection officer
Raimo Kaipio, email@example.com
1) the personal data of its customers for customer relations management and marketing activities, as well as
2) the personal data of any potential customers for marketing purposes.
The term “Data Subject” shall be hereinafter used for referring to any customers and potential customers.
4. Objectives and grounds for the processing of personal data
Grounds for the processing of personal data are as follows:
1) The legitimate interest of Tallinna Optika, which is based on a customer relationship, another type of relevant contact or direct marketing activity between Tallinna Optika and the customer;
2) A contract concluded between Tallinna Optika and the customer;
3) The customer’s approval for electronic direct marketing by Tallinna Optika.
Tallinna Optika shall process the personal data of its customers for the following objectives:
· Management of customer relations, including the provision and development of services, delivery of the products ordered by the customer, and customer service and customer communication activities;
· Marketing and targeted marketing for the products and services of Tallinna Optika;
· Collection and analysis of customer feedback, customer satisfaction surveys, market and opinion surveys;
· Management of any product-related complaints and warranty cases;
· Invoicing for products and services and debt collection.
The objective of processing data – other than personal data – is the marketing and targeted marketing for the products and services of Tallinna Optika. Clause 10.2 specifies how the data subject can prohibit or restrict the processing of his or her personal data for direct marketing purposes.
5. What type of personal data do we collect?
5.1. Personal data of the customer
Tallinna Optika collects and processes the following personal data of its customers:
· First and last name;
· Date of birth;
· Contact information: address of residence, e-mail address, telephone number;
· Addition information provided by the customer (e.g. preferences, interests, feedback);
· Start and end date of customer relations;
· Prohibitions and consents concerning direct marketing.
6. Which sources do we use for the collection of personal data?
Mainly, Tallinna Optika obtains personal data from the data subject (the data and information submitted by the data subject, which we collect in connection with customer service and the usage of products and services). In addition, Tallinna Optika collects personal data from the following sources:
· Third parties, from whom Tallinna Optika collects personal data for direct marketing purposes, e.g. purchased marketing databases.
7. Recipients of personal data, i.e. to whom personal data is transferred
Usually, Tallinna Optika shall not transfer the personal data of data subjects to other accountable data controllers. Tallinna Optika may still transfer the personal data of the customers to any competent authority in accordance with the applicable legislation. In that case, Tallinna Optika shall ensure that it has the right to transfer such personal data.
The subcontractors of Tallinna Optika shall process the personal data of the data subjects under the orders and in the name of Tallinna Optika for the purpose of customer service as well as customer and marketing communication, the performance of customers’ orders, drafting of marketing materials and management of IT systems. Tallinna Optika shall ensure that its subcontractors shall process the personal data of the data subjects only in accordance with the instructions of Tallinna Optika. The data subjects have the right to receive information concerning the subcontractors of Tallinna Optika by contacting Tallinna Optika using the methods described in clause 11.
8. Storage period of personal data
Tallinna Optika shall preserve the personal data of its customers during the duration of the customer relationship. After the end of the customer relationship, the data shall be stored for a period of time specified in the applicable legislation or the time necessary for the performance of the warranty obligations. Tallinna Optika shall consider a customer relationship as ended if a customer has not performed a single transaction at a Tallinna Optika store or e-shop over the course of a five year period. To perform its accounting obligations, Tallinna Optika shall preserve the personal data associated with a customer’s purchase history for a period of five years after each purchase transaction. If the product purchased by the customer is covered by a warranty, Tallinna Optika shall preserve the personal data necessary for the performance of the warranty obligations for as long as the warranty remains valid.
Tallinna Optika shall preserve the personal data of customers for direct marketing purposes for two years, provided that the data subject has not prohibited direct marketing. In such case, Tallinna Optika shall preserve information on direct marketing prohibition.
9. Ensuring the safety of personal data
Only such employees or contractual partners of Tallinna Optika can use the personal data who have agreed to follow all of the instructions and procedures associated with the usage of Tallinna Optika’s customer and marketing registry. The persons referred have access to personal data on the basis of a user name and password. Tallinna Optika shall provide a right to access the personal data only to such persons who have been authorized to process them, and only to such extent, which is necessary for the performance of specific work duties. All of the personal data processed by Tallinna Optika are confidential, and the employees and contractual partners of Tallinna Optika are bound by a confidentiality obligation, which shall remain valid also after the end of the employment or contractual relationship.
Tallinna Optika shall monitor the usage of personal data, e.g. through the usage of user logs, and enforce any technical or organizational measures necessary for the protection of personal data. The principles of processing and protecting personal data shall be defined and adopted by the management of Tallinna Optika.
10. Rights of the data subject
10.1. General information concerning the rights and their enforcement
Based on provisions provided in the legislation, Tallinna Optika may refuse to perform certain declarations of intent. In such a case, Tallinna Optika shall provide the data subject with reasoning for its refusal. If the data subject wishes, he or she may submit an appropriate complaint to the supervisory authority (please see clause 12).
10.2. The right to object to the processing of one’s personal data and their usage for direct marketing purposes (right of prohibit)
At any time, the data subject has the right to object to the processing of his or her personal data, when Tallinna Optika processes the personal data on the basis of legitimate interest, e.g. for direct marketing or customer data analysis. When presenting his or her objections, the data subject must specify the reasons why he or her does not wish for their personal data to be processed.
If a data subject prohibits the usage of their data for direct marketing purposes, Tallinna Optika shall stop to process the personal data of the data subject for direct marketing purposes. This means that the data subject shall receive no more marketing information concerning the products and services of Tallinna Optika or any marketing information that has been personalized for the data subject. The data subject may also provide specific consents and prohibitions concerning any specific direct marketing channels: e.g. the data subject may prohibit the sending of marketing information by e-mail, but allow for the sending of marketing information using regular mail. The data subject may also prohibit the usage of his or her data for customer data analysis that is performed for direct marketing purposes.
10.3. The right to access one’s personal data (right of verification)
The data subject has the right to receive information concerning the fact, whether or not his or her personal data are being processed. The data subject has the right to check his or her personal data, and to receive a copy of them.
The verification procedures are basically free of charge, but should the data subject receive repeated or extensive copies of his or her personal data, Tallinna Optika may ask for a fee to cover any direct costs associated with it.
10.4. The right to demand the rectification of personal data
The data subject has the right to demand that Tallinna Optika would rectify or supplement any personal data that are are incorrect, inaccurate or incomplete.
The data subject must notify Tallinna Optika of any changes to his or her personal data. If the data subject has access to his or her personal data using Tallinna Optika’s electronic services, he or she should correct/supplement the incorrect, inaccurate or incomplete personal data at their own initiative.
10.5. The right to demand the deletion and the restriction of the processing of personal data
The data subject has the right to demand that Tallinna Optika would delete any personal data associated with him or her. In such case, Tallinna Optika shall evaluate, whether it is obligated to delete the personal data in accordance with the applicable data protection law. Tallinna Optika does not have the right to delete such personal data, which it is obligated to preserve under the applicable legislation.
The data subject has the right to demand that Tallinna Optika would restrict the processing of his or her personal data in the circumstances provided in the applicable data protecting law, e.g. when the data subject is awaiting a reply from Tallinna Optika to his or her application for a prohibition on the processing of his or her personal data.
10.6. The right to transfer personal data
The data subject has the right to receive in electronic format the personal data submitted by him or her to Tallinna Optika for the purpose of transferring them to the information system of another data controller, provided that Tallinna Optika processes such personal data on the basis of a consent provided by the data subject or a contract.
If the customer of Tallinna Optika wishes, he or she may (on their own initiative) forward their personal and other data to third parties, if the electronic service of Tallinna Optika permits it.
10.7. The right to withdraw consent
If the processing of personal data is based on the consent of the data subject, the data subject may withdraw his or her consent at any time. When the data subject withdraws his or her consent, it does not affect the legality of processing his or her personal data prior to the withdrawal, or such processing of personal data, which is not based on the consent of the data subject.
The data subject must send all applications, declarations of intent, questions, notifications, etc. concerning the enforcement of the abovementioned rights to the following e-mail address: firstname.lastname@example.org. The data subject may also personally visit any store of Tallinna Optika located in Estonia. Should the data subject wish to withdraw his or her consent to direct marketing, he or she can do it using the cancellation link attached to the end of all direct marketing messages.
12. The right to submit a complaint to the supervisory authority
If the data subject thinks that Tallinna Optika has not processed his or her personal data in accordance with the applicable data protection law, he or she may submit a complaint to the appropriate supervisory authority or the supervisory authority located in the EU member state of his or her place of residence or work.