1. Application of the Privacy Policy

1.1. This privacy policy (hereinafter: Privacy Policy) applies to all cases in which the Eesti Masinatööstuse Liit MTÜ (Federation of Estonian Engineering Industry, hereinafter: EML) processes the personal data of natural persons (hereinafter: Data Subject) as the controller in the operation and administration of the online database and communication network of Estonian industrial enterprises (hereinafter: Platform).

1.2. The Privacy Policy does not regulate the processing of personal data published on the Profiles – in this respect, the controller is the Company owning the Profile and EML processes personal data in accordance with the Personal Data Processing Procedure (see https://www.industryestonia.com/page/terms-of-service).

1.3. The Terms of Privacy apply from the date stated above. The EML has the right to unilaterally amend and supplement the Privacy Policy. Data Subjects will be notified of any changes in the Privacy Policy via e-mail.

1.4. Privacy Policy forms an integral part of the Terms of Use of the Platform. The Terms of Use of the Platform is available at https://www.industryestonia.com/page/terms-of-service.

2. Controller

2.1. The controller of processing the personal data of Data Subjects is a non-profit organisation EESTI MASINATÖÖSTUSE LIIT, registry code 80004986, address Harju County, Tallinn, Kristiine District, Mustamäe tee 4, 10621.

2.2. In all matters relating to the Privacy Policy and the processing of personal data, feel free to contact EML by sending an e-mail to info@emliit.ee.

3. Purposes of processing personal data

3.1. EML processes the personal data of Data Subjects for the following purposes:

(a) for the provision of services via the Platform;

(b) communicating with Data Subjects interested in using the Platform (including via email);

(c) to provide User support;

(d) to develop the Platform;

(e) To perform the obligations arising from the legislation of the Republic of Estonia;

(f) To implement its rights arising from the legislation of the Republic of Estonia and the Terms of Use of the Platform.

4. Personal data processed

4.1. EML processes the following personal data:

(a) In cases referred to in sections 3.1(a) - 3.1(f) – first and last name of the Data Subject, e-mail address;

(b) In cases referred to in sections 3.1(c) - 3.1(f) – logs (i.e. the operations performed by the Data Subject in the Platform).

5. Legal basis for processing personal data

5.1. EML processes the personal data of Data Subjects because it is necessary for the performance of a contract with the Data Subject (see above 3.1(a) and 3.1(c)) or for taking measures prior to the conclusion of the contract as requested by the Data Subject (see above 3.1(b) and 3.1(c)). In this case, the legal basis for the processing of personal data is the agreement entered into with the Data Subject, or the Data Subject's request for pre-contractual negotiations.

5.2. EML also processes personal data to improve and develop the Platform (see 3.1(d) above). In such a case, the legal basis is the EML’s justified interest in improving and developing the functioning and quality of the Platform.

5.3. EML also processes personal data to perform the obligations arising from the legislation of the Republic of Estonia (see section 3.1(e) above). In this case, the legal basis for the processing of personal data is the fulfilment of the legal obligations of the EML as a controller.

5.4. EML also processes personal data to implement its rights arising from the legislation of the Republic of Estonia and the Terms of Use of the Platform (see section 3.1(f) above). In this case, the legal basis for the processing of personal data is the justified interest of the EML as a controller. It is the EML’s justified interest to implement its rights in the way deemed necessary by the EML.

6. Transmission of personal data to third parties

6.1. EML does not transmit personal data of Data Subjects to third parties, except for:

(a) server service provider in so far as the EML stores and processes personal information outside of the EML's office;

(b) developer of the EML’s ITK systems in so far as it is necessary for the management of EML databases, provision of services and communication with Data Subjects, in which case the developer has access to the personal data processed by the EML to the extent necessary for the provision of development services;

(c) e-mail server service provider to the extent in which the EML uses e-mails to send personal data within the EML, e.g., to Google LLC (Google has joined the Privacy Shield data protection framework which ensures the processing of personal data at the same level as in the European Union).

6.2. All controllers referred to in section 6.1 shall ensure the protection of personal data as set out in the personal data protection legislation.

6.3. EML also has the right to disclose the personal data of Data Subjects to the following persons and in the following cases:

(a) to an institution which has the right under the legislation of the Republic of Estonia to publish personal data processed by the EML, and if the EML is obligated to disclose personal data to that institution;

(b) to a relevant third party to protect the rights of the EML, safety of the Platform, and personal data processed by the EML (e.g., for anti-fraud protection or credit risk mitigation).

7. Retention of personal data

7.1. Personal data of a Data Subject is retained:

(a) until the Data Subject's account is deleted indefinitely in so far as the EML processes the personal data of the Data Subject in connection with the registration, operation and storage of the Data Subject's user account;

(b) for up to 3 years after the last use of the Platform by the Data Subject, in which the EML stores the personal data of the Data Subject in connection with the provision of the Platform as a service (see section 3.1(a) above), with the development of the Platform (see section 3.1(d) above), with the fulfillment of obligations arising from the legislation of the Republic of Estonia (see section 3.1(e) above) and in exercising the rights of the EML arising from the legislation of the Republic of Estonia and the Terms of Use of the Platform (see section 3.1(f) above);

(c) for up to 3 years after the last contact with the Data Subject in so far as the EML retains the personal data of the Data Subject in connection with pre-contractual negotiations and communication with Data Subjects interested in the service (see section 3.1(b) above);

(d) for up to 3 years after the last contact with the Data Subject, in so far as the EML retains the personal data of the Data Subject in connection with the provision of user support (see section 3.1(c) above).

7.2. Accounting records containing personal data shall be kept for seven years from the end of the financial year to which they relate.

8. Rights of a Data Subject in the processing of personal data

8.1. Data Subject can turn to the EML at any time with a corresponding written and free-form application sent to the e-mail address info@emliit.ee, to:

(a) request access to personal data relating to the Data Subject;

(b) request the rectification of personal data;

(c) request the deletion of personal data;

(d) restrict the processing of personal data;

(e) object to the processing of personal data;

(f) request the transfer of personal data;

(g) require that no decision be taken on the Data Subject based on automated processing;

(h) withdraw their consent to the processing of personal data;

(i) lodge a complaint to the supervisory authority (Data Protection Inspectorate).

9. Links to third party websites

9.1. EML and other Users of the Platform may publish links to the websites of third persons (hereinafter: Third Party Websites). Third Party Websites may be subject to terms and conditions other than this Privacy Policy, the implementation of which cannot be controlled by the EML. EML is not responsible for the privacy policies of third party websites or for the processing of personal data through Third Party Websites.