Teie privaatsus on meile oluline. Hindame teie privaatsuse ja andmekaitse õigust. Soovime, et teaksite, millistel eesmärkidel ja kuidas me kogume ja kasutame teie isikuandmeid (tuntud ka kui isiklik teave) ning millised õigused teil on. Olulist teavet teie isikuandmete töötlemise kohta leiate sellest privaatsusteatisest. Privaatsusteatis võib täiendada muid privaatsusavaldusi ja küpsiste kasutamise teatisi (küpsisepoliitika), mis on avaldatud drinks.bid’i veebisaidil.
See privaatsusteatis kehtib isikuandmete töötlemisele INDIEDRINKS EE OÜ poolt (registreeritud Eesti Vabariigis registrikoodiga 16305658 ja registrijärgne asukoht Suur-Sõjamäe 14, 11415 Tallinn, Eesti; edaspidi Indiedrinks, meie või meid).
1. Definitsioonid
Käesolevates Privaatsustingimustes kasutatakse järgmist terminoloogiat järgmises tähenduses:
- Andmesubjekt on füüsiline isik, kelle kohta Indiedrinksil on andmed või teave, mida saab kasutada füüsilise isiku tuvastamiseks. Andmesubjektid on näiteks kliendid, kes on füüsilised isikud, koostööpartnerid ja nendega seotud isikud, ettevõtete kliendid või müüjad (nt esindajad või töötajad);
- GDPR on Euroopa Parlamendi ja nõukogu määrus (EL) 2016/679, mis käsitleb füüsiliste isikute kaitset seoses isikuandmete töötlemisega ja selliste andmete vaba liikumist ning millega tunnistatakse kehtetuks direktiiv 95/46/EÜ;
- Isikuandmed on igasugune teave tuvastatud või tuvastatava andmesubjekti kohta, sealhulgas klient või kliendiga seotud füüsilised isikud;
- Kliendiandmed on igasugune teave (sh isikuandmetena käsitletav teave), mis on Indiedrinksile teada kliendi või selle esindajate kohta;
- Klient on iga füüsiline või juriidiline isik, kes kasutab, on kasutanud või on avaldanud soovi kasutada Indiedrinks'i poolt pakutavaid teenuseid või on muul viisil meie teenustega seotud;
- Kolmas osapool on füüsiline või juriidiline isik, avalik-õiguslik asutus, asutus või organ ning ükskõik milline isik peale andmesubjekti, Indiedrinks'i, Indiedrinks'i volitatud töötaja või isiku, kes võib töödelda andmesubjekti isikuandmeid Indiedrinks'i või töötleja volituse alusel;
- Leping on mis tahes sisuga leping, mis on sõlmitud Indiedrinks'i ja kliendi vahel, peamiselt ostja või müüja tingimused;
- Töötlemine tähendab igasugust toimingut või toimingute kogumit, mis viiakse läbi isikuandmetega, nagu kogumine, salvestamine, korraldamine, struktureerimine, säilitamine, kohandamine või muutmine, taasesitamine, konsulteerimine, kasutamine, avalikustamine edastamise teel, levitamine või muul viisil kättesaadavaks tegemine, ühitamine või ühendamine, piiramine, kustutamine või hävitamine, sõltumata kasutatavast töötlemisviisist või vahenditest;
- Töötleja tähendab füüsilist või juriidilist isikut, avalik-õiguslikku asutust, asutust või muud organit, kes töötleb isikuandmeid Indiedrinks'i, volitaja nimel.
2. Turvalisus
Indiedrinks võtab kõigi oma valduses olevate andmete turvalisust väga tõsiselt. Indiedrinks tagab kliendiandmete ja isikuandmete konfidentsiaalsuse kohaldatava seaduse alusel ja rakendab asjakohaseid tehnilisi ja organisatsioonilisi meetmeid, et kaitsta isikuandmeid volitamata juurdepääsu, ebaseadusliku töötlemise või avalikustamise, juhusliku kaotuse, muutmise või hävitamise eest.
Indiedrinks võib kasutada isikuandmete töötlemiseks töötlejaid. Sellistel juhtudel tagab Indiedrinks, et isikuandmete töötlemine toimub vastavalt Indiedrinks'i juhistele ja kohaldatava seaduse ning käesoleva Privaatsusteate kohaselt. Rakendame lepingulisi ja sobivaid turvameetmeid teie isikuandmete kaitsmiseks ja konfidentsiaalsuse säilitamiseks.
3. How do we collect your Personal Data?
Indiedrinks collects Personal Data primarily in the following ways:
- - we mainly collect Personal Data from the Client or other Data Subject itself or from the persons acting on the Client’s or other Data Subject’s instructions (e.g. through requests, applications, conclusion and performance of Agreements)
- - in the context of providing services (e.g. sale of alcoholic and non-alcoholic beverages)
- - personal Data, including e-mail correspondence, emerged as a result of normal communication between the Data Subject and Indiedrinks
- - personal Data clearly disclosed by the Data Subject (e.g.in social media)
- - personal Data generated by the use of services provided by Indiedrinks (e.g. executing transfers)
- - personal Data received from Third Parties (e.g. from the commercial register, or other databases and national registers)
- - personal Data combined by Indiedrinks (e.g. history of provided services and Client communication)
4. Which Personal Data do we process?
The categories of Personal Data that Indiedrinks mainly, but not exclusively, collects and processes are the following:
- - person’s identification data (e.g. name, personal identification code, date of birth, details of the identification document (e.g. copy of passport, ID card and/or driving license))
- - contact details (e.g. address, phone number, e-mail address, language of communication)
- - data of the Data Subject’s employer and position
- - any financial and tax information
- - data about the Data Subject’s business activities and relationships with legal persons (e.g. information submitted by the Data Subject or retrieved from public registers or received through Third Parties for making transaction on behalf of a legal person)
- - information on the Data Subject’s authorisations
- - information relating to the provided services (e.g. performance or non-performance of Agreements, concluded and terminated Agreements, submitted applications, queries and complaints)
- - client’s satisfaction data (e.g. activeness of using the services, data on services used, Client’s complaints)
- - data connected with the website and account usage such as member ID, user ID, user PIN, login status, services which you plan to use, log information, device information, browser information, location information (if enabled), activeness of using services, Internet Protocol (IP) address
- - communication data (e.g. data collected via e-mail, messages and other communication means (incl. social media))
Indiedrinks primarily uses the following Personal Data for marketing purposes:
- - e-mail address and name of the Data Subject (incl. the Client)
- - information on the provided services
In addition to the categories of Personal Data explicitly stated in this Privacy Notice, Indiedrinks may collect additional and other Personal Data in accordance with the law, if needed
The provision of Personal Data for using services, e.g. registering an account, is statutory and required to enter into Agreement, therefore, Data Subject is obligated to provide required Personal Data. Without providing required Personal Data it is not possible to use services or some services are limitedly accessible, and Indiedrinks could refuse to provide services
5. For which purposes and on which legal bases do we process your Personal Data?
Indiedrinks processes your Personal Data primarily to:
- - manage customer relations in general, in particular to keep data updated and corrected by verifying and enriching data, respond to your requests and questions, notify about changes to services, provide customer support, based on:
- - performance of Agreement or in order to take steps at the request of the Data Subject prior to entering into Agreement or compliance with a legal obligation
- - provide access to services, provision of services, in particular to conclude and execute Agreement, establish an account, keep data updated and corrected by verifying and enriching data, delivery the goods, resolving Client’s complaints, based on: performance of Agreement or in order to take steps at the request of the Data Subject prior to entering into Agreement or compliance with a legal obligation
- - complying with requirements set out to us by law based on:
- - compliance with a legal obligation
- - prevent misuse of website and/or services and ensure adequate provisions of website and/or services, in particular to authorize and control access to and functioning of digital channels, prevent unauthorized access and misuse of those and to ensure the safety of information, based on:
- - performance of Agreement or take steps at the request of the Data Subject prior to entering into Agreement or compliance with a legal obligation or Indiedrinks’ legitimate interests to have control over authorizations, access to and functioning of website and services;protect interest of Indiedrinks, based on:
- - performance of Agreement or in order to take steps at the request of the Data Subject prior to entering into Agreement or compliance with a legal obligation or Indiedrinks’ legitimate interests to prevent, limit and investigate any misuse or unlawful use or disturbance of website and/or services
- - establishing, exercising and defending legal claims, based on
- - performance of Agreement or in order to take steps at the request of the Data Subject prior to entering into Agreement or compliance with a legal obligation or Indiedrinks’ legitimate interests to exercising legal claims
- - end marketing and useful information by e-mail, incl. market Indiedrinks services, special offers, promotions, contests or entitlements that may be of interest to you, based on:
- - consent of Data Subject or Indiedrinks’ legitimate interest;
administrate and improve the website and/or services, for our internal records, for statistical analysis, based on: Indiedrinks’ legitimate interests to improve its services;
improve technical systems and structure of information technology, based on:
- — Indiedrinks’ legitimate interests to improve its services.
In the case that we are going to use your personal data for other purposes as provided above, we will communicate it to you in a timely manner.
6. Who do we transfer your Personal Data to?
Indiedrinks transfers Personal Data to the following recipients:
- employees authorised by Indiedrinks for such purpose;
- public authorities (e.g. law enforcement agencies, courts, bailiffs, tax authorities, and supervisory authorities);
- sellers and/or manufacturers whose products are sold on the website (only in case of business-to-business relationship, and it involves only personal data of the company’s employee or representative);
- persons related to the provision of services and performance of Agreement concluded with the Client (e.g. payment intermediaries, providers of communication, IT, data processing, data backup, translation, courier and postal services, IT application providers, advertising and marketing partners, provider of the destruction of confidential documents, opposite parties of the court proceedings and their representatives);
- auditors, accounting service providers, financial consultants or other Indiedrinks’ consultants;
- payment default registrars to whom information is transmitted to enable Third Parties to assess the Client’s payment behaviour and creditworthiness;
- the debt collection service providers, courts and trustees in bankruptcy if the Client has violated Agreement;
- if the Client has violated the Agreement, the debt collection service providers, courts and bankruptcy or insolvency administrators;
- participants and/or parties involved with payment systems and payment solutions.
7. Where is Your Personal Data being processed?
As a general rule, Processing of Personal Data takes place within the European Union / European Economic Area (EU/EEA). If there is a need to Process Personal Data outside EU/EEA, the transfer will only take place if appropriate safeguards are implemented. Examples of appropriate safeguards include:
- an adequate level of data protection is in place in the country outside of the EU/EEA in accordance with the decision of the European Commission;
- existence of a valid Agreement containing standard contract clauses developed by the EU or approved codes of conduct or certifications or other similar things that comply with the GDPR.
In the absence of appropriate safeguards, Indiedrinks has the right to transfer Personal Data outside the EU/EEA in situations where:
- the Data Subject has given an explicit and informed consent about the lacking protection measures;
- it is necessary for the conclusion or performance of Agreement between the Client and Indiedrinks or for the implementation of pre-contractual measures taken at the request of the Data Subject;
- it is necessary for the conclusion or performance of a contract concluded in the interest of the Data Subject between Indiedrinks and another natural or legal person;
- it is necessary for the establishment, exercise or defence of legal claims;
- it is necessary in order to protect the vital interests of the Data Subject or other persons, where the Data Subject is physically or legally incapable of giving consent;
- the transfer is made from a register which according to European Union or national law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by European Union or national law are fulfilled in the particular case;
- the transmission is not repetitive, concerns only a limited number of Data Subjects, is necessary to protect Indiedrinks’ legitimate interests, for which the interests, rights or freedoms of the Data Subject are not predominant, and if Indiedrinks has assessed all data transfer circumstances and established based on the assessment appropriate safeguards for Personal Data protection. Indiedrinks will notify the supervisory authority of the transfer.
For receiving more information about the transfer of Personal Data outside the EU/EEA, please contact us by e-mail: privacy-ee@indiedrinks.direct
8. How long do we store your Personal Data for?
Indiedrinks does not Process Personal Data for longer than it is necessary for the purposes related with such data and/or to comply with the statutory data storing obligations. The retention period may also be based on the Agreements with the Client (e.g. to settlement a dispute arising from the Agreement concluded with the Client), Indiedrinks’ legitimate interest or applicable law (e.g. legislation about accounting or limitation period).
As a general rule, the retention period for Personal Data and documentary evidences used in the course of provision of our services is maximum of 5 years. Personal Data Processed under your consent will only be Processed until the consent is withdrawn.
9. Responsible persons and Indiedrinks contact details
INDIEDRINKS EE OÜ is the controller for the Processing activities described in this Privacy Notice. If you have any questions regarding the Processing of your Personal Data, please contact us in the following ways:
- address: Suur-Sõjamäe 14, 11415 Tallinn, Estonia
- e-mail address: privacy-ee@indiedrinks.direct
Indiedrinks will reply to the request within 30 days after receiving the request. If more time is needed to reply to the request, Indiedrinks may extend the term for responding by a reasonable time.
10. Children Under the Age of 18
Indiedrinks’ services are not intended or directed at individuals under the age of 18. Therefore, individuals under the age of 18 may not access or use the services on the website.
11. What rights do you have and how to use them?
The Data Subject has the following rights in connection with the Processing of his/her Personal Data:
- to obtain information about the Processing of their Personal Data and the right to request a copy of the Personal Data being Processed;
- to request the rectification of their Personal Data if it has changed or is otherwise inaccurate;
- to object to the Processing of their Personal Data if the Processing of Personal Data is based on a legitimate interest. For example, the Client may prohibit the use of their contact information for sending offers, to use it, the Client can remove itself from the list of the recipients upon receipt of the marketing email;
- to request restriction of the Processing of their Personal Data, for example at a time when Indiedrinks assesses whether the Client is entitled to delete its Personal Data;
- to withdraw their consent for Processing of Personal Data. Upon withdrawal of the consent, Indiedrinks will no longer Process the Personal Data of the Data Subject for the purpose of the respective consent. The consent is valid until it is withdrawn;
- data portability right;
- to request deletion of their Personal Data, for example, if Indiedrinks has no right to Process such data or if the Processing of Personal Data is based on a consent and the consent has been withdrawn. Such right does not apply (or to such an extent) if Processing of Personal Data that is requested to be deleted is also been Processed for other legal bases, for example, under Agreement or for the performance of legal obligations;
- to contact us at any time regarding the use of their Personal Data. To do so, please send us an e-mail at privacy-ee@indiedrinks.direct. You also have the right to lodge a complaint to the Estonian Data Protection Inspectorate (website: www.aki.ee) or to a competent court.The Data Subject can exercise its rights by contacting us at [email]. We will respond to the request without delay, but not later than within one month from receiving the request.
12. Validity and changes to Privacy Notice
Indiedrinks has the right to unilaterally amend the Privacy Notice at any time in accordance with the applicable law.
Indiedrinks will notify the Data Subject of any changes to the Privacy Notice via the website and by the e-mail at least one month before the changes take effect, except if the Privacy Notice is amended as a result of changes in legislation.