GDPR
1. Introduction
We understand you are aware of and care about your privacy and personal data, and we approach the matter seriously and responsibly. We value the privacy of our customers, suppliers, subcontractors, cooperation partners and employees.
2. Who are we?
The data controller is Columbia-Kivi AS (hereinafter Columbia-Kivi). We produce masonry and
paving stones. Our offices are located in Tallinn and Tartu; we operate in Estonia.
We can be contacted via telephone +372 52 455 17 or e-mail info@columbia-kivi.ee
The postal address of our office in Vana-Kastre küla, Kivitehase, 62313, Kastre vald, Tartumaa.
3. What is personal data?
Personal data comprise all information that can be used to personally identify you, either directly or indirectly. Such data include your personal identification code, name, e-mail address, mobile phone number, computer IP address, etc.
4. How do we obtain your personal data?
We obtain your personal data, primarily your work-related contact details, when you contact us – when you email us to the company’s general and employee email addresses or send us a letter via postal services.
We have access to your work-related contact details, when we participate in a construction project that also involves your employer;
When you visit our construction site and are caught in the visual field of a security camera.
Sometimes, we may obtain your personal data from publicly accessible sources like your company website, information catalogues and advertising materials, where the data has been disclosed.
Sometimes, our partners and customers forward us your work-related contact details.
5. Categories of personal data that we process
Generally, our main customers are other companies. Therefore, the personal data that we process comprise your name and work-related contact details, e.g. work telephone number, e-mail address, job position.
If you send us your CV, we will process the personal data contained in the CV, e.g. experience, education, previous positions, residence, etc.
Video images, when you are caught in the visual field of a recording security camera on a construction site.
Unknowingly, we may become data controllers of other data not mentioned above, when you have presented the data to us for some reason.
6. Personal data of special categories
Personal data of special categories comprises data, which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, genetic data, biometric data allowing the unique identification of a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
Rand ja Tuulberg does not collect or process your personal data of special categories. If you have presented to us personal data that can be considered belonging to special categories, we will stop processing these data as soon as possible or undertake to request your explicit consent to process these data.
We do not knowingly collect information about children. If we have obtained personal data about a child, we will stop processing these data or undertake to process these data only on the basis of the consent of the parent or for the purposes of fulfilling legal obligations.
7. Purposes and basis of data processing
We process personal data only for the purposes that we have obtained the data for.
We presume that if you have presented us with your contact details, you already have a contractual relationship with Rand ja Tuulberg or you are interested in signing a contract.
If you have contacted us for other matters and thereby presented us your contact details, and you are waiting for a response, we will only process your personal data for providing a response. The purpose and obligation for processing the data is to provide a response, and this is based on our, the data controller’s, legitimate interest.
The purpose of recording video images is to secure a construction site and this is based on our legitimate interest.
In certain cases, we may also process your data due to the relevant legislation requirements, i.e. for fulfilling the legal obligations of the company.
8. How do we process and maintain your personal data?
Your letter containing personal data will be forwarded only to relevant people, depending on the content of the letter.
We will process your personal data in Estonia, and in Ireland or Holland, where Microsoft servers, whose IT services we use, are hosted.
We will immediately delete or destroy all letters containing personal data that, in our opinion, are not relevant to Rand ja Tuulberg. Such letters may include fishing letters, spam and other similar materials.
If we already have a contract with you or your letter indicates an intention to sign a contract, we will add your contact details to our customer or supplier database and maintain the data as long as it is necessary for fulling the respective contract. We review the content of these databases once a year and delete all information that is no longer necessary.
Communication containing subjects other than matters related to providing construction services are reviewed once a year and if the problem or matter in the letter has been solved, we will delete the communication.
The period of maintaining video image recordings from security cameras cannot be revealed due to security reasons, but the recordings are later viewed only in case of accidents at work or thefts.
We will also process your personal data in case it is required by legislation. In such cases, we will maintain the personal data according to maintaining periods required by legislation.
9. How do we protect your personal data?
We will protect your personal data by adopting relevant security measures in information technology, physical as well as organisational form. For example, your personal data can be accessed only by employees with relevant authorisation. We use firewalls and other IT solutions to prevent unauthorised people from accessing the Rand ja Tuulberg computer network. We maintain documents containing personal data in locked cabinets. It has to be emphasized that maintaining the safety of data is an ongoing process that needs to be dealt with regularly, but nevertheless, 100% safety can never be guaranteed.
10. Sharing data
We will not share your personal data with third parties, except in the following cases:
A third party provides us services necessary for the everyday operation of the company, for example IT services or security services for construction sites.
A third party participates in or performs subcontracting in a construction project that also involves your employer.
Sharing of data is required to fulfil obligations deriving from legislation.
11. Your rights
According to the General Data Protection Regulation (“GDPR”)
http://eur-lex.europa.eu/legal-content/ET/TXT/PDF/?uri=CELEX:32016R0679&from=ET
you have the following rights:
Right to obtain information and have access to personal data;
Right to erase personal data and to rectify incorrect personal data;
Right to restrict the processing of personal data;
Right to personal data portability;
Right to object to the processing of personal data;
Right to give or withdraw your consent to the processing of personal data;
Rights regarding individual decision-making based on automated processing, incl. profiling.
GDPR also specifies a number of limitations to the respective rights.
If you wish to obtain more information on the processing of your personal data by Rand ja Tuulberg, or if, in your opinion, we do not process your personal data according to the respective legislation, please contact us via the following channels:
E-mail: info@columbia-kivi.ee
Telephone: +372 52 455 17
Postal address: Vana-Kastre küla, Kivitehase, 62313, Kastre vald, Tartumaa
You also have a right to contact the Estonian Data Protection Inspectorate (EDPI), the contact details of which are available on their website:
http://www.aki.ee/et/inspektsioon/kontaktid-nouandetelefon
12. Changes to the terms and conditions of data protection
We are aware that the protection of personal data and privacy is an ongoing obligation and therefore, we reserve the right to change the terms and conditions of data protection from time to time.
The current terms and conditions of data protection have been confirmed by the management board of AS Columbia-Kivi.