The EU’s General Data Protection Regulation sets out the requirements that we as a data controller have to follow when processing personal data. In addition to the role of a controller, we may also act as a processor (e.g. when processing data of customer contact persons or employees). As a processor, we process personal data only on behalf of the controller on the basis of a contract or other legal instrument.
What personal data do we process and when?
Personal data means any information relating to an identified or identifiable natural person (data subject). In particular, a natural person is identifiable by reference to an identifier (name, personal identification code, residence, location, e-mail address, telephone number, network identifier) or to one or more physical, physiological, genetic, mental, economic, cultural or social characteristics.
Special categories of personal data are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership, genetic data, biometric data used to uniquely identify a natural person, health data or data concerning the sex life and sexual orientation of a natural person.
We process your personal data in the following cases:
We use the personal data contained in your memoranda, request for information, request for explanation or other request (for example, when exercising your rights relating to your personal data) to process your request and respond to you. If we have to send inquiries to a third party in order to respond to you, we will disclose your personal data only to the extent that is absolutely necessary.
If we need to disclose your or a third party’s restricted personal data in order to respond to you, we need to be sure of your identity. Therefore, you must sign your request in person or digitally.
The record of your request is visible under the Public Information Act in our document register. In the case of registered restricted documents, instead of the name or content of the document, only the initials of the sender or recipient are visible in the public document register. If you have sent us an inquiry that we are not competent to answer, we will pass it on to the necessary institution. We will inform you of forwarding of the request.
Access restrictions apply to correspondence with private persons. If somebody wants to see your correspondence and makes a request for information, we will check whether the requested document can be released in full or only partially. Access restrictions depend on the content of the document. Possible grounds for access restrictions are set out in section 35 of the Public Information Act.
Regardless of access restrictions, we will release documents to an authority or person who has a direct legal right to request them (e.g. an investigating authority, an extrajudicial body or a court).
Correspondence with private individuals (requests for information, memoranda, etc.) will be kept in the document management system for five years. Documents exceeding this deadline are destroyed.
We may process your personal data in the context of public procurement and the performance of a contract if you are named as a contact person, specialist, etc. in the tender or contract. In such cases, we will process your personal data to the extent necessary for the purposes stated by the tenderer involved in the procurement or the contracted partner in the performance of the contract. The same conditions apply if subcontracting is used for the performance of the contract.
In order to provide you with our services, manage customer relations and fulfil our promises to our existing or potential customers, we need your contact information for the following activities:
- preparing and performing contracts with customers and providing them with the offers and information they request;
- providing support to users of our services;
- continuously improving our services through customer feedback;
- invoicing, making payments and other financial transactions.
Contracts will be kept for 10 years from the termination of the contract. Contracts that have exceeded this deadline are destroyed and the information deleted.
Information on vacancies and internships is available on our website.
When you apply for a job or an internship with us, we will use the information you provide only for the following purposes:
- to assess your application;
- to assess your qualifications and make decisions about recruitment;
- for communication purposes, such as providing information about possible dates for a job interview;
- to compile basic information to be used if you are recruited.
The personal data of the candidate will be processed by the employees involved in the recruitment process. Other employees do not have access to your personal data when you apply for a job.
Candidates’ personal data are collected when they submit the documents required in the call for applications, whereas:
- we proceed from the candidate’s own published information as well as public sources (including media, e.g. articles, recordings, social networks, blogs, public records, including criminal records, business records, court decisions);
- the candidate has the right to know what data RIT has collected about them;
- the candidate has the right to access the data collected by RIT and to provide explanations and objections;
- we will assume that the candidate has given their consent to the referees mentioned in the application documents to answer questions about the candidate, and that the referees have agreed that we may contact them for information;
- we will not disclose your details to other candidates, nor will we disclose details of other candidates to you.
The information of applicants is restricted information, which third parties (including competent agencies) may access only in cases stipulated by law. We keep the personal data of applicants for the purpose of resolving any legal disputes that may arise during the recruitment process until such a claim expires (after one year).
We keep correspondence on employment, personnel and other matters for five years. We keep internship, authorisation and employment contracts for ten years from the date of their termination. Documents exceeding the deadline are destroyed.
When you visit our office at Lõõtsa 8a, Tallinn, you will be welcomed by the person who invited you. Our employee has the right to ask you for identification to verify your identity. If necessary, you will be given a guest card that will give you access to the meeting room. You can move around the building with the person you are visiting.
We have 24-hour video surveillance in and around our office. Your movements in the building and on the premises (parking lots, areas adjacent to the building) are recorded for security reasons. Video recordings and door card logs are managed by the Tax and Customs Board. Video recordings are kept for 2 months and door card logs for 1 year.
We are the data controller of the website. Our website is administered by a data processor, the Government Office. Questions regarding data protection should be sent to [email protected].
In our public online pages, we automatically collect information about visitors, which is stored in log files. This information may include the user’s IP address, location, time of visit, type of browser used, information about the operating system, history of visits to pages and technical data, such as information about plug-ins used (Java etc.).
We generally process the data of our website visitors in a non-personalised form. We use the information collected to improve our website. It may also be necessary to use the visitor’s IP address to identify problems in the server of the Government Office, administer the website, analyse trends and get an overview of the activity of visitors to the website.
Our online environment also uses cookies. We use Google Analytics, a web analytics service provided by Google Inc. to help us collect information about how our website is used. We need this information to improve the user-friendliness of the website; for example, to highlight the information you are looking for.
Google Analytics cookies collect, among other things, the following data:
- IP address;
- the number of visitors to the website;
- the source of the visit (country);
- the pages viewed by visitors;
- the time a visitor spends on one page or another.
Information about your use of our website will be transmitted to and stored by Google on its servers. This information is used to compile general overviews of website usage, which do not include any personalised information about the user. For more information see Google’s privacy policy.
If you, as a user of our website, do not want the above-mentioned data about you to be transmitted to Google Analytics, you can opt out. To do this, you need to download and install this add-on to your browser.
In addition to Google Analytics, we may also use other web analytics services, such as React&Share, on our managed websites. For more information, see the React&Share privacy policy.
Privacy policy
We process personal data based on the following principles.
- Processing of personal data is lawful, fair and transparent. Personal data are collected and processed for a specific purpose and as minimally as possible. Personal data are accurate and their correction is ensured.
- Personal data are stored only for a specified period of time and then deleted.
- Personal data are processed using security measures to protect them against unlawful access and accidental loss or destruction.
You have the following rights regarding all personal data collected about you:
- right to access your data;
- right to receive information about your personal data;
- right to request the correction of inaccurate data;
- right to request the restriction and termination of processing;
- right to object;
- right to contact the Data Protection Inspectorate and/or an administrative court.
Your rights regarding the personal data collected
A natural person has the right to obtain confirmation as to whether personal data concerning them are being processed and if so, the right to request access to them. You need to submit an application to gain access to the information. We need to be sure of your identity when issuing personal data, so you must sign the request in person or digitally. We will disclose the data in the way you want as soon as possible, but no later than one month after receiving your request. If it is not possible to provide the data within one month, we will inform you and extend the deadline for responding by up to two months.
We may charge a fee of up to 0.19 euros per page of information issued on paper from the 21st page onwards (unless a state fee for issuing information is provided for by law).
If we have collected data about you, you have the right to know the purpose of the collection, to whom your personal data has been or will be disclosed, how long the data will be retained and, if the data was not collected from you, the source of the data.
Your right to access your data and to obtain information about the persons to whom we have disclosed your personal data may be limited if the disclosure of the data or information to you may:
- damage the rights and freedoms of another person;
- obstruct the prevention of a crime or apprehension of a criminal;
- make it difficult to determine the truth in criminal proceedings; or
- threaten the protection of the secrecy of a child’s parentage.
If you discover that the information we hold about you is inaccurate or does not correspond to reality, you have the right to request that the inaccurate personal data be corrected or supplemented. To do this, submit a personally or digitally signed request, together with supporting evidence and a description of the circumstances. We will communicate information about the rectification, erasure or restriction of processing to anyone to whom the personal data have been disclosed, unless this proves impossible or involves a disproportionate effort.
If there is no lawful basis (any longer) for processing, disclosing, using for a particular purpose or granting access to your personal data, you can request the restriction or termination of the use of your data, their deletion, or the restriction or termination of their disclosure and access to the data. All you need to do is submit a reasoned application that you have signed by hand or digitally.
You also have the right to object to the processing of your personal data. All you need to do is submit a reasoned application that you have signed by hand or digitally to [email protected].
If you think that your rights and freedoms have been infringed by the processing of your personal data, you have the right to refer the matter to the Data Protection Inspectorate or to an administrative court.
Personal data breaches
We document all breaches of personal data, including the circumstances of the breach, the impact and the measures taken. We will notify the supervisory authority (the Data Protection Inspectorate) of the breach without undue delay and, where possible, within 72 hours of becoming aware of it, unless the breach is unlikely to pose a risk to the rights and freedoms of natural persons. In the event of a high risk to the rights and freedoms of the data subject, the data subject will be informed. The purpose of informing is to enable you to take the necessary precautions to mitigate the situation.
Questions about our data protection terms and conditions should be sent to [email protected].
Last updated: 14.08.2023
