General principles of processing personal data in Riigi Kinnisvara AS

The aim of the general principles of processing personal data is to ensure the protection of natural persons when processing personal data in Riigi Kinnisvara AS.

As of 25.05.2018, personal data protection law is regulated by the directly applicable Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 (hereinafter Regulation). Riigi Kinnisvara AS has taken appropriate measures to secure the protection of personal data and ensure that the processing of personal data complies with the above Regulation.

Terms and definitions:

1. Data Subject – a person on whom Riigi Kinnisvara AS has information or information that can be used to identify a natural person.
    
2. Personal Data – any information about a natural person that allows that person to be identified directly or indirectly. Direct identification is possible, for example, on the basis of name, date of birth, personal identification code, e-mail address, residential address, user names, phone number or a photo of a person. Indirect identification is possible, for example, on the basis of IP-address, nickname, economic status or car data.
    
3. Processing of Personal Data – any operation performed on the Personal Data of the Data Subject. For example, collection, recording, organisation, storage, alteration and publication of Personal Data, grant of access, consultation and retrieval, use, transmission, cross-usage, combination, blocking, erasure or destruction of Personal Data, or several of the aforementioned operations regardless of the manner in which they are performed and the means used.

Riigi Kinnisvara AS undertakes to comply with the following principles of processing Personal Data:

• the principle of lawfulness, fairness and transparency;
• the principle of purpose limitation;
• the principle of data minimisation;
• the principle of accuracy;
• the principle of storage limitation;
• the principle of integrity and confidentiality;
• the principle of accountability.

Riigi Kinnisvara AS implements relevant technical and organisational measures to ensure security appropriate to the data. Riigi Kinnisvara AS is required to give information to persons on the terms and conditions of the processing of their Personal Data and their rights.

Riigi Kinnisvara AS processes Personal Data on the basis of the Regulation proceeding from legitimate interest, compliance with a legal obligation or a contract; as a controller Riigi Kinnisvara AS primarily collects the following Personal data:

• Personal Data and contact information learned on the basis of a contract;
• Personal Data (name, date of birth, education and other data the person has disclosed during the application process) related to applying for a position or a traineeship;
• data relating to a person which are obtained through their request for explanation, letter of formal notice and other correspondence;

Riigi Kinnisvara AS erases or destroys information containing Personal Data within three months after the end of the need to use the data.

Riigi Kinnisvara AS maintains a register of processing activities and has appointed a data protection specialist who is responsible for checking that this document and related legislation is complied with.

Rights of persons

Persons have the right to request information from Riigi Kinnisvara AS if their Personal Data is processed. Persons have the right to:

• request access to Personal Data concerning them;
• request the rectification of data if the information stored is wrong or incomplete;
• restrict the processing of Personal Data;
• object to the processing of Personal Data;
• request the erasure of Personal Data;
• request the transfer of Personal Data;
• withdraw the consent for processing of Personal Data.

In cases where persons want to limit the processing of Personal Data or cancel their consent for processing Personal Data or request the erasure of their Personal Data, a corresponding written request must be submitted to the data protection specialist of Riigi Kinnisvara AS.

Persons have the right to request that no decision be made about them based on automated processing.

Persons also have the right to receive their Personal Data or forward their Personal Data to a different data processor. The above right only applies to data for which the person has granted his/her consent to Riigi Kinnisvara AS. In order to use the above right, persons have to submit a corresponding written request to the data protection specialist of Riigi Kinnisvara AS.

Contact information in case of questions

If you have any questions on the processing of Personal Data, write to the data protection specialist at andmekaitse@rkas.ee.

Persons who are not satisfied with the reply have the right to submit a complaint to the Data Protection Inspectorate.