Last updated: August 21, 2024

This Privacy Policy (hereafter referred to as the “Policy”) provides detailed information on how Proventum Key OU (hereafter referred to as the “Company”) manages and protects the information and personal data you provide, which enables us to effectively uphold the relationship you have established with us.

This Policy applies to our websites, applications, products, and/or services that link to this Policy or do not have a separate privacy policy (collectively referred to as “Our Services”). The primary objective of this Privacy Policy is to give you a clear understanding of the types of data we collect, the reasons for our data collection, the methods we use to handle this data, the third parties with whom we may share your personal data, your rights regarding the collection, processing, and sharing of this data, and other related privacy and data security matters.

Any personal data you provide or that we already possess will be processed in accordance with the standards specified in this Policy. Information may be submitted through any of the Company’s websites (“the Website”), designated phone numbers, or via any other means the Company may provide from time to time.

By reviewing this Policy, you acknowledge and agree that your personal data may be processed in accordance with the methods outlined herein. If you do not agree with the terms of this Privacy Policy, we kindly ask that you refrain from using the Website or providing us with any personal data.

All references to “the Company,” “Us,” “We,” or “Our” in this Policy refer to the Data Controller, Proventum Key OU, with registration number 16971510 and a registered address at Harju maakond, Tallinn, Kesklinna linnaosa, Tartu mnt 83-205, 10115, Estonia.

The processing of personal data described in this Policy will comply with:

• The Personal Data Protection Act of Estonia (hereafter referred to as the “DPA”) and any associated legislation, subject to future amendments.

• Regulation (EU) 2016/679 of The European Parliament And of The Council of 27 April 2016  On The Protection of Natural Persons With Regard to The Processing of Personal Data And On The Free Movement of Such Data, And Repealing Directive 95/46/EC (General Data Protection  Regulation)” (hereinafter referred to as “the Regulation” or “GDPR”).

The DPA and GDPR are collectively referred to as the “Data Protection Laws.” The Company functions as the “Data Controller,” meaning we determine the purposes and methods of personal data processing in compliance with the applicable Data Protection Laws.

Definitions

• Data Controller: A natural or legal person, public authority, agency, or other body that determines the purposes and means of processing personal data, whether independently or jointly with others. If the purposes and means of such processing are dictated by Union or Member State law, the designation of the Controller and the specific criteria for its appointment may also be defined by applicable law.

• Data Processor: Refers to a natural or legal entity, public authority, agency, or other body that processes personal data on behalf of the Data Controller.

• Personal Data: Any information that can identify you as an individual or relates to an identified or identifiable individual.

Security Measures

The Company implements various security protocols to ensure the protection of your personal data. These measures include storing your personal data on encrypted hard drives, utilizing antivirus and anti-spam software, regularly updating passwords for all staff computers, and employing additional protective strategies.

Commitment to Personal Data Protection

We are committed to safeguarding your personal data through advanced security processes and systems that meet industry standards. Our commitment extends beyond maintaining high quality and standards; it involves strict adherence to relevant legal requirements. We will only process personal data when there is a legitimate reason based on one of the legal grounds established under the GDPR.

Processing Based on Legitimate Interests

We may process your personal data if there is a legitimate business reason to do so. In these cases, we are dedicated to protecting your personal data and ensuring that our processing activities are fair, transparent, and do not adversely affect your rights or interests.

If we decide to process your personal data based on legitimate interests, we will inform you of our reasoning and provide an opportunity for you to ask questions or raise objections regarding such processing. Please note that the Company may not be required to cease processing if our justification for doing so outweighs your objections.

Processing Based on Your Consent

Consent is one of the ways we can process your personal data, but it is not the only legal basis we may rely upon. We will only depend on your consent where no other valid legal grounds apply, such as compliance with legal obligations or legitimate interests. If we process your personal data based on your consent, you retain the right to withdraw that consent at any time and using the same method you initially provided it. If you choose to withdraw your consent, we will evaluate whether we can continue processing your personal data under another legal foundation; if so, we will inform you of that option. Withdrawal of your consent will not affect the legality of any processing activities performed prior to that withdrawal.

Data Retention Policy

The Company is committed to protecting all personal data and will only use it for purposes consistent with applicable Data Protection Laws and other relevant legislation. We will retain your personal data for as long as necessary, based on the original purpose for which it was collected. Determining what is necessary will depend on the specific type of personal data involved and our relationship with you, including its duration.

Typically, we will determine if EU and/or Estonian laws (e.g., tax or corporate laws) require us to retain specific personal data for defined periods, in which case we will keep the data for the maximum length mandated by those laws.

Moreover, we will consider any legal or contractual claims you or third parties may raise against us and their corresponding limitation periods (typically five years). If applicable, we will preserve relevant personal data required to defend against claims, disputes, or similar actions initiated by you or others for the necessary duration.

When your personal data is no longer needed, we will either securely delete it or anonymize it.

Failure to provide necessary personal data may hinder the Company’s ability to meet its legal and regulatory obligations. Thus, not providing required information may affect our ability to offer certain products and/or services to you.

Categories of Personal Data, Purpose of Processing, and Legal Basis for Processing:

The Company may also gather personal data from publicly available sources such as web searches, company registries, and broadcast media, as long as such actions are reasonable and do not infringe on your rights and freedoms.

Processing Based on Consent

To clarify, in specific situations where we cannot or choose not to rely on another legal basis (such as our legitimate interests), we will strictly process your personal data on the basis of your consent.

When processing data on the basis of your consent, we will obtain your consent in a clear and explicit manner. You have the right to withdraw your consent at any time, using the same method you originally provided it. If you submit a request to withdraw your consent (by contacting us using the addresses provided below), we will determine if an alternative legal basis exists for processing your personal data (for example, if we are obligated to process it). If a valid basis exists, we will notify you accordingly.

When we ask for your personal data, you always have the choice to decline. However, if you refuse to provide the necessary data required to deliver requested services, we may be unable to fulfill those services, particularly if consent is our sole legal justification for processing.

Cookies and Tracking Technologies

When you visit our website, we automatically collect certain categories of personal data through the use of cookies and similar technologies.

Additional Purposes for Using Personal Data

Beyond the specific uses mentioned, we may also need to retain and utilize personal information for purposes such as loss prevention and safeguarding our rights, privacy, safety, or property, as well as that of other individuals, in accordance with our legitimate interests.

Disclosure of Personal Data to Third Parties

Your personal data may be shared with authorized third parties located within or outside the European Union/European Economic Area (EU/EEA), where such disclosures are permitted or required under Data Protection Laws or applicable legislation. These authorized third parties may include, but are not limited to, entities within the Company, law enforcement agencies, collaborating accounting and auditing firms, regulators, relevant authorities, and digital marketing providers. We may also share your personal data with organizations that have referred you to us, third parties you have authorized us to share data with, or any other entities necessary to provide the products and/or services you requested.

The specific personal data shared will depend on the products and/or services you choose to utilize. In any case where personal data must be transferred outside the EEA, we ensure that appropriate measures are in place to protect your data. Your personal data will never be shared with third parties for marketing purposes without your explicit consent.

Data Accuracy and Maintenance

We make every effort to ensure your personal data is accurate and up-to-date. You have the right to inquire about the accuracy of the information we hold about you at any time. If you identify any inaccuracies, we are committed to making the necessary corrections or deletions.

Transfer of Data Outside the EEA

Your personal data will only be transferred outside of the EEA or to any other countries that the European Commission has deemed to provide an adequate level of protection (known as “white-listed countries”) under the following circumstances:

• When you have explicitly consented to the transfer.

• When it is necessary for the execution of a contract between you and the Company.

• To comply with any legal obligations.

If personal data is transferred outside of the EEA, whether within the Company or to business partners, we ensure that appropriate safeguards are in place to maintain the same level of protection required within the EEA. You have the right to request a copy of these safeguards by contacting us at the address provided below.

Your Rights as a Data Subject

The Company is committed to helping you exercise your rights regarding your personal data. In specific situations, we may need to verify your identity before processing your request.

• Right of Access: You may inquire whether we are processing any personal data related to you. If we are, you have the right to access that information alongside relevant details such as:

  • The personal data we hold.

  • The reasons for processing that data.

  • The individuals or entities with whom we share it.

  • The expected duration of data retention.

  • Whether the data is transferred abroad, along with the protections in place.

  • Your rights concerning your personal data.

  • Procedures for filing a complaint.

  • The source of your personal data and any automated decision-making processes involved.

• Right to Rectification: You may request corrections to any inaccurate or incomplete personal data regarding you.

• Right of Erasure (the “Right to be Forgotten”): You have the right to request the deletion of your personal data, and we will do so promptly unless:

  • The personal data is no longer necessary for the purposes it was collected.

  • You have withdrawn consent (in cases where consent is the basis for processing), and we have no other legal grounds for continuing the processing.

  • You have successfully exercised your right to object to processing.

  • The data has been unlawfully processed.

  • There are legal obligations that require us to continue processing.

  • Special circumstances concerning children’s rights are applicable.

In any case, we are not obligated to comply with your erasure request if we need the data for legal obligations.

• Right to Restrict Processing: You can request that we limit the processing of your personal data under specific conditions, such as disputing its accuracy, opposing unlawful processing, needing the data for legal claims, or pending verification of our legitimate grounds for processing.

If you successfully exercise this right, we may only process your personal data:

• Where you have given consent.

• For the establishment, exercise, or defense of legal claims.

• To protect the rights of another individual.

• For important public interests.

• Right to Data Portability: You have the right to request a copy of your personal data that you previously provided us.

You may exercise this right when:

• The processing is based on your consent or the performance of a contract with you.

• The processing is automated.

• Right to Withdraw Consent: Kindly refer to the “Processing Based on Your Consent” section for more details regarding your right to withdraw consent.

• Right to Object to Processing: Under certain conditions, you may object to the processing of your personal data. If our processing is based on:

  • The necessity of processing for tasks carried out in the public interest.

  • The necessity of processing for legitimate interests pursued by us or another third party.

Processing will only cease if the Data Controller fails to provide compelling reasons that outweigh your objections.

If your data is processed for direct marketing purposes, you can object to the processing at any time.

For any matters not previously specified, the general right to object will not apply.

• Right to Lodge a Complaint: As a data subject, you have the right to submit a complaint to the relevant Data Protection Supervisory Authority if you believe your rights have been violated by the Company. In Estonia, the appropriate supervisory authority is the Data Protection Inspectorate:

  • Email: info@aki.ee

  • Phone: +372 627 4135

  • Address: Tatari 39, Tallinn 10134, Estonia

We encourage you to try to resolve any issues with us before reaching out to the Data Protection Inspectorate.

It is essential to recognize that the Company may refuse requests if there are valid grounds for doing so. Such refusal does not inhibit your right to file a complaint with the relevant data protection authority.

Company Contact Information

If you have any questions or comments regarding privacy or wish to exercise any of your individual rights, please contact us at info@provetum.ee or reach out via the address provided above.