top of page
HRBusiness-white.png
  • Facebook
  • Instagram
  • Телеграмма
  • TikTok

Privacy Policy

This Privacy Policy (hereinafter the "Policy") describes the procedure applied to the processing of personal data of data subjects by HR Hariduskeskus OÜ, registry code 17440602 (hereinafter "HR Hariduskeskus"), a legal entity established under the laws of the Republic of Estonia, who use HR Hariduskeskus's educational services (hereinafter the "Services") or are interested in them, where these Services are made available through www.hrharidus.ee (hereinafter the "Website") or by other means.

This Policy is applied in conjunction with HR Hariduskeskus's Terms of Use (hereinafter the "Terms"), as well as HR Hariduskeskus's Principles of Study Organisation and HR Hariduskeskus's Training Quality Assurance Principles. In the event of a conflict between the Policy and the Terms, or HR Hariduskeskus's Principles of Study Organisation, or HR Hariduskeskus's Training Quality Assurance Principles, the Policy shall prevail.

Terms and definitions set out in the Terms shall apply to this Policy, unless their application contradicts the provisions of the Policy.

The Policy has been established in accordance with the Personal Data Protection Act of the Republic of Estonia and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation). If there is a conflict between this Policy and the General Data Protection Regulation or the Personal Data Protection Act, the General Data Protection Regulation or the Personal Data Protection Act shall prevail. In the event of a conflict between the General Data Protection Regulation and the Personal Data Protection Act, the General Data Protection Regulation shall apply.

All terms and definitions set out in the General Data Protection Regulation shall apply to this Policy, unless their application contradicts the terms or definitions of the Policy.

Where HR Hariduskeskus processes the personal data of a data subject who is not a resident of the European Union, and the processing of such data subject's personal data is governed by the laws and regulations of other jurisdictions, including but not limited to the California Consumer Privacy Act (CCPA) and the Children's Online Privacy Protection Act and its implementing rule adopted by the Federal Trade Commission (COPPA), such laws and regulations shall apply to the extent that their application does not violate the General Data Protection Regulation and the laws and regulations of the Republic of Estonia.

The following terms and definitions apply to this Policy.

"Controller" – HR Hariduskeskus.

"Data subject" – a natural person who is:
a) a client of HR Hariduskeskus, as defined in the Terms, or
b) a natural person who is a representative or employee of a client that is a legal entity, or
c) a natural person who uses the Services at the request of a client that is a legal entity, or
d) a natural person who visits the Website or otherwise expresses interest in HR Hariduskeskus's Services.

"Processor" – a natural or legal person who:
a) is involved in the provision of the Service and processes the personal data of data subjects for the purpose of providing the Services (including HR Hariduskeskus's trainers), or
b) is involved in the processing of data subjects' personal data under a contract concluded with HR Hariduskeskus or a subsidiary of HR Hariduskeskus, or
c) is a subsidiary of HR Hariduskeskus.

"Services" – the services provided by HR Hariduskeskus under the Terms.

"Subsidiary" – a subsidiary of HR Hariduskeskus, as defined in the Terms.

"Third party" – a natural or legal person who is:
a) a supplier of a data subject's personal data to HR Hariduskeskus on a lawful basis set out in Article 6 of the General Data Protection Regulation, or
b) a recipient of a data subject's personal data from HR Hariduskeskus for purposes not related to the processing of personal data under this Policy.

"Usage data" – personal data regarding a data subject's online activity that is automatically collected either in the course of using the Services or from the Services' infrastructure. Usage data is anonymous and cannot be linked to a specific person.

HR Hariduskeskus processes the personal data of data subjects under this Policy in accordance with the following principles.

  • Personal data processing shall be carried out only in accordance with this Policy and applicable legislation.

  • Personal data processing shall be carried out only to achieve the purposes set out in the Policy.

  • HR Hariduskeskus processes only accurate and up-to-date personal data, which is retained only for as long as is necessary to achieve the processing purposes set out in the Policy.

SECTION 1. LAWFULNESS OF PERSONAL DATA PROCESSING

1.1. By visiting and/or browsing the Website, the data subject grants HR Hariduskeskus consent to process the data subject's personal data as set out in clauses 2.1.8.–2.1.9. of the Policy.

1.2. By registering for a course in accordance with Section 5 of the Terms, the data subject grants HR Hariduskeskus consent to process the data subject's personal data as set out in clauses 2.1.1.–2.1.7. of the Terms.

1.3. If the client is a legal entity that has entered into an agreement with HR Hariduskeskus for the provision of Services to natural-person data subjects, HR Hariduskeskus has the right to process the personal data of such client and of such client's representatives and employees, as set out in clauses 2.1.1.–2.1.7. of the Policy, in accordance with Article 6(1)(a) of the General Data Protection Regulation. However, HR Hariduskeskus shall not process the personal data of data subjects using HR Hariduskeskus's Services at the request of such a client, unless the client provides HR Hariduskeskus with the written consent of all such data subjects to the processing of their personal data under this Policy.

1.4. Even if a client who is a natural person does not give explicit consent to the processing of their personal data, but uses HR Hariduskeskus's Services or requests HR Hariduskeskus to provide Services, HR Hariduskeskus has the right to process such client's personal data, as set out in clauses 2.1.1.–2.1.7. of this Policy, for purposes related to the provision of Services under the Terms (Article 6(1)(b) of the General Data Protection Regulation).

1.5. If a data subject provides HR Hariduskeskus with the personal data set out in clause 8.2. of the Policy, the data subject grants HR Hariduskeskus consent to process such personal data for the purposes set out in clause 8.3. of the Policy.

1.6. If a data subject makes publicly available the personal data set out in clause 8.4. of the Policy, the data subject grants HR Hariduskeskus consent to process such personal data for the purposes set out in clause 8.4. of the Policy.

1.7. If a data subject refuses to give consent to the processing of personal data and there are no other legal bases for processing set out in Article 6 of the General Data Protection Regulation, HR Hariduskeskus has the right to refuse to provide Services or to restrict the data subject's access to the Website, if the provision of Services or access to the Website is not possible without the processing of such personal data.

SECTION 2. PERSONAL DATA PROCESSED

2.1. Under this Policy, HR Hariduskeskus has the right to process the following personal data of data subjects.

2.1.1. The data subject's first and last name.

2.1.2. The data subject's personal identification code (if the data subject is a citizen or resident of the Republic of Estonia) or the data subject's ID/passport number or taxpayer registration number (if the data subject is not a citizen or resident of the Republic of Estonia).

2.1.3. The data subject's email address and/or the data subject's contact details on a social network or a messaging environment (e.g. Telegram, Skype, etc.).

2.1.4. The data subject's phone number.

2.1.5. The data subject's home address.

2.1.6. The name and address of the person paying for the Services under the Terms.

2.1.7. Information about the data subject's profession or qualification, level of education, work experience, and professional interests.

2.1.8. Cookies and technically similar data, as defined in Section 7 of this Policy.

2.1.9. Usage data, including but not limited to the internet protocol address of the data subject's computer or phone (e.g. IP address), browser type, browser version, the pages of the Website visited by the data subject, the time and date of the visit to the Website, the time spent by the data subject on the pages of the Website, unique device identifiers, and other diagnostic data.

2.1.10. Personal data lawfully transferred to HR Hariduskeskus by third parties.

2.1.11. Other personal data voluntarily provided by the data subject, including client feedback about a trainer, submitted in accordance with Section 4 of the Terms and HR Hariduskeskus's Training Quality Assurance Principles.

2.2. Personal data not set out in clause 2.1. of the Policy may only be processed with the data subject's prior consent or on other bases for processing set out in Article 6(1)(c)–(f) of the General Data Protection Regulation.

2.3. HR Hariduskeskus does not process, and will not process, special categories of personal data set out in Article 9 of the General Data Protection Regulation (for example, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, etc.). If HR Hariduskeskus discovers that HR Hariduskeskus or a processor of HR Hariduskeskus has processed personal data set out in Article 9 of the General Data Protection Regulation, HR Hariduskeskus shall immediately delete such personal data and take reasonable measures to prevent the processing of such personal data in the future.

SECTION 3. PURPOSES OF PERSONAL DATA PROCESSING

3.1. HR Hariduskeskus has the right to process the personal data of data subjects set out in clauses 2.1.1.–2.1.7. of the Policy for the following purposes.

3.1.1. Provision of Services under the Terms.

3.1.2. Resolution of disputes arising with clients in accordance with Section 12 of the Terms.

3.1.3. Collection and evaluation of client feedback regarding the trainers offered, in accordance with Section 4 of the Terms and HR Hariduskeskus's Training Quality Assurance Principles.

3.2. HR Hariduskeskus has the right to process the personal data of data subjects set out in clauses 2.1.8.–2.1.9. of the Policy for the following purposes.

3.2.1. Statistical and analytical purposes.

3.2.2. Enhancing the data subject's experience in relation to the use of the Website.

3.2.3. Improving the performance of the Website.

3.2.4. Modifying the functionality of the Website in order to attract more clients for the Services.

3.2.5. Providing the client with all the functionality of the Website necessary for the provision of Services.

3.2.6. Providing technical support for the Website.

3.2.7. Analysing data subjects' interactions with the Website in order to modify the content and structure of the Website and other internet resources used by HR Hariduskeskus to provide the Services.

3.2.8. Analysing data subjects' interactions with the Website in order to create and launch marketing and advertising campaigns online.

3.3. HR Hariduskeskus has the right to process the personal data of data subjects set out in clause 2.1. of the personal data processing Policy for marketing and advertising purposes, which includes direct advertising (e.g. email newsletters, mass emails) and contextual advertising.

3.4. Depending on the nature of the personal data, HR Hariduskeskus has the right to process the personal data of data subjects set out in clause 2.1.11. of the Policy for the purposes set out in clauses 3.1.–3.3. of the Policy.

3.5. Depending on the nature of the personal data, HR Hariduskeskus has the right to process the personal data of data subjects set out in clause 2.1.10. of the Policy for the purpose set out in clause 6.1. of the Policy.

SECTION 4. DATA SUBJECTS AND CHILDREN'S PRIVACY

4.1. HR Hariduskeskus's Services are not directed at natural persons under 16 (sixteen) years of age. HR Hariduskeskus does not provide Services to clients under 16 (sixteen) years of age and does not knowingly process the personal data of data subjects under 16 (sixteen) years of age. HR Hariduskeskus takes all reasonable technical and organisational measures to prevent the processing of personal data of data subjects under 16 (sixteen) years of age.

4.2. If HR Hariduskeskus has doubts about a client's age, HR Hariduskeskus has the right to require the client to prove their age. If the client refuses to prove their age, or if HR Hariduskeskus discovers that the client is under 16 (sixteen) years of age, HR Hariduskeskus shall immediately terminate the Terms with the client, delete all personal data related to such client in accordance with this Policy, and restrict the client's access to the Services.

4.3. If the client is a legal entity, all natural persons for whom the client requests the provision of Services under the Terms must be at least 16 (sixteen) years of age. By agreeing to the Terms, the client guarantees to HR Hariduskeskus that all natural persons using the Services under the Terms are at least 16 (sixteen) years of age. If HR Hariduskeskus has doubts about the age of the natural persons for whom the client requests the provision of Services, HR Hariduskeskus has the right to require the client to verify the age of the natural persons using the Services. If the client refuses to verify the age of the natural persons using the Services, HR Hariduskeskus has the right to immediately terminate the Terms with the client, delete all personal data of the natural persons for whom the client requests the provision of Services, and restrict the access of the client and all natural persons to the Services. If HR Hariduskeskus discovers that any of the natural persons for whom the client requests the provision of Services are under 16 (sixteen) years of age, HR Hariduskeskus shall immediately delete all personal data related to such natural persons and restrict such natural persons' access to the Services.

4.4. If a data subject who is not a client and who is under 16 (sixteen) years of age transmits to HR Hariduskeskus any personal data referred to in clauses 2.1.1.–2.1.7. or clause 2.1.11. of the Policy, HR Hariduskeskus shall immediately delete such personal data and take reasonable measures to prevent the processing of such personal data in the future.

4.5. If a third party transmits personal data to HR Hariduskeskus in accordance with clause 2.1.10. of the Policy, and HR Hariduskeskus becomes aware that such personal data belongs to a data subject under 16 (sixteen) years of age, HR Hariduskeskus shall immediately delete such personal data and take reasonable measures to prevent the processing of such personal data in the future. HR Hariduskeskus shall also have the right to terminate the agreement with such third party under which the third party provided the personal data to HR Hariduskeskus.

4.6. If the Website or other technical tools used by HR Hariduskeskus process the personal data set out in clauses 2.1.8.–2.1.9. of this Policy, and HR Hariduskeskus determines that the personal data being processed belongs to a data subject under 16 (sixteen) years of age, HR Hariduskeskus shall take all reasonable measures to extract and delete such personal data.

4.7. If a person who holds parental responsibility for a data subject under 16 (sixteen) years of age contacts HR Hariduskeskus and provides evidence that HR Hariduskeskus is unknowingly processing the personal data of such a data subject, HR Hariduskeskus shall immediately delete such personal data and take reasonable measures to prevent the processing of such personal data in the future. If such a holder of parental responsibility notifies HR Hariduskeskus that HR Hariduskeskus is unknowingly processing the personal data set out in clauses 2.1.8.–2.1.9. of the Policy, HR Hariduskeskus shall take all reasonable measures to extract and delete such personal data and to prevent the processing of such personal data in the future.

SECTION 5. CONTROLLER AND PROCESSOR

5.1. Under this Policy, HR Hariduskeskus is the controller, as defined in Article 4(7) of the General Data Protection Regulation. The controller determines the purposes and means of the processing of data subjects' personal data and engages processors in the processing of personal data under this Policy.

5.2. The controller processes data subjects' personal data either directly itself or through processors. Processors process data subjects' personal data on behalf of the controller, as defined in Article 4(8) of the General Data Protection Regulation. All processors act under agreements concluded with the controller or a subsidiary of the controller, with the direct authorisation of the controller. The controller monitors that processors comply with the General Data Protection Regulation and other applicable data protection legislation.

5.3. Under this Policy, the controller has the right to use the following categories of processors for the processing of data subjects' personal data.

5.3.1. Trainers who teach on HR Hariduskeskus's courses under the Terms. Such trainers may only process personal data directly related to the teaching of courses under the Terms, including the personal data set out in clause 2.1.11. of the Policy.

5.3.2. HR Hariduskeskus's subsidiaries. Subsidiaries may directly process data subjects' personal data under the Policy. With the direct authorisation of HR Hariduskeskus, subsidiaries may also enter into agreements with other processors for the processing of personal data on behalf of the controller. If Services are provided through a subsidiary, HR Hariduskeskus remains the controller under this Policy.

5.3.3. Processors that provide technical support for the Website and other internet resources used by HR Hariduskeskus to provide the Services.

5.3.4. Processors that provide HR Hariduskeskus with web-based and other technical solutions aimed at the provision of Services and/or improving the quality of the Services.

5.3.5. Processors that assist HR Hariduskeskus in processing the personal data set out in clauses 2.1.8.–2.1.9. of the Policy.

5.3.6. Processors that assist HR Hariduskeskus in analysing and using the personal data set out in clauses 2.1.8.–2.1.9. of the Policy for advertising and marketing purposes (for example, Google Analytics, Meta for Business, etc.).

5.3.7. Processors that assist HR Hariduskeskus in resolving disputes with data subjects.

5.3.8. Processors that ensure the security of the Website and other internet resources used by HR Hariduskeskus for the provision of Services and the processing of data subjects' personal data.

SECTION 6. THIRD PARTIES AND THE USE OF PERSONAL DATA IN BUSINESS

6.1. HR Hariduskeskus may receive the personal data set out in clause 2.1.10. of the Policy from third parties in order to achieve the purposes set out in clauses 3.2.1.–3.2.8. and clause 3.3. of the Policy. Such third parties do not participate in the processing of personal data under this Policy. Third parties belonging to the following categories may provide HR Hariduskeskus with data subjects' personal data for the purposes set out in this clause.

6.1.1. Natural and legal persons who collect and/or analyse the usage data described in clause 2.1.9. of the Policy.

6.1.2. HR Hariduskeskus's business partners, contractors, and subcontractors who assist HR Hariduskeskus in providing the Services under the Terms, or who participate in HR Hariduskeskus's other business projects that are indirectly related to or unrelated to the provision of Services.

6.2. HR Hariduskeskus shall refuse to accept personal data from a third party if such personal data was obtained unlawfully by the third party. If HR Hariduskeskus discovers that a third party has unlawfully obtained a data subject's personal data, HR Hariduskeskus shall immediately delete such personal data and take reasonable measures to prevent the processing of such personal data in the future. HR Hariduskeskus shall also have the right to terminate the agreement with such third party who provided HR Hariduskeskus with unlawfully obtained personal data.

6.3. HR Hariduskeskus may transfer data subjects' personal data to third parties belonging to the following categories.

6.3.1. HR Hariduskeskus's business partners, contractors, and subcontractors who assist HR Hariduskeskus in providing the Services under the Terms, or who carry out other business projects of HR Hariduskeskus that are indirectly related to or unrelated to the provision of Services. Such business partners, contractors, and subcontractors may use data subjects' personal data only for the following purposes.

a) Analysis of personal data for the purpose of improving the Services and other services offered by HR Hariduskeskus or HR Hariduskeskus's subsidiaries.

b) Organising the provision of HR Hariduskeskus's Services or the implementation of other business projects.

c) Improving the design or functionality of the Website.

d) Assisting HR Hariduskeskus in launching and managing marketing and advertising campaigns.

e) Promoting HR Hariduskeskus's Services among current or potential clients.

6.3.2. HR Hariduskeskus's potential or current investors who are interested in investing in HR Hariduskeskus's business. Such third parties may only receive data subjects' personal data for the purpose of evaluating HR Hariduskeskus's business in order to make a decision on investing in HR Hariduskeskus's business. The disclosure of data subjects' personal data to such third parties is strictly limited to the purpose of the disclosure and is carried out under a non-disclosure agreement entered into with HR Hariduskeskus's potential or current investor. As a general rule, HR Hariduskeskus does not disclose to such third parties the personal data set out in clauses 2.1.1.–2.1.7. of the Policy.

6.3.3. Competent courts, supervisory authorities, or other governmental or municipal authorities of the Republic of Estonia or other jurisdictions. The disclosure of data subjects' personal data to such third parties shall take place only on the basis of an irrevocable lawful request from such third party, or where the disclosure takes place on the bases set out in Article 6(1)(c)–(f) of the General Data Protection Regulation.

6.4. HR Hariduskeskus may disclose data subjects' personal data to other categories of third parties not listed in clause 6.3. of the Policy, where the disclosure takes place on legal bases set out in the General Data Protection Regulation or in the applicable laws of the Republic of Estonia or other jurisdictions.

6.5. HR Hariduskeskus does not sell and does not intend to sell data subjects' personal data to third parties or other natural or legal persons. HR Hariduskeskus has not sold data subjects' personal data at any point during the past 12 (twelve) calendar months.

6.6. HR Hariduskeskus's Website may contain references to URL links of third-party websites and other internet resources, as well as those of other natural and legal persons. HR Hariduskeskus does not control or regulate the content of such websites or internet resources, nor the personal data processing rules applied to such websites or internet resources. The data subject is solely responsible for exercising caution when using websites and internet resources whose URL addresses are presented on the Website. HR Hariduskeskus shall not publish URL addresses of websites or other internet resources that violate applicable laws.

SECTION 7. COOKIES AND OTHER SIMILAR TECHNOLOGIES

7.1. Cookies, or cookie files, are small text files that are placed in browser directories and may contain an anonymous unique identifier. Generally, there are two types of cookies: session cookies and persistent cookies. A session cookie is used to make it easier for a person to navigate the Website, and it expires when the person closes the browser. A persistent cookie remains on the hard drive of the person's device for a longer period of time. Cookies cannot be used to run programs or to transmit viruses to a person's computer. Cookies are uniquely assigned to a person's device and can be read only by the web server of the domain that issued the cookie to the person's device. For more information about cookies, see: https://en.wikipedia.org/wiki/HTTP_cookie.

7.2. HR Hariduskeskus may use both session cookies and persistent cookies to help data subjects navigate the Website and the Services and to enable the Website's functions to be performed efficiently. Under this Policy, HR Hariduskeskus may in particular use the following cookies.

7.2.1. Session cookies. HR Hariduskeskus may use session cookies for the operation of the Services provided through the Website.

7.2.2. Preference cookies. HR Hariduskeskus may use preference cookies to remember the preferences and various settings of the data subject using the Website.

7.2.3. Security cookies. HR Hariduskeskus may use security cookies to make the use of the Website secure.

7.3. Through the use of cookies, HR Hariduskeskus may automatically collect information about the data subject's online activity on the Website. Such data may include the following.

7.3.1. Information about the pages of the Website visited by the data subject.

7.3.2. URL links that the data subject has clicked on the Website.

7.3.3. Searches performed by the data subject through the webpage.

7.4. The data subject has the right to accept or refuse the use of cookies using browser settings. If the data subject refuses the use of cookies, the data subject may not be able to use all the functions of HR Hariduskeskus's Website.

7.5. HR Hariduskeskus may also use other technologies for the processing of the personal data set out in clause 7.3. of the Policy, including the following.

7.5.1. Web beacons. Web beacons (also known as clear gifs, pixel tags, or web bugs) are tiny graphic images with a unique identifier, similar in function to cookies, and are used to track the online movements of Website users. Unlike cookies, which are stored on the user's device, web beacons are invisibly placed on a webpage or in an email, and the size of these web beacons is approximately the size of a period at the end of a sentence.

7.5.2. Tracking URLs. A tracking URL is a standard link to which parameters have been added for tracking and analysis purposes. A tracking URL has a unique identifier that makes it possible to identify the source of Website traffic (e.g. the location from which internet users visit the Website, or the search engine used by visitors when clicking on the Website's URL).

7.6. HR Hariduskeskus may also use web beacons and tracking URLs, as provided for in clause 7.5. of the Policy, in HR Hariduskeskus's marketing messages (including marketing mass emails) and in HR Hariduskeskus's online advertisements published on third-party websites.

SECTION 8. HR HARIDUSKESKUS AND SOCIAL NETWORKS

8.1. In order to promote information about HR Hariduskeskus, its Services, and the Website, HR Hariduskeskus may create accounts on social networks and messaging environments, including Facebook, Instagram, WhatsApp, and Telegram.

8.2. In order to communicate with HR Hariduskeskus, data subjects may follow HR Hariduskeskus's accounts on social networks and HR Hariduskeskus's channels on messaging environments. Data subjects may like HR Hariduskeskus's posts and comments, and may leave comments, reviews, or reactions under HR Hariduskeskus's posts and messages on social networks and messaging environments. Data subjects may also send messages to HR Hariduskeskus's accounts on social networks and messaging environments, including messages containing feedback on the performance of trainers teaching HR Hariduskeskus's courses.

8.3. The data set out in clause 8.2. of the Policy shall be treated as the personal data of data subjects set out in clause 2.1.11. of the Policy. Depending on the nature of the data being processed, HR Hariduskeskus may use such personal data of data subjects for the purposes set out in clause 3.1., clauses 3.2.1.–3.2.3., clauses 3.2.7.–3.2.8., and clause 3.3. of the Policy.

8.4. In addition to the personal data set out in clause 8.2. of the Policy, HR Hariduskeskus may also analyse the profile data that the data subject has published on their account on a social network or messaging environment, provided that such analysis does not violate the applicable terms and policies of the social networks and messaging environments. The analysis shall be carried out manually only, without automated decision-making. Such analysis may be carried out to achieve the purposes set out in clauses 3.2.7.–3.2.8. and clause 3.3. of the Policy.

SECTION 9. RIGHTS OF THE DATA SUBJECT

9.1. Every data subject has the following rights.

9.1.1. Right of access: the data subject has the right to obtain from HR Hariduskeskus information about the personal data processed by HR Hariduskeskus, the purposes of the personal data processing, the categories of recipients of the personal data, the period for which the personal data will be retained, and information about the transfer of personal data to other jurisdictions.

9.1.2. Right to lodge a complaint with a supervisory authority: the data subject has the right to lodge a complaint against HR Hariduskeskus with the supervisory authority of the data subject's habitual residence or place of work, or with the supervisory authority of the place of the alleged infringement, or with the supervisory authority of HR Hariduskeskus's place of establishment, which supervises HR Hariduskeskus's compliance with personal data legislation.

9.1.3. Right to rectification: the data subject has the right to have inaccurate data concerning the data subject corrected.

9.1.4. Right to erasure: the data subject has the right to have personal data concerning them erased.

9.1.5. Right to restriction of processing: the data subject has the right to restrict the processing of personal data on the bases set out in Article 18 of the General Data Protection Regulation.

9.1.6. Right to data portability: the data subject has the right to receive personal data concerning them in a structured, commonly used, and machine-readable format, and to transmit such data to another controller.

9.1.7. Right to object: the data subject has the right to object to the processing of personal data on grounds relating to their particular situation (for example, where HR Hariduskeskus processes personal data for marketing purposes).

9.1.8. Right not to be subject to a decision based solely on automated processing, including profiling.

9.1.9. Right to submit a request or complaint to HR Hariduskeskus as the controller. This right also includes the data subject's right to exercise remedies against HR Hariduskeskus in the courts of HR Hariduskeskus's or the data subject's country of residence, in accordance with Article 79 of the General Data Protection Regulation, and the right to exercise remedies against a supervisory authority in the country where the supervisory authority is established (Article 78 of the General Data Protection Regulation).

9.1.10. Right to withdraw the data subject's consent to the processing of personal data.

9.1.11. Right to opt out of the sale or resale of the data subject's personal data.

9.2. If a data subject intends to exercise one of the rights set out in clause 9.1. of the Policy, they shall send a letter or email to HR Hariduskeskus using the contact details of HR Hariduskeskus set out in Section 14 of the Policy. If a data subject wishes to lodge a complaint with a supervisory authority against HR Hariduskeskus, or to exercise remedies against HR Hariduskeskus or a supervisory authority, the data subject shall follow the procedure set out in Articles 77–79 of the General Data Protection Regulation and in the legislation of the country in which the data subject intends to lodge the complaint or exercise the remedies.

9.3. If a data subject requests HR Hariduskeskus to delete the data subject's personal data, objects to the processing of the data subject's personal data, exercises the right to data portability, or withdraws consent to the processing of personal data, HR Hariduskeskus has the right to refuse to provide the Services and/or to terminate the Terms, if the provision of the Services is not possible without the processing of the data subject's personal data. In such a case, HR Hariduskeskus also has the right to restrict the data subject's access to the Website, if providing access to the Website or to certain parts of the Website is not possible without the processing of the data subject's personal data under this Policy.

SECTION 10. SECURITY OF PERSONAL DATA

10.1. HR Hariduskeskus takes all reasonable measures to protect the data subject's personal data against unauthorised access by third parties, as well as against the loss, misuse, alteration, or destruction of personal data, including the following measures.

10.1.1. The data subject's session on the Website is conducted through a secure SSL connection while browsing the Website.

10.1.2. Only authorised employees of HR Hariduskeskus have access to data subjects' personal data, and such employees and contractors are required to treat such information as confidential.

10.1.3. The data subject's personal data is stored on HR Hariduskeskus's servers, which are protected by authentication.

10.2. Existing security measures are periodically reviewed in accordance with new legislation and technical updates.

SECTION 11. RETENTION OF PERSONAL DATA

11.1. HR Hariduskeskus retains data subjects' personal data only for as long as is necessary to achieve the processing purposes set out in Section 3 of this Policy.

11.2. HR Hariduskeskus retains clients' personal data set out in clauses 2.1.1.–2.1.7. and clause 2.1.11. of the Terms for the period during which clients use the Services. If a client stops using HR Hariduskeskus's Services, HR Hariduskeskus has the right to retain the client's personal data for up to 5 (five) years after the client stops using the Services. The prescribed five-year period shall not apply if the client resumes using the Services before the expiry of the five-year period.

11.3. The rule set out in clause 11.2. of the Terms shall apply to natural persons for whom a client that is a legal entity requests the provision of Services under the Terms.

11.4. HR Hariduskeskus retains the personal data of data subjects set out in clause 2.1.10. of the Policy for the period necessary to achieve the processing purposes set out in Section 3 of the Policy.

11.5. HR Hariduskeskus retains the personal data of data subjects set out in clauses 2.1.8.–2.1.9. of the Policy for the period necessary to achieve the processing purposes set out in clauses 3.2. and 3.3. of the Policy.

11.6. HR Hariduskeskus periodically reviews the stored personal data set out in clauses 11.4. and 11.5. of the Policy. Depending on the nature of the personal data and the purposes of processing, HR Hariduskeskus periodically deletes outdated personal data that is not necessary to achieve the processing purposes set out in Section 3 of the Policy.

11.7. HR Hariduskeskus does not store the personal data set out in Section 8 of this Policy.

11.8. HR Hariduskeskus shall continue to retain a data subject's personal data if the deletion of such personal data is restricted or prohibited by the Money Laundering and Terrorist Financing Prevention Act of the Republic of Estonia or other applicable laws and regulations.

SECTION 12. INTERNATIONAL TRANSFER OF PERSONAL DATA

12.1. HR Hariduskeskus retains data subjects' personal data only on servers located in the Republic of Estonia and/or in other EEA countries (the European Economic Area, which includes the countries of the European Union as well as Iceland, Liechtenstein, and Norway).

12.2. If HR Hariduskeskus makes an organisational decision to store data subjects' personal data outside the EEA, HR Hariduskeskus shall first select servers located in countries for which the European Commission has decided that such countries ensure an adequate level of data protection (Article 45 of the General Data Protection Regulation). In particular, HR Hariduskeskus may select jurisdictions such as Switzerland, the United Kingdom, Andorra, Israel, and New Zealand. A full list of jurisdictions outside the EEA that ensure an adequate level of data protection can be found on the European Commission's website: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.

12.3. If HR Hariduskeskus is unable to retain data subjects' personal data on servers located in the EEA or in the jurisdictions set out in clause 12.2. of the Policy, HR Hariduskeskus shall transfer data subjects' personal data to other jurisdictions in accordance with the appropriate safeguards set out in Article 46 of the General Data Protection Regulation.

12.4. If HR Hariduskeskus is unable, for any reason, to transfer personal data in accordance with clauses 12.1.–12.3. of the Policy, HR Hariduskeskus shall transfer data subjects' personal data only in accordance with the provisions of Article 49 of the General Data Protection Regulation, which sets out derogations for specific situations.

In particular, where a data subject who is a client, or a natural person for whom a client that is a legal entity requires the provision of Services under the Terms, resides outside the EEA, and it is necessary to transfer the client's personal data outside the EEA in order to perform the Terms and provide the Services, HR Hariduskeskus shall carry out such a transfer without the client's prior written consent (Article 49(1)(b) and (c) of the General Data Protection Regulation). The same shall apply where an HR Hariduskeskus trainer teaching courses is located outside the EEA and it is necessary to transfer the personal data of a client or natural person using HR Hariduskeskus's Services to such a trainer for the provision of Services and/or the review of the client's or natural person's feedback about the trainer.

HR Hariduskeskus may also transfer a data subject's personal data outside the jurisdictions set out in clauses 12.1.–12.2. of the Policy where there is a legal basis for the transfer set out in Article 49(1)(d)–(g) of the General Data Protection Regulation.

12.5. If HR Hariduskeskus must transfer a data subject's personal data outside the jurisdictions set out in clauses 12.1.–12.2. of the Policy, and the sole legal basis for such a transfer is the data subject's consent to the transfer (Article 49(1)(a) of the General Data Protection Regulation), HR Hariduskeskus shall transfer such data only after obtaining the data subject's consent to the intended transfer of personal data. Such consent may only be obtained from the data subject after HR Hariduskeskus has informed the data subject of the possible risks of such a transfer arising from the absence of an adequacy decision as set out in clause 12.2. of the Policy and the absence of appropriate safeguards as set out in clause 12.3. of the Policy. If the data subject does not give consent to the transfer of personal data, HR Hariduskeskus may refuse to provide Services to such data subject or may restrict the data subject's access to the Website, if the provision of Services or access to the Website is not possible without the data subject's consent to the international transfer of personal data.

SECTION 13. CHANGES TO THE PRIVACY POLICY

13.1. HR Hariduskeskus regularly reviews this Policy to ensure its compliance with applicable data protection laws, and shall make such changes to this Policy as HR Hariduskeskus deems necessary. Changes shall be published on the Website in the form of an updated Policy and shall take effect from the date of their publication. Publication of the updated version of the Policy constitutes notification of data subjects of the changes. Data subjects shall regularly visit the Website to review changes to the Policy.

13.2. HR Hariduskeskus shall take reasonable measures to inform existing HR Hariduskeskus clients of changes to the Policy. In doing so, HR Hariduskeskus may send emails or SMS messages to clients using the Services, or to natural persons for whom a client that is a legal entity requests the provision of Services.

SECTION 14. CONTACTING HR HARIDUSKESKUS

HR Hariduskeskus OÜ
A legal entity established under the laws of the Republic of Estonia
Registry code: 17440602
Address: Harju County, Tallinn, Pirita District, Rahvakooli tee 26-2, 12015
Email: info@hrbp.ee
Phone: +372 55 644 140

bottom of page