1. Introduction
1.1. OÜ Lehepunkt (hereinafter “we” or “Sirvi”) is the controller of personal data processed in connection with the management of the Sirvi online publication sales platform (www.sirvi.eu) and activities related to ordering magazines, newspapers, crossword magazines, board games and other products through the platform. We consider the protection of the privacy of our customers, website visitors, business partners and other data subjects important and process personal data in accordance with applicable data protection legislation.
1.2. These Privacy Terms explain how we collect, use, retain and protect the personal data of data subjects in accordance with the General Data Protection Regulation (EU) 2016/679 (hereinafter the “GDPR”) and other applicable legislation governing the protection of personal data.
2. Contact details of the controller and Data Protection Officer
2.1. Controller:
OÜ Lehepunkt
Registry code: 12113637
Address: Lõõtsa 1a, 11415 Tallinn
Email: info@lehepunkt.ee
2.2. Data Protection Officer:
Fondia Eesti OÜ
Registry code: 12350857
Address: Ahtri tn 6, 10151 Tallinn
Email: dpo.lehepunkt@fondia.com
3. Purposes and legal bases for processing personal data
3.1. Placing and fulfilling orders
3.1.1. Sirvi processes customers’ personal data for receiving, processing and fulfilling orders for magazines, newspapers, crossword magazines, board games and other products, as well as for arranging delivery.
3.1.2. Depending on the order, the personal data processed may include the following: first and last name, email address, telephone number, delivery and billing address, and information related to the order.
3.1.3. Personal data may be disclosed to business partners to the extent necessary to fulfil the order, including logistics and transport service providers. Personal data may also be disclosed where required by law or pursuant to a lawful request from a competent authority.
3.1.4. The legal basis for processing is the performance of a contract (Article 6(1)(b) of the GDPR).
3.2. Calls to customer support
3.2.1. When you call Sirvi customer support, we may record calls in order to ensure and improve the quality of customer service, document the resolution of enquiries, provide evidence of circumstances relating to transactions, and protect our rights in the event of possible disputes. The caller will be informed that the call is being recorded before recording begins. Call recordings may only be accessed by authorised persons and are retained for up to 60 days, unless longer retention is necessary for the establishment, exercise or defence of a legal claim.
3.2.2. The legal basis for processing is our legitimate interest in ensuring the quality of customer service, resolving disputes, and establishing claims to protect our rights or defending ourselves against claims made against us (Article 6(1)(f) of the GDPR).
3.3. Cookies and log files
3.3.1. When you use www.sirvi.eu, we automatically collect certain technical information and store it in log files. This information may include the user’s IP address, browser type and version, operating system, technical characteristics of the device, pages visited, the time and duration of the visit, and other information related to the use of the website. This data is used to ensure the operation and security of the website, identify and resolve technical issues, and improve the website’s functionality, ease of use and user experience.
3.3.2. The website uses cookies and other similar technologies. A cookie is a small text file that is stored on the user’s device when visiting the website. Cookies enable the website to recognise the user’s device, save user preferences, ensure the proper functioning of the website and collect statistical information about the use of the website.
3.3.3. Detailed information about the types of cookies used, their purposes and retention periods, as well as options for configuring cookies and managing consent, is provided in Lehepunkt’s Cookie Policy, available at www.sirvi.eu/kupsised.
3.3.4. The legal basis for processing when using analytical, statistical, functional and marketing/advertising cookies is the data subject’s consent (Article 6(1)(a) of the GDPR). For cookies that are necessary for the operation of the website (strictly necessary cookies), the legal basis is our legitimate interest in ensuring the secure and proper operation of the website (Article 6(1)(f) of the GDPR).
3.4. Marketing and promotions
3.4.1. Where a customer has given consent, we process the customer’s personal data to send newsletters, promotional offers, personalised offers and other direct marketing communications. The customer may withdraw their consent at any time by using the unsubscribe link included in the marketing communication or by contacting us using the contact details provided in these Privacy Terms. Withdrawal of consent does not affect the lawfulness of personal data processing carried out on the basis of consent before its withdrawal.
3.4.2. In connection with promotions, prize draws and other advertising activities, we process participants’ personal data for the purposes of running the promotion, verifying eligibility to participate, selecting winners, contacting winners and arranging the delivery of prizes. Personal data is processed only to the extent necessary for conducting the relevant promotion or prize draw.
3.4.3. The legal basis for processing is the data subject’s consent (Article 6(1)(a) of the GDPR).
3.5. Statistics and analytics
3.5.1. Sirvi processes personal data or aggregated data derived from it for compiling statistics, analysing sales trends, planning the product selection, forecasting demand, and developing services and business processes. Where possible, anonymised or aggregated data is used for statistical purposes.
3.5.2. The legal basis for processing is our legitimate interest in developing and planning our business activities (Article 6(1)(f) of the GDPR).
3.6. Payment solutions
3.6.1. Sirvi uses third-party payment service providers to process payments. Any processing of personal data carried out in connection with payment processing is performed under the responsibility of the relevant payment service providers and in accordance with their terms and legal basis. Sirvi does not store or process bank card details required for making payments.
3.6.2. The legal basis for processing is the performance of a contract (Article 6(1)(b) of the GDPR).
4. Disclosure of personal data to third parties
4.1. We disclose personal data only to the extent necessary to the following parties:
4.1.1. Processors, i.e. service providers (e.g. IT service providers, transport service providers and payment solution providers) who process personal data solely in accordance with our instructions and with whom we have entered into data processing agreements;
4.1.2. Public authorities, including supervisory, investigative and law enforcement authorities, courts and other competent public bodies, where disclosure of personal data is necessary to comply with a legal obligation, respond to a lawful request from a public authority or protect our rights (e.g. submitting information relating to tax obligations to the Estonian Tax and Customs Board);
4.1.3. Legal advisers and other professional advisers where this is necessary to obtain legal advice, establish or defend claims, or resolve disputes;
4.1.4. Auditors, audit firms and other providers of financial and compliance review services where this is necessary to comply with legal obligations, audit financial statements, conduct internal or external reviews, or assess the compliance of our activities.
4.2. Personal data may also be transferred in connection with the sale of Sirvi’s business or another similar transaction. In such cases, we will take all necessary measures to protect personal data and, where applicable, notify data subjects in accordance with applicable requirements.
5. Transfers of personal data outside the European Economic Area
5.1. As a rule, we process personal data within the European Economic Area (EEA). In certain cases, personal data may be accessible to or transferred to service providers located outside the EEA, including in connection with the use of web analytics, marketing, cloud services or other technical solutions.
5.2. Where personal data is transferred to a country for which the European Commission has not adopted an adequacy decision, we ensure that the transfer is carried out in accordance with applicable data protection requirements and on the basis of appropriate safeguards, including the Standard Contractual Clauses (SCCs) approved by the European Commission or other legal mechanisms provided for in Chapter V of the GDPR.
6. Retention periods
Data category - Retention period
· Call recordings - up to 60 days
· Accounting records - 7 years + the current financial year
· Contract-related data (including order data) - 3 years, in exceptional cases up to 10 years (general limitation periods for claims)
7. Rights of the data subject
7.1. Data subjects have the following rights in relation to the processing of their personal data:
7.1.1. the right of access to their personal data and to obtain a copy of the data being processed;
7.1.2. the right to rectification where the data is inaccurate or incomplete;
7.1.3. the right to erasure in certain cases (e.g. where consent is withdrawn and there is no other legal basis for processing);
7.1.4. the right to restriction of processing in certain cases;
7.1.5. the right to data portability in a structured and machine-readable format;
7.1.6. the right to object to the processing of personal data based on legitimate interests;
7.1.7. the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.
7.2. To exercise these rights, please contact the Data Protection Officer specified in section 2.2 of these Privacy Terms.
7.3. We are required to respond to a request within 1 month of receiving it.
7.4. Further information about data subjects’ rights is available on the website of the Estonian Data Protection Inspectorate: www.aki.ee.
8. Security
8.1. We implement appropriate technical, physical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, destruction, loss or other unlawful processing. These measures include, among other things, managing access rights, authentication and authorisation mechanisms, encrypting data communications where appropriate, using firewalls and security monitoring solutions, regularly updating systems, and implementing backup and recovery measures.
8.2. Access to personal data is permitted only to employees, processors and business partners who have a legitimate need for such access in order to perform their duties or contractual obligations. All persons who have access to personal data are required to comply with confidentiality requirements and process personal data in accordance with applicable legislation and our internal guidelines.
8.3. We regularly assess the appropriateness of the security measures implemented and, where necessary, introduce additional measures, taking into account technological developments, the nature, scope, context and purposes of processing, and potential risks to the rights and freedoms of data subjects.
8.4. We provide employees with regular training and awareness activities concerning personal data protection, information security and the principles of secure data processing.
9. Changes to the Privacy Terms
9.1. We have the right and obligation to keep these Privacy Terms up to date. Changes will be published on the Sirvi website together with the date on which the changes take effect. We may also notify data subjects of significant changes by other means (e.g. by email).
10. Questions and complaints
10.1. If you have any questions concerning the processing of personal data, please contact the Data Protection Officer whose contact details are provided in section 2.2 of these Privacy Terms.
10.2. If you have a complaint concerning the processing of your data, you also have the right to contact the Estonian Data Protection Inspectorate:
Tatari 39, Tallinn 10134