1. General provisions

1.1. This Privacy Policy sets out the principles governing the collection, processing and storage of personal data. Personal data is collected, processed and stored by the controller of personal data, A-Tolliagentuur OÜ and Tollibüroo OÜ (hereinafter referred to as the data controller).

1.2. For the purposes of this Privacy Policy, a data subject is a customer or other natural person whose personal data is processed by a data processor.

1.3. For the purposes of this Privacy Policy, a customer is anyone who purchases goods or services from the website of a data processor.

1.4. The data processor complies with the data processing principles set out in the legislation, including processing personal data lawfully, fairly and securely. The data controller is able to confirm that the personal data have been processed in accordance with the law.

2. Collection, processing and storage of personal data

2.1. The personal data collected, processed and stored by the data controller are collected electronically, mainly through the website arukasaruandlus.ee.

2.2. By sharing his or her personal data, the data subject gives the data processor the right to collect, organise, use and manage the personal data that the data subject shares with the data processor directly or by purchasing services, for the purposes specified in the Privacy Policy.

2.3. It is the data subject’s responsibility to ensure that the data he or she provides is accurate, correct and complete. Knowingly providing false information will be considered a breach of the Privacy Policy. It is the data subject’s responsibility to inform the data processor immediately of any changes to the data provided.

2.4. The data controller shall not be liable for any damage caused by the provision of false information by the data subject to the data subject or to third parties.

3. Processing of customers’ personal data

3.1. A data processor may process the following personal data of a data subject:

• First name and surname

• Phone number

• E-mail address

• Company name

3.2. In addition to the above, the data controller is entitled to collect data about the customer that is available in public registers.

3.3. The legal basis for the processing of personal data is Article 6(1)(a), (b), (c), (f) and (g) of the GDPR:

(a) the data subject has given his or her consent; (b) the processing is necessary for the performance of a contract; (c) the processing is necessary for compliance with a legal obligation; (f) the processing is necessary for legitimate interests; (g) the processing is for direct marketing purposes.

3.4. Purposes of processing and retention periods:

• Safety and security – in accordance with the legal deadlines.

• Processing of requests – in accordance with the time limits set by law.

• Customer management – in accordance with the legal deadlines.

• Financial activities, accounting – in accordance with legal deadlines.

• Marketing – in accordance with legal deadlines

3.5. The data controller has the right to share the data with third parties (e.g. processors, public authorities and producer responsibility organisationsd).

3.6. The data controller shall implement organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure or other unlawful forms of processing.

3.7. Personal data will be kept for a maximum of 15 years or for periods set by law.

4. Use of cookies on the arukasaruandlus.ee website

4.1. The website uses cookies to provide you with a better user experience and to analyse your use of the website. Cookies are small text files that are stored on your device.

4.2. By visiting this website, you consent to the use of cookies in accordance with this Privacy Policy. Disabling cookies may limit the functionality of the website.

4.3. Types of cookies:

• Cookies needed

• Functional cookies

• Analyst cookies

If you have any questions, please contact info@toll.ee.

5. Rights of the data subject

5.1. Data subjects have the right to access and inspect their data.

5.2. The right to be informed about processing.

5.3. The right to correct inaccurate data.

5.4. Right to oppose consent.

5.5. To exercise your rights, please contact info@toll.ee.

5.6. The right to lodge a complaint with the Data Protection Inspectorate.

6. Final provisions

6.1. The Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the Estonian Personal Data Protection Act.

6.2. The Data Controller reserves the right to change the Privacy Policy by publishing the changes on www.arukasaruandlus.ee.

6.3. Links to other websites. Our Service may contain links to other websites that are not operated by Us. If you click on a link to another third party website, you will be redirected to that third party website. We encourage you to review the privacy policy of each site you visit. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third party web sites or services.