1. General provisions

1.1. This Privacy Policy governs the principles for the collection, processing and storage of personal data. Personal data is collected, processed and stored by the data controllers A-Tolliagentuur OÜ and Tollibüroo OÜ (hereafter referred to as the data controller).

1.2. For the purposes of this Privacy Policy, a data subject is a customer or other individual whose personal data is processed by the data controller.

1.3. For the purposes of this Privacy Policy, a customer is anyone who purchases goods or services on the data controller’s website.

1.4. The data controller complies with the data processing principles set in the legislation, including processing personal data lawfully, fairly and securely. The data controller is able to confirm that personal data has been processed in accordance with the law.

2. Collection, processing and storage of personal data

2.1. The personal data collected, processed and stored by the data controller is collected electronically, mainly through the website arukasaruandlus.ee.

2.2. By sharing their personal data, the data subject grants the data controller the right to collect, organise, use and manage, for the purpose defined in the privacy policy, the personal data that the data subject shares with the data controller either directly or indirectly by purchasing services.

2.3. The data subject is liable for the data they submit being accurate, correct and complete. Providing false information on purpose will be considered a breach of the Privacy Policy. The data subject is obligated to inform the data controller immediately of any changes to the data submitted.

2.4. The data controller is not be liable for any damage caused by the provision of false information by the data subject to the data subject or to third parties.

3. Processing of customers’ personal data

3.1. A data controller may process the following personal data :

• First and last name

• Phone number

• E-mail address

• Company name

3.2. In addition to the above, the data controller has the right to collect data about the customer that are available in public registers.

3.3. The legal basis for the processing of personal data is Article 6(1)(a), (b), (c), (f) and (g) of the GDPR:

(a) the data subject has given consent to the processing of their personal data; (b) the processing is necessary to fullfill a contract; (c) the processing is necessary for compliance with a legal obligation; (f) the processing is necessary for legitimate interests; (g) the processing is for direct marketing purposes.

3.4. Purposes of processing and retention periods:

• Safety and security – in accordance with the time limits prescribed by law.

• Processing of requests – in accordance with the time limits prescribed by law.

• Customer management – in accordance with the time limits prescribed by law.

• Financial activities, accounting – in accordance with the time limits prescribed by law.

• Marketing – in accordance with the time limits prescribed by law.

3.5. The data controller has the right to share the data with third parties (e.g. processors, public authorities and producer responsibility organisationsd).

3.6. The data controller shall implement organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure or other unlawful forms of processing.

3.7. Personal data will preserved for a maximum of 15 years or for periods set by law.

4. Use of cookies on the arukasaruandlus.ee website

4.1. The website uses cookies to provide a better user experience and to analyse website usage. Cookies are small text files that are stored on your device.

4.2. By visiting this website, you agree to the use of cookies in accordance with this Privacy Policy. Disabling cookies may limit the functionality of the website.

4.3. Types of cookies:

• Necessary cookies

• Functional cookies

• Analytics cookies

If you have any questions, please contact info@toll.ee.

5. Rights of the data subject

5.1. Data subject has the right to access and review their personal data.

5.2. The right to receive information about the processing of data.

5.3. The right to correct inaccurate data.

5.4. The right to withdraw consent.

5.5. To exercise these rights, please contact info@toll.ee.

5.6. The right to lodge a complaint with the Data Protection Inspectorate.

6. Final provisions

6.1. The Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the Estonian Personal Data Protection Act.

6.2. The Data Controller reserves the right to amend the Privacy Policy by publishing the changes on www.arukasaruandlus.ee.

6.3. Links to other websites. Our Service may contain links to other websites that are not operated by us. If you click on a third-party link, you will be redirected to that third party website. We encourage you to review the privacy policy of each site you visit. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third party web sites or services.