The general privacy policy of the media companies of MM Group (hereinafter: MMG Privacy Policy) provides an overview of the principles of processing personal data at the media companies of the Group and of how personal data are processed. In addition, the Policy sets out the rights of the data subjects and all other terms and conditions relating to the processing of personal data, which apply to the media companies across the Group. The specifications for the processing of personal data at the media companies of the Group (hereinafter: Controller) can be found in the privacy policy or privacy statement of each respective Media Company, available on the website of each Media Company (see section 2.1 below) or by clicking on the logos here:

POSTIMEES GRUPP AS:



DUO MEDIA NETWORKS OÜ:




POSTIMEHE KIRJASTUS AS:



MAAPORTAAL OÜ:




PMG LABOR OÜ:


If the Data Subject uses the services of a Media Company, visits the websites or participates in campaigns or raffles organised by the Controller or has otherwise disclosed his or her personal data to the Controller, this MMG Privacy Policy applies to the processing of the personal data of the Data Subject.
 
Definitions  
General information  
Principles relating to processing of personal data  
Categories of Data Subjects, and the personal data processed












 
Processing the personal data of children  
Purposes and bases of processing














 
Transfer of personal data

This section sets out the information on when the Controller may transfer personal data to its cooperation partners. There may be various processing relationships between the Controller and cooperation partners, for example, controller-processor, controller-controller. In any case, the Controller undertakes to do its best to ensure compliance with the requirements of the GDPR, including, if necessary, by means of a data processing contract.

7.1 Transfer of personal data to cooperation partners. The Controller may disclose personal data to third parties if there is a need and a legal basis (e.g. a legal obligation, legitimate interest, consent), for example:

  (a) the transfer of copies to third parties for the purpose of archiving print media and audiovisual content (e.g. to the National Library);

  (b) to national authorities, including supervisory, investigative and law enforcement authorities, based on law;

  (c) to a payment service provider. In such case, the legal basis for transfer is the performance of the contract signed with the Data Subject (e.g. Maksekeskus AS, EveryPay AS, Zlick Ltd, Swedbank AS, AS SEB Pank, AS LHV Pank, Coop Pank AS, Luminor Bank AS);

  (d) to auditors, legal advisers and other advisers where necessary to fulfil their obligations to the Controller and provided that they keep the respective data confidential. In such case, the legal basis for the transfer is the performance of the Controller’s legal obligation (e.g. in case of auditors) or the legitimate interest of the Controller to protect its rights;

  (e) based on consent, the tools provided by third parties, such as Google or Facebook, may be used to register an account and log in to the account. In such case, a profile is created for the Data Subject based on the information received from such service providers, and information about the Data Subject is provided to the respective service providers;

  (f) to obtain traffic, usage statistics and other non-personal technical information about the Website of a Media Company, the Media Company may forward the information about the Client, User or Website Visitor to service providers such as Google and Facebook based on the legitimate interest of the Media Companies to improve the Website and the services (if allowed by the result of the assessment of legitimate interest);

  (g) to a postal service provider (i.e. including e-mail) for the delivery of orders/goods and promotional materials; to home delivery service providers. In such case, the legal basis for the transfer is the performance of the Contract entered into with the Client, the legitimate interest of the Controller or the consent of the Data Subject;

  (h) to companies belonging to the same group as the Controller in order to provide the Client with the discounts applicable at the companies belonging to the group and for group-wide reporting and the development of services. In such case, the legal basis for the transfer is the Controller’s legitimate interest to provide the Service, or the Data Subject’s consent within the loyalty program;

  (i) to a person engaged in debt collection, if the Data Subject has incurred arrears with the Controller. In such case, the legal basis for the transfer is the legitimate interest of the Controller to protect its rights. In a situation where the Data Subject has breached the Contract or otherwise violated the rights of the Controller, the interests and rights of the Data Subject will not override the legitimate interest of the Controller;

  (j) to a company providing an accounting system;

  (k) to ICT partners, i.e. providers of various technical services (e.g. providers of server space and other cloud services);

  (l) to marketing partners and agencies, including advertising;

  (m) to customer satisfaction and feedback service providers;

  (n) to the service providers used to carry out consumer games, raffles and campaigns;

  (o) to payment default registers and invoicing service providers.

7.2 Information about cooperation partners. The Data Subject has the right to request more detailed information about the cooperation partners used by the Controller to whom the personal data of the Data Subject have been transferred, by contacting the Controller at the contact information given (see Section 2.1).

7.3 Transfer of personal data to processors. Personal data are transferred to the persons specified in clause 7.1 (who are processors) provided that the processing has a legal basis and purpose and the processing is carried out in accordance with the instructions given by the Controller and an agreement been concluded for the processing of personal data.

7.4 Processing in the EEA. In the context of standard processing, the Controller will not transfer personal data outside the European Economic Area (EEA). If the transfer of personal data outside the EEA is necessary, the Controller will operate according to the options set out in Chapter V of the GDPR and will transfer the personal data out of the EEA only if there is a relevant basis and the mechanism set out in Chapter V is applicable, e.g. if the European Commission has decided that adequate protection is guaranteed in the relevant country or that the EU Standard Contractual Clauses agreed to or that any other appropriate option specified in Chapter V applies.
 
Personal data storage, and the security of processing

This section sets out information on the storage of personal data and on the general protection measures.

8.1 The storage of personal data. Personal data will be stored only for the time necessary for the purpose of processing, for the protection of the Controller’s rights, or for the period required by legislation. If the storage period has elapsed, the Controller will permanently delete or anonymise the data (or organise these procedures). Depending on the purpose of the processing, personal data will be stored in accordance with the Controller’s Privacy Policy / Privacy Statement and/or in accordance with the register for processing operations (if made available). By default, the following storage principles will apply:

  (a) accounting documents: in accordance with the law, e.g. order letters and advertisements for 1 year; all accounting and financial documents for 7 years from the end of the relevant financial year as required by law; staff documents as required by law, for example, employment contracts for 55 years;

  (b) the personal data relating to the Contract: 10 years from the expiry of the Contract, based on the maximum limitation period in case of intentional violation;

  (c) data of a Client: 3 years after the end of the client relationship; up to 10 years in the case of a legal dispute or a risk thereof, or until the end of the dispute.

  (d) data on Cookies: according to the Cookie policy / information about Cookies on the Website;

8.2 Criteria for determining the storage period of journalistic content for Media Companies. The storage of journalistic content is closely linked to the freedom of the media and the press. The notes or recordings of a journalist of a Media Company may be necessary years later to create new journalistic content, to resolve disputes or provide evidence in court or at other authorities. The material collected for the production of journalistic content is deleted if 10 years have elapsed from the disclosure of the journalistic content, i.e. when the Media Company and journalist can be sure that the statement can no longer be subject to (court) disputes and the Media Company and the journalist are convinced that the material is no longer necessary for any articles of future public interest or for other content.

8.3 General security. The Controller has established, or group-wide guidelines and procedural rules are in place that help ensure the security of personal data. The Controller implements appropriate technical measures as well. Among other things, the following is done to ensure security and confidentiality:

  (a) access to personal data is granted only if it is necessary for the performance of work duties, for example, and if the person and the Controller have the right to do so;

  (b) the Controller may process the personal data transferred to it only for the purposes and to the extent necessary for the provision of the services specified in the Contract;

  (c) software solutions are in place to ensure a level of security that meets the market standard.

8.4 Security incident. In case of a security incident concerning personal data, i.e. a personal data breach within the meaning of Article 33 of the GDPR, the Controller will take the necessary measures to mitigate the consequences and manage the relevant risks in the future. The Controller will register all incidents or will have all risks registered, and will notify the Data Protection Inspectorate and the Data Subject directly or publicly (e.g. through national media) if required under the GDPR.

Rights of the Data Subject with regard to personal data
 
Exercise of the rights, and the filing of claims

 
Cookies and other web technologies





 
Information about the MMG Privacy Policy