These General Principles of Personal Data Processing (hereinafter the Principles) explain how Postimees Grupp AS (registry code 10184643, address Tartu mnt 80, 10112 Tallinn) and its group company Maaportaal OÜ (registry code 14619329, address Tartu mnt 80, 10112 Tallinn) and companies Duo Media Networks OÜ (registry code 16077430, address Tartu mnt 80, 10112 Tallinn) and OMG TV OÜ (registry code 16030629, address Tartu mnt 80, 10112 Tallinn), Postimehe Kirjastus OÜ (registry code 16259326, address Tartu mnt 80, 10112 Tallinn) and (hereinafter together Media Companies) process Personal Data in the course of offering and providing their Services. If you use or have used the Services of the Media Companies, the Websites or participated in campaigns, raffles or otherwise transmitted your Personal Data to the Media Companies, these Policies apply directly to you. Therefore, we encourage you to familiarize yourself thoroughly with these Principles. If you do not agree with the General Principles of Processing Personal Data of Media Companies, the Website or the Services are not intended for you and you must refrain from visiting the Websites and using the Services.

We emphasize that not all of the following principles and the rights of the data subject always apply in full to personal data contained in articles and other journalistic content published in the publications of Media Companies. In applying each principle and the right of the data subject, it must be borne in mind that the Media Company processes this data in the exercise of the right to freedom of expression and information and for journalistic purposes.

1.1. Postimees Group – AS Postimees Grupp (registry code 10184643, address Tartu mnt 80, 10112 Tallinn), which processes the User's Personal Data as a controller within the meaning of the GDPR in accordance with these Principles; Postimees and its news portals in Estonian, Russian and English; Tartu Postimees, Pärnu Postimees, Sakala, Virumaa Teataja, Järva Teataja, South-Estonian Postimees and their news portals, weekly Maa Elu ja magazines Osuti, 60+ and Koolilõpp; Entertainment websites Elu24 and Russian-language Limon; OMG.tv; Neti.ee; in addition, more than ten thematic portals; Radio stations Kuku, Elmar, MyHits, Narodnoe Radio and DFM; BNS news agency; Postimees Publishing House; AS Kroonpress; Direct mail Target Master OÜ; SIA TVNET; SIA LETA; 15min UAB; UAB Diginet LTU; BNS Lithuania, processes the User's Personal Data as a controller within the meaning of the GDPR in accordance with these Principles;

1.2. Duo Media Networks – TV channels Channel 2, Channel 11, Channel 12, MyHits;

1.3. OMG tv A streaming service, which gives the Customer access to various films, TV series and TV channels, as well as other services offered by OMG TV or its partners.

1.4. Maaportaal Maaportaal and advertisement portal soov.ee

1.5. Postimehe Kirjastus offers titles in both fiction and non-fiction for adults, young adults and children.

1.6. GDPR – Regulation by European Parliament and Council (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

1.7. Personal data – means any information relating to an identified or identifiable natural person;

1.8. User – a natural person who visits the Webpage; Creates an account on the Webpage or uses the Services;

1.9. Agreement – an agreement to be concluded between the Media companies and the User on the basis of which the User gains access rights to the paid content of the Webpage and/or the subscription to the newspaper, and will pay the fee to the Media companies if it is agreed upon. For the purposes of these Principles, the Agreement also includes agreements concluded between the Media companies and the User, on the basis of which the User is entitled to post comments on the articles appearing on the Webpage;

1.10. Service – all services and functionalities that have been made available to the User by the Media companies, e.g. subscribing to the publications belonging to the Postimees Group, commenting on the articles, reading the articles, subscribing to the news letters, announcements of the products, services and benefits of the companies and/or partners belonging to the Media companies; organizing consumer games, campaigns and/or lotteries;

1.11. Processing – any automated or non-automated operation or a set of operations, including collection and transferring, carried out with the Personal data or their aggregates;

1.12. Webpage – postimees.ee and all the related sub-domains, secure.pmo.ee, kliinik.ee, targetmaster.ee, maaportaal.ee, 15min.lt, tvnet.lv and all the related sub-domains and the mobile applications managed by the Media companies.

2. Personal data and the ways to collect them

2.1. The Media companies collect Personal data upon the conclusion of the Agreement, in the provision of the Services, and otherwise in the use of the Webpage by the User as follows:

2.1.1. The User himself/herself transfers to the Media companies his/her Personal data (for example, name, contact information, user name, password, posts comments, uses various Webpage features and Services);

2.1.2. The Media companies collects information about the User's behavior and activities regarding the use of the Services and the Webpage (data according to the terms of the use of cookies available from here);

2.1.3. The Media companies can confirm the User's identity and/or the payment order with the third person who provides the corresponding service. For example, a user can identify him/herself via an ID-card, Mobile-ID, a bank link, a Facebook account, or a Google+ account, and make payments under the Contract via the bank link service. The Media companies do not see the User PIN 1 or PIN 2 codes and do not save them. By authenticating via an ID-card and Mobile-ID, and by signing the statements of intent or confirmations, the User is required to comply with the security requirements and recommendations of the respective developers and the Media companies. To do this, we recommend that you get acquainted with the additional information at https://www.id.ee/mobiil-id/ and https://www.id.ee;

2.1.4. Media companies, including Postimees Group journalists can record their location on the premises and messages and orders received via communication channels (email, phone etc.), also information and other operations and use these recordings to prove orders or other operations as necessary.

2.2. Media companies Process the following Personal data:

•  identification data (name, date of birth, gender, personal identification code)
•  contact data (phone, email, address)
•  In the case of contractual payments, bank data (User's bank account, bank name)
•  Data of IP addresses and cookies

3. Objectives and a legal basis for the processing of personal data

3.1. The Media companies process the User's Personal data for the following purposes and legal basis:

3.1.1. To conclude or execute the Agreement to be concluded or concluded with the User, e.g.

3.1.1.1. To assist and advise the User who has entered into an Agreement, if the User has submitted a corresponding request to Media companies;

3.1.1.2. The Agreement concluded with the User for the transfer of invoices or other important notices related to the Service;

3.1.1.3 The Agreement concluded by the User for the provision of contractual Services and the delivery of goods, including the access to the contents of the Webpage.

3.1.2. Based on the User’s consent, e.g.

3.1.2.1. By the estimation of the Media companies, the display of an advertisement of interest to the User, if the User has agreed to install the corresponding cookies in his web browser;

3.1.2.2. Sending notifications to the User about the goods, services and benefits of the Media companies and the partners of the Media companies, if the User has given the corresponding consent;

3.1.2.3. Sending a newsletter to the User, if the User has forwarded his/her e-mail address to the Media companies for this purpose;

3.1.2.4. Carrying out of the consumer games, lotteries and campaigns organized by the Media companies, provided that the User has given the corresponding consent.

3.1.3. Based on the legitimate interest of the Media companies, e.g.

3.1.3.1. To contact the User for the direct marketing purposes if it is possible to assume that the User is interested in the respective offer under the previously concluded Agreement or on the basis of the provided Service, and the User has not expressed dissatisfaction or objected to such communications;

3.1.3.2. To ensure the execution of the Agreement entered into with the User, including for the detection of violations of the Agreement or the legislation by the User, and for its verification (for example, for presenting claims against the User). In this case, the legitimate interest of the Media companies in protecting their rights is the legal basis for the Processing. In the event that the User has violated the Agreement or the legislation, the interests and rights of the User are not considered superior to the legitimate interest of the Media companies;

3.1.3.3. For the collection of the statistics of the Webpage visitation, and the use of the Service, and for other non-personalized technical information regarding the use of Webpage, in order to supplement the Webpage and Services.

3.1.3.4. For processing CCTV camera recordings on the territory of media enterprises. The purpose of using cameras and processing recordings is to protect the property of employees, visitors, Postimees Grupp AS and other persons in the territory; security; defense and submission of claims, and the resolution of claims. In addition, Postimees can process camera recordings and for journalistic purposes. Read more.

3.1.4. To fulfill the obligations arising from the law on the Media companies, e.g.

3.1.4.1. statutory obligation to maintain the accounting records;

3.1.4.2. on the basis of legitimate requests, statutory obligation to transfer to the competent authorities the Users’ personal data;

3.1.4.3. the obligation arising from the law on the Media companies Act to respond to a request or order submitted by the User.

3.2. The User's personal data may also be processed if this is necessary in a specific case in the legitimate interest of the Media companies or a third party, unless such interests are overridden by the User's interests or fundamental rights and freedoms for which the personal data must be protected, or if this is necessary to protect the vital interests of the User or any other natural person.

3.3. If the Processing of Personal data is based on the legitimate interest of the Media companies, the User has the right to file an objection at any time.

4. Transfer of personal data to service providers (authorized processors)

4.1. The Media companies uses the service providers for Processing the User’s Personal data (authorized processors within the meaning of the GDPR). The Media companies is convinced of the reliability of such service providers by entering into the data processing agreements with them and being responsible for their activities.

4.2. The Media companies uses the following categories of the Authorized Processors: The companies belonging to the Media companies, providers of servers and cloud service, providers of platforms used for conducting consumer games, lotteries and campaigns organized by the Media companies, home delivery service providers.

4.3. Users have the right to request from the Media companies more detailed information on the authorized processors by using the contact details in clause 12.

5. Transferring personal data to the third persons

5.1. The Media companies will only transfer Personal data to the third parties to the extent that the Media companies is obligated to do so by law, if necessary for the execution of the Agreement entered into with the User, if the Media companies has a legitimate interest or if the User has given its consent.

5.2. The Media companies transfers the User's Personal data to the following third parties:

5.2.1. For the postal service provider (including e-mail service provider) to deliver orders and promotional materials. In this case, the legal basis for the transfer is the execution of the Agreement entered into with the User, the legitimate interest of the Media companies or the consent of the User;

5.2.2. for a payment service provider. In such a case, the legal basis for the transfer is the performance of the Agreement entered into with the User. (Maksekeskus AS, EveryPay AS, Zlick Ltd, Swedbank AS, AS SEB Pank, AS LHV Pank, Coop Pank AS, Luminor Bank AS)

5.2.3. for the associations belonging to the Media companies, to enable to offer the customer the discounts for the companies belonging to the Media companies. In this case, the legal basis for the transfer is the legitimate interest of the Media companies in providing the service;

5.2.4. on the bases provided for in legislation for the supervisory, investigative and law enforcement agencies. In this case, the legal basis for the transfer is the fulfillment of the statutory obligation of the Media companies;

5.2.5. for the auditors, legal and other advisers, if this is necessary for the performance of their duties to the Media companies and provided that they keep the relevant data confidential. In this case, the legal basis for the transfer is the fulfillment of the statutory obligation of the Media companies (for example, auditors) or the legitimate interest of the Media companies in protecting their rights;

5.2.6. for a debt collector if the User has incurred debts owed to the Media companies. In this case, the legal basis for the transfer is the legitimate interest of the Media companies in protecting their rights. In a situation where the User has violated the Agreement or otherwise violated the rights of the Media companies the interests and rights of the User shall not be considered superior to the legitimate interest of the Media companies.

5.2.7. to the company providing the accounting system. In such a case, the legal basis for the transfer is the performance of the contract entered into with the User and the performance of the obligations arising from law to the Media Company;

5.2.8. for registration and self-validation, you may also use tools provided by third parties such as Google or Facebook based on your consent. In that case, we will be able to create a profile for you based on the information we receive from such third party service providers and the information about you will be provided to those service providers. You can also log in to your account using the services of these third parties, if you already have one;

5.2.9. in order to obtain website traffic, website usage statistics and other non-personalized technical information, the User's personal data may be transferred to Service Providers such as Google and Facebook to improve the Website and Services, as well as the User experience based on Media Companies' legitimate interests.

6. Transferring personal data to the third countries

6.1. In the event that the User's data is transferred or processed in a country outside the EU / EEA, Media companies will provide appropriate guarantees for the protection of your personal data, for example, by concluding a standard data protection clause that provides security measures to ensure compliance with the protection law data, and also undertakes to introduce the necessary additional protection mechanisms to ensure that the User is provided with the same data protection guarantees as GDPR.

7. Storage of personal data

7.1. The Media companies stores the User's Personal data as long as it is necessary for the purpose of their collection, for the protection of the rights of the Media companies or until required by law.

7.2. Depending on the type of personal data, Media companies stores the User’s Personal data as follows:

7.2.1. Accounting documents: 7 years from the end of the relevant fiscal year, as required by law;

7.2.2. Personal data related to the Agreement: 10 years from the termination of the Agreement, due to the maximum limitation date for the intentional infringement;

7.2.3. Cookies data: according to terms of cookies usage.

7.2.4.Criteria for determining the retention period for journalistic content. Preservation of journalistic content is closely linked to freedom of the media and the press. Notes or recordings from a media company journalist may also be needed years later to create both new journalistic content; dispute resolution as well as evidence in court or other authorities. Material collected for the production of journalistic content is deleted 10 years after the publication of the journalistic content, ie if the media company and the journalist can be sure that there can be no (court) disputes over the application and the media company and the journalist are convinced that the material is no longer needed in public. for an article or other content of interest in the future.

8. Security

8.1. The Media companies takes the necessary organizational, physical and info-technological security measures to ensure the User's Personal data security.

8.2. The User, who created the account on the Webpage, undertakes to keep the user name and password required for entering the Webpage in secret and in such a way that it will not fall into possession of the third parties, except if s/he has authorized a third party to use his user name and password for the use of the Services.

8.3. The User, who created the account on the Webpage, must immediately inform the Media companies if its user name or password has been lost or fallen into possession of the third parties in order to enable the Media companies to take appropriate measures to ensure the security of personal data.

8.4. The Media companies is not liable for any breach of security requirements arising from the User's activity.

9. User rights and liabilities

9.1. To the extent governed by the relevant legislation (in particular, the GDPR), the User has the right to exercise the following rights regarding the Personal data Processed by the Media companies:

9.1.1. request access to your Personal data;

9.1.2. request Personal data correction;

9.1.3. request deletion of Personal data;

9.1.4. request objections to the processing of Personal data, especially if the Media companies process them on the basis of a legitimate interest;

9.1.5. request transfer of Personal data.

9.2. In order to exercise his/her rights, the User shall contact the Media companies via the contact details given in clause 12 of the Principles. The User, who created the account on the Webpage, can also exercise certain rights via his user account.

9.3. The Media companies has the right to request the submission of additional information necessary for the identification of the User.

9.4. The Media companies meets the User's request within 1 month and informs the User whether and what measures have been taken to resolve the application of the User by the Media companies. If the application is complicated or voluminous, the Media companies may extend the deadline for replying by 2 months. If the Media companies does not take action according to the User's request, it shall notify the User of the reasons for the non-action and shall explain the possibility of submitting a complaint to the Data Protection Inspectorate or turn to the court for protection of its rights.

9.5. If the User's applications are clearly unreasonable or excessive, in particular due to their repeated nature, the Media companies may either:

9.5.1. ask for a reasonable fee, or

9.5.2. refuse to take the requested measures.

9.6. The User may only require the deletion of Personal data if one of the following grounds exists:

9.6.1. Personal data are no longer needed for the purpose for which they were collected or otherwise processed;

9.6.2. the User takes back the consent given to the Processing of Personal data and there lacks any other legal basis for the Processing of Personal data;

9.6.3. the User objects to the Processing of Personal data based on the legitimate interest of the Media companies, and there are no overriding legitimate reasons for the processing;

9.6.4. the User opposes the Processing of Personal data for direct marketing purposes;
A media company may, on the basis of a legitimate interest, use the customer's contact details for the direct marketing of its similar products or services. A person has the right to prohibit the use of his or her contact data for direct marketing both upon the initial collection of contact information and upon receipt of an offer. To do so, contact us isikuandmed@postimeesgrupp.ee or click on the rejection hyperlink at the end of the offer e-mail.

9.6.5. Personal data has been processed illegally;

9.6.6. Personal data must be deleted in order to comply with the obligation arising from the law on the Media companies;

9.6.7. this is a Personal data of a child under 13 years of age that is processed on the basis of consent.

9.7. If the User requests the deletion of Personal data, then in the respective application, s/he must justify on the basis of which, specified in Clause 6 of the Principles, s/he demands it. The Media companies is not required to delete Personal data if there is no basis for this, or if the Personal data Processing is necessary for the following reasons:

9.7.1. for the execution of the right to freedom of expression and information;

9.7.2. in order to comply with the obligation arising from the Law on the Media companies;

9.7.3. in order to draw up, submit or defend legal requirements;

9.7.4. the Media companies has other statutory basis for the processing of Personal data.

9.8. If the User's Processing of Personal data is based on the User's consent, the User is entitled to withdraw the consent given to the Processing of Personal data at any time. The withdrawal of consent shall not affect the legality of the Processing that was made on the basis of the consent prior to the withdrawal.

9.9. If a violation should occur in connection with the User's Personal data, and according to the opinion of the Media companies, it is likely to be a major threat to the rights and freedoms of the User, the Media companies informs the User about this without an undue delay via the contact details provided by the User to the Media companies or, if that is not possible, publicly.

9.10. In order to keep the User's personal data up-to-date, the User is obligated to inform the Media companies about the change in his/her Personal data.

9.11. In the event that the User's rights have been violated, the User has the right to file a complaint with the Data Protection Inspectorate or to turn to the court for the protection of his rights.

10. Profiling for marketing purposes

10.1. The Media companies conducts profiling of Users for the marketing purposes on the users' web browsers, using the text files or cookies installed by the Media companies or some third parties. Profiling is a data processing aimed at making predictions about the demographic characteristics (gender, age) and interests of the User and, in this regard, displaying ads and offers to the User that the Media companies believes could be of interest to the User.

10.2. As a result of profiling for marketing purposes, no decision is made with respect to the User with the legal significance.

10.3. The Media companies uses profiling for marketing purposes on a legitimate basis. The User may at any time express objections to the Media companies regarding profiling in the for marketing purposes or to prohibit the saving of cookies in his web browser by setting his/her own browser. For more information on cookies used by the Media companies, including how to configure your browser to ignore the cookies, see the terms of use of cookies of the Media companies.

10.4. The Media companies does not use personal data for profiling that the User, having created an account on the Webpage, has transferred to the Media companies for the purpose of establishing the account or concluding the Agreement.

11. Change of Principles

11.1. The Media companies may need to change these Principles due to the changes in the legislation, the processes of processing personal data of the Media companies, or the instructions given by supervisory authorities or courts. In this case, the Media companies will notify the User before the appropriate changes are made within a reasonable time.

12. Contact data

12.1. In order to exercise their rights, withdraw their consent, as well as obtain additional clarifications and submit a complaint to the Media companies, the User may contact the Media companies at the following contact points:

Email:

•  Postimees: isikuandmed@postimeesgrupp.ee
•  Duo Media Networks: info@duomedia.tv
•  OMG TV: privacy@apollo.tv
•  Maaportaal.ee: info@maaportaal.ee
•  BNS: bns@bns.ee

Postal address:

•  Tartu mnt 80, 10112 Tallinn, Eesti