Principles of Personal Data Processing

Last updated: 01.06.2020

On this page you will find information on how we collect and process your personal data, and what your rights are regarding it. We only collect personal data in accordance with applicable personal data protection laws. If you use our website and e-shop, the controller of your personal data is:

OÜ Loote Ultraheliskriining (register code 11665665)
A. H. Tammsaare tee 47
11316 Tallinn
Estonia

Please read the information below carefully. If you have any questions about this notice or your rights, please contact us at: pood@ultraheli.ee

1. Collection and processing of personal data

The personal information you provide to us when making a purchase includes: your name and contact information (address, e-mail, phone number). We also process information about your order (including order content, order notifications and correspondence, claims, and order history). Your personal data will be processed in accordance with Articles 6 (1) b) (processing of personal data necessary for the performance of contractual obligations) and 6 (1) c (statutory obligations) of the General Regulation on the Protection of Personal Data (GDPR) of the European Union. We may also process your personal data based on our legitimate interests (GDPR art. 6 (1) f)), for example to compile statistics.

2. Transfer of personal data

Personal data will not be transferred outside the European Economic Area.

In certain cases, the controller may transfer your personal data to third parties if this is necessary, for example, in order to:

Fulfil its legal obligations;
Protect its property and rights;
Defend itself against legal claims;
Prevent or investigate possible offenses.

The controller shall keep a register of complaints about medical devices. Complaints and notifications of non-compliant equipment and recalls shall be recorded in this register and forwarded to the manufacturer/manufacturer's authorized representative.

We forward the personal data necessary for making payments to the authorized processor, Maksekeskus AS.

3. Security of personal data

We shall take appropriate technical and organizational measures to protect your personal data, taking into account in particular risks arising from the processing of personal data, especially the accidental or unlawful destruction, loss, alteration and unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed.

4. Preservation of personal data

We process your personal data during the performance of the contract or other agreement and then retain your personal data for as long as is necessary for the purposes for which we collected it, including the fulfilment of legal or accounting obligations applicable to us.

Personal data related to contracts and/or transactions are part of our accounting and business records and are retained for 7 years from the end of the year in which they were recorded. The retention period may be longer if the processing of your personal data is required to meet other requirements related to our core business (such as making or fulfilling a claim). At the end of the retention period, we will delete personal data or make it anonymous.

5. Your rights

In accordance with the GDPR and applicable law, you have the following rights with regard to your personal data:

the right to request access to your personal data;
the right to request the rectification of your personal data. Please note that we may need to verify the accuracy of the information you provide;
the right to request the deletion of your personal data. Please note that, for legal reasons, we may not always be obliged to comply with your request (for example, if personal data is necessary to create, file or defend a claim), but we will inform you in our response to your claim.

In certain circumstances, you may also have the right to request the transfer of your data or to restrict or to object to the processing of your personal data.

You may exercise your rights in accordance with the requirements of general regulations and applicable law.

To exercise your rights, please contact us at pood@ultraheli.ee. When exchanging information about your rights to the processing of personal data, we may need to ask you for certain information or documents in order to identify you. This is necessary to ensure that personal data is not disclosed to anyone who is not you or who is not entitled to receive your personal data.

6. Right of appeal

If you find that your data protection rights have been violated, you have the right to lodge a complaint with the Data Protection Inspectorate.

Contact details of the Data Protection Inspectorate:

Tatari 39, 10134
Tallinn, Estonia
E-mail: info@aki.ee
Phone: +372 627 4135

7. Changes to this notice

This personal data processing notice may be updated as necessary. Changes to this notice will take effect when they are posted to this page.