ELAMUS PLUSS PRIVACY POLICY
Elamus Pluss Ltd., MTÜ Elamus Pluss and/or Kondimootor OÜ (hereinafter referred to as “Elamus Pluss" or "we" and "us") adheres to the requirements and principles set out in this policy. The privacy of individuals and the protection of personal data are important to us, and therefore we have developed this privacy policy, which sets out the purposes and conditions of personal data processing and the rights of data subjects related to their personal data. Elamus Pluss considers the confidentiality and protection of personal data to be very important and ensures the lawfulness of the processing of personal data. Elamus Pluss collects personal data primarily from its customers.
Definitions
1.1. Data subject – a person whose personal data is processed.
1.2. Personal data - any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location information, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
1.3. Processing of personal data - any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
1.4. Controller - a natural or legal person, public sector or local government (LG) institution, which is the primary collector of personal data. The controller determines the purposes and means of processing personal data.
1.5. Authorized processor - a natural or legal person, public sector or local government institution that processes personal data on behalf of the controller and based on his or her instructions.
1.6. Third party - a natural or legal person, public sector or local government institution, agency or body.
1.7. Personal data breach - a breach of requirements that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
1.8. Customer – a natural or legal person who purchases Elamus Plussi package tours, travel services, airline tickets or other services offered.
Elamus Pluss is based on the following principles when processing personal data:
2.1. principle of lawfulness, fairness and transparency - processing is lawful, fair and transparent to the data subject;
2.2. purpose limitation principle - personal data are collected for specified and legitimate purposes and are not further processed in a manner incompatible with those purposes;
2.3. principle of data minimisation - personal data are relevant, relevant and limited to what is necessary in relation to the purpose of their processing;
2.4. principle of accuracy - personal data are accurate and, where necessary, kept up to date, and all reasonable steps are taken to ensure that personal data that is inaccurate, having regard to the purpose of the processing, is erased or rectified without delay;
2.5. principle of storage limitation - personal data shall be stored in a form which permits identification of data subjects only for as long as is necessary for the purpose for which the personal data are processed;
2.6. principle of reliability and confidentiality - personal data are processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.
Security of personal data processing
3.1. Elamus Pluss implements various organizational, physical and information technology security measures to protect personal data based on the principle of reasonableness.
3.2. Elamus Pluss also uses authorized processors to process personal data and provide services. Elamus Pluss ensures that processors process personal data Elamus Plussi in accordance with the instructions and in accordance with applicable law and implement appropriate security measures.
3.3. Personal data breach - a breach of requirements that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
Types of personal data and purposes of processing
4.1. Elamus Pluss processes personal data obtained directly from the data subject and personal data encountered in the course of providing the service. Elamus Pluss is the controller of personal data in the personal data processing processes, except in the cases specified in sections 4.1.2., 4.1.4. and 4.1.5. Elamus Pluss processes the personal data below for the following purposes:
4.1.1. first and last name, personal identification number, contact telephone number, postal and e-mail address, if the customer orders package tours, travel services, flight tickets or other services from us by e-mail, online or by telephone;
4.1.2. if the customer purchases a trip to a destination where a visa is required for travel, and the price of the travel service includes the processing of a visa, then we ask for personal data required by the legislation of the destination country - this may be all or some of the following personal data: first and last name, personal identification number, contact telephone number, postal and e-mail address, date of birth, patronymic, copy of the travel document and/or document number, occupation, place of work and its address, contact person and their address and relationship to the traveler, traveler's bank account statement. In the visa application process, the responsible processor is the visa-issuing authority of the destination country;
4.1.3. Customers can also make special requests when ordering package tours, travel services, flight tickets or other services from us. Customers' special requests may include shared accommodation or may be related to their health, in which case they will disclose health data about themselves that is necessary for the safe conduct of their trip;
4.1.4. we collect on our website www.elamuspluss.ee IP addresses to make using our website more convenient;
4.1.5. we collect on our website www.elamuspluss.ee information about the web browser (or other program used to access Elamus Pluss website) and access time in order to improve the usability of our website;
4.2. Elamus Pluss is the controller of personal data and follows the principles of ensuring the confidentiality of personal data in order to ensure the privacy rights of individuals. Access to change and process personal data is only available to Elamus Plussby persons authorized by i.
Third parties and authorized persons
5.1. Elamus Pluss may transfer personal data to third parties and authorized persons for the following purposes:
5.1.1. to the embassy of the destination country requiring a visa for travel, to apply for a client visa;
5.1.2. to provide accommodation to the client;
5.1.3. for booking train, bus or plane tickets or excursions required during the customer's ordered trip;
5.1.4. for customers to order airline tickets from airlines or travel agencies.
5.2. If the customer's personal data is transferred to third parties for the reasons stated above, we have done our best to ensure that our cooperation partners and authorized processors implement adequate security measures to ensure the security of personal data protection.
Transfer of personal data to third countries outside the EU or their equivalent regions
6.1. If, in the course of providing the service, we transfer data outside the EU or equivalent territories to fulfill the contract, for example, to apply for a visa, provide accommodation, or book domestic train, bus, or flight tickets in a third country, we will transfer the relevant personal data. Elamus PlussTo fulfill the contract between me and the client.
6.2. Where possible, we also enter into agreements with recipients of personal data that also stipulate personal data protection clauses, but this is not possible in all cases and we cannot guarantee that all processors located in third countries process personal data in accordance with the standard of the General Regulation.
Rights of the data subject
7.1. The data subject has the right to make inquiries about the personal data concerning him/her that he/she has Elamus Plusssubmitted to the ile, making a statement to that effect Elamus Plussi to the email address provided in section 11.1 of this privacy policy.
7.1.1. If the client submits a request regarding personal data, Elamus Pluss to ensure that the person concerned is the person who has the right to receive the data. Therefore, the person requesting the data must, if necessary, prove their identity or their right to request the data.
7.2. The data subject also has the right to erasure of personal data and restriction of processing, in appropriate cases, unless otherwise provided by law.
7.3. In certain cases, the data subject has the right to receive personal data in machine-readable format with him or her or to transfer it to another responsible employee.
7.4. The data subject has the right to file a complaint regarding the processing of personal data with the Data Protection Inspectorate.
Storage of personal data
8.1. Elamus Pluss retains personal data for as long as necessary to fulfill the purposes for which the personal data is processed.
8.2. Elamus Pluss securely destroys and/or deletes all personal data for which there is no purpose for retention.
8.3. To comply with the legal requirement, we retain data in accordance with the retention period specified in the law; we retain invoices for travel payments as primary accounting documents for 7 years from the date of ticket issuance in accordance with the Estonian Accounting Act.
8.4. To fulfill our obligation to perform the contract, we retain personal data in accordance with the terms agreed in the contract.
8.5. We retain personal data processed based on the client's consent for as long as it is necessary to fulfill the purposes for which the personal data is processed based on the consent.
Use of cookies
9.1. Elamus Plussmy website www.elamuspluss.ee uses cookies to make the user experience on the website more comfortable and smoother.
9.2. A cookie is a small text file that is automatically stored on a person's device by a web browser. We use cookies for the following purposes:
9.2.1. Cookies that are necessary for the operation of the website are used for essential functions during your visit to the website. These include identifying the country and language used, processing the transaction, identifying the version of the website being used (whether mobile or desktop), fraud detection and prevention, and ensuring compliance and website stability. These cookies are categorized according to the needs of keeping the website running;
9.2.2. We use performance cookies to measure the performance of our website and to analyse your use of the website by monitoring which pages you visit and whether you experience any errors when visiting our website, in order to Elamus PlussIt would be easier to troubleshoot problems with the website. Performance cookies also detect how much you use different parts of the website. These cookies usually collect anonymous statistical data. All information is anonymous and is only used to help us enrich your experience on our website, understand your interests and measure the effectiveness of marketing;
9.2.3. Functional cookies improve user experience, they store information about the choices made by the client on the website. This allows us to show the user more relevant and personalized information.
9.3. Users can make changes to their web browser cookie settings at any time. By changing these settings, the user can block the automatic processing of cookies in the web browser settings or set a notification about cookies each time they enter the website. More detailed information about the options and methods of handling cookies is available in the user manual of the web browser software used by the end user and on the website. www.aboutcookies.orgIf cookies are not used, websites may not function correctly and not all services may be available.
9.4. Cookies are stored for 30 days, after which they are automatically deleted.
Changes to the Privacy Policy
10.1. The privacy of individuals is Elamus Plussimportant to us, which is why we regularly update this privacy policy. We always publish the most up-to-date version of the privacy policy on the website.
Contact
11.1. For any questions, concerns or suggestions regarding the processing of personal data, you can contact the controller at the following contacts:
Elamus Pluss OÜ
Metsaserva piirkond 21, Haage küla, 61402 Tartu, Tartumaa, Eesti
info@elamuspluss.ee
Kehtib alates 31.01.2020