Privacy Notification

This privacy notification describes how companies in the Endover Group (for the purposes of this privacy notification, OÜ Endover KVB, registry code 10308874, address Tartu Road 2, 10145 Tallinn, Republic of Estonia, and its subsidiaries and associated companies operating under the Endover brand; hereinafter we or Endover) process the personal data of potential and existing clients and other persons associated with them, sales contacts, website users and other data subjects with whom Endover comes into contact when providing services to them (hereinafter you). This privacy notification is applicable whenever you use or have used or have expressed the intent to use our services, including visiting our website, providing us with your e-mail address to sign up for our newsletter, applying for a vacancy or submitting a job request.

In the above cases we are the controller responsible for processing your personal data.

Collection of personal data. We collect your personal data in the following ways:

• your personal data that you yourself have transmitted to us (for example, when contacting us by phone or e-mail or via our website or social media channels, at our office, as a result of making a reservation agreement via our website, at our open-house events or other public events we hold, via online channels or by uploading your CV on our website);
• your personal data transmitted to us by a third party (for example, a broker or a third-party payment services provider verifying whether your payment has been successful or not);
• your personal data we have collected ourselves, including by automatic means. Read also our Cookies Policy.

Processing of personal data. We process the following kinds of personal data.

• When signing up on our website for our newsletter or joining the Premium Club, your name and contact information (e-mail address).
• When signing up on our website to receive information on development projects, your name, contact information (phone and e-mail address) and preferences regarding apartments you are potentially interested in (size and price range).
• When signing up for and participating in our open-house events, your name, contact information (address, phone and e-mail address) and preferences regarding apartments you are potentially interested in (size and price range).
• When making an agreement with us (including a reservation agreement via our website), your name, personal ID code, contact information (address, phone and e-mail address) and marital status as well as other relevant data (except marital status data) on your authorised representative.
• When applying for a vacancy, your name, contact information (address, phone and e-mail address) and information regarding your education, professional skills, professional history, etc.
• When participating in our open-house events or other public events we hold, images of you (video and photo imagery).
• When visiting our development sites, images of you as well as all other kinds of personal data and activities visible in the area under video surveillance.

Purpose of and legal basis for processing We process your personal data for the following purposes and we have the following legal basis for processing it:

• to make an agreement with you or to fulfil an agreement made with you;

• • our legitimate interest, for example:

• to contact your for marketing purposes if previous contact with you implies that you might be interested in our offer, and if you have not expressed discontent with or not objected to such contact. Our position is that in such a situation your interests and rights to do not outweigh our legitimate interest in marketing our products and services;
• to ensure that an agreement made with you is fulfilled, including the identification of a violation of an agreement or applicable law, proving it and lodging a claim. If you have violated an agreement or applicable law, your interests or rights do not outweigh our legitimate interest.
• to collect information on our website traffic, service usage statistics and other non-personalised technical information on our website usage in order to improve our website and services;
• to contact you to request feedback on our products and services in order to be able to conduct customer satisfaction surveys, provided that you have not expressed discontent with or objected to such contact.

• • to fulfil our legal obligations.

We may also process your personal data when, under specific circumstances, it is necessary for the purposes of our or third-party legitimate interest, except when such interest is outweighed by your interests or fundamental rights and freedoms with regard to the protection of personal data as well as under circumstances in which it is necessary to protect your vital interests or those of any other natural person.

We do not process special categories of personal data.

Processing on the basis of your consent. We can process your personal data on the basis of your consent (for example, sending newsletters for the purposes of direct marketing). When processing is based on your consent, you can withdraw your consent at any time by using the contact information below or by clicking on the “Unsubscribe from this list” link provided at the end of all e-mails we send. Please keep in mind that the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Processors. To process your personal data, we rely on carefully selected service providers (processors). However, it is still us who is fully responsible for your personal data.

We use processors in the following areas: providers of data storage, e-mail, customer relationship management, brokering, payment and job placement services.

For further information on processors (their names and addresses), please contact us using the information below.

Third parties. We share your personal data with third parties only for the purposes established in this privacy notification, when this is required by applicable law (for example, when we are obliged to share personal data with authorities) or with your consent.

We can share your personal data with companies in the Endover Group, our auditors and legal consultants. Legitimate basis for such sharing is our relevant legal obligation or legitimate interest.

Personal data transfer outside the EU. Our processors may process your personal data outside the EU (including in the US). We transfer your personal data outside the EU only when we have a legitimate basis for doing so, including to data recipients: i) who are located in countries which, according to the Commission’s evaluation, offer an adequate level of data protection (includes Privacy Shield-certified organisations); or ii) under an agreement which complies with EU requirements on personal data transfer to processors not established in the EU.

For further information on personal data transfer outside the EU (for example, processors’ names and legal basis for transfer), contact us using the information below.

Data security. We implement technical and organisational security measures to protect your data, taking into account (i) technological developments, (ii) the cost of implementation, (iii) the nature, scope, context and purposes of processing, and (iv) risks to you. Such security measures include, among others, data access management, employee training, two-factor authentication and data encryption.

Data storage. We store your personal data for as long as necessary to achieve the purposes for which it is collected, to protect our interests or to comply with applicable law.

If you have made an agreement with us, we store the following personal data:

• according to Estonian accounting and tax laws, we store information regarding accounting documents for 7 years from the end of the relevant financial year;
• according to limitation periods established in Estonian laws, we store personal data regarding contractual claims for up to 10 years from the date a claim becomes chargeable.

If you have signed up to receive information that you might be interested in, we store your personal data for 5 years from the day we had contact with you for the last time.

If you have participated in an open-house event and we have not made any agreement with you, we store your personal data for 5 years from the day the event took place.

If you have unsuccessfully applied for a vacancy with us, we store your personal data for 1 month after officially filling the position you applied for. On the basis of your separate consent, we store relevant data for up to 6 months from the end of the recruitment process. If you have provided us with your contact information and uploaded your CV on our website, we store your personal data for up to 6 months after making it available to us.

Photo and video imagery recorded by us is stored for 7 years after recording them.

Data collected by cookies used on our website is stored according to the provisions of our Cookies Policy.

Your rights. Concerning your personal data, you are granted all rights held by data subjects to the extent compatible with applicable data protection laws. Regarding your personal data, these include the right to:

• request access;
• obtain a copy of your personal data;
• rectification of inaccurate or incomplete personal data;
• erasure;
• restriction of processing;
• data portability.
• Objecting to the processing of personal data based on legitimate interest and for the purposes of direct marketing.

To exercise your rights, contact us using the information below.

If you believe that your rights have been violated, file a complaint with the Estonian Data Protection Inspectorate or take legal action.

Changes to the privacy notification. When the need arises to make changes to our data processing policy or the privacy notification due to applicable data protection laws, other legislation, case law or guidelines or regulations issued by competent authorities, we have the right to make changes to the privacy notification unilaterally and at any time. In this case we will inform you within a reasonable period of time before the changes enter into force.

Applicable law. Because our company is registered in the Republic of Estonia, the processing of your personal data is governed by Estonian law.

Contact information. If you have any questions about the processing of your personal data or if you seek to exercise the rights you have as a data subject, please contact us by visiting our office at Tartu Road 2, Tallinn 10145, e-mailing us at endover@endover.ee or calling us at +372 666 0620.