This privacy notification describes how companies in the Endover Group (for the purposes of this privacy notification, OÜ Endover KVB, registry code 10308874, address Tartu Road 2, 10145 Tallinn, Republic of Estonia, and its subsidiaries and associated companies operating under the Endover brand; hereinafter we or Endover) process the personal data of potential and existing clients and other persons associated with them, sales contacts, website users and other data subjects with whom Endover comes into contact when providing services to them (hereinafter you). This privacy notification is applicable whenever you use or have used or have expressed the intent to use our services, including visiting our website, providing us with your e-mail address to sign up for our newsletter, applying for a vacancy or submitting a job request.
In the above cases we are the controller responsible for processing your personal data.
Collection of personal data. We collect your personal data in the following ways:
Processing of personal data. We process the following kinds of personal data.
Purpose of and legal basis for processing We process your personal data for the following purposes and we have the following legal basis for processing it:
We may also process your personal data when, under specific circumstances, it is necessary for the purposes of our or third-party legitimate interest, except when such interest is outweighed by your interests or fundamental rights and freedoms with regard to the protection of personal data as well as under circumstances in which it is necessary to protect your vital interests or those of any other natural person.
We do not process special categories of personal data.
Processing on the basis of your consent. We can process your personal data on the basis of your consent (for example, sending newsletters for the purposes of direct marketing). When processing is based on your consent, you can withdraw your consent at any time by using the contact information below or by clicking on the “Unsubscribe from this list” link provided at the end of all e-mails we send. Please keep in mind that the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Processors. To process your personal data, we rely on carefully selected service providers (processors). However, it is still us who is fully responsible for your personal data.
We use processors in the following areas: providers of data storage, e-mail, customer relationship management, brokering, payment and job placement services.
For further information on processors (their names and addresses), please contact us using the information below.
Third parties. We share your personal data with third parties only for the purposes established in this privacy notification, when this is required by applicable law (for example, when we are obliged to share personal data with authorities) or with your consent.
We can share your personal data with companies in the Endover Group, our auditors and legal consultants. Legitimate basis for such sharing is our relevant legal obligation or legitimate interest.
Personal data transfer outside the EU. Our processors may process your personal data outside the EU (including in the US). We transfer your personal data outside the EU only when we have a legitimate basis for doing so, including to data recipients: i) who are located in countries which, according to the Commission’s evaluation, offer an adequate level of data protection (includes Privacy Shield-certified organisations); or ii) under an agreement which complies with EU requirements on personal data transfer to processors not established in the EU.
For further information on personal data transfer outside the EU (for example, processors’ names and legal basis for transfer), contact us using the information below.
Data security. We implement technical and organisational security measures to protect your data, taking into account (i) technological developments, (ii) the cost of implementation, (iii) the nature, scope, context and purposes of processing, and (iv) risks to you. Such security measures include, among others, data access management, employee training, two-factor authentication and data encryption.
Data storage. We store your personal data for as long as necessary to achieve the purposes for which it is collected, to protect our interests or to comply with applicable law.
If you have made an agreement with us, we store the following personal data:
If you have signed up to receive information that you might be interested in, we store your personal data for 5 years from the day we had contact with you for the last time.
If you have participated in an open-house event and we have not made any agreement with you, we store your personal data for 5 years from the day the event took place.
If you have unsuccessfully applied for a vacancy with us, we store your personal data for 1 month after officially filling the position you applied for. On the basis of your separate consent, we store relevant data for up to 6 months from the end of the recruitment process. If you have provided us with your contact information and uploaded your CV on our website, we store your personal data for up to 6 months after making it available to us.
Photo and video imagery recorded by us is stored for 7 years after recording them.
Data collected by cookies used on our website is stored according to the provisions of our Cookies Policy.
Your rights. Concerning your personal data, you are granted all rights held by data subjects to the extent compatible with applicable data protection laws. Regarding your personal data, these include the right to:
To exercise your rights, contact us using the information below.
If you believe that your rights have been violated, file a complaint with the Estonian Data Protection Inspectorate or take legal action.
Changes to the privacy notification. When the need arises to make changes to our data processing policy or the privacy notification due to applicable data protection laws, other legislation, case law or guidelines or regulations issued by competent authorities, we have the right to make changes to the privacy notification unilaterally and at any time. In this case we will inform you within a reasonable period of time before the changes enter into force.
Applicable law. Because our company is registered in the Republic of Estonia, the processing of your personal data is governed by Estonian law.
Contact information. If you have any questions about the processing of your personal data or if you seek to exercise the rights you have as a data subject, please contact us by visiting our office at Tartu Road 2, Tallinn 10145, e-mailing us at firstname.lastname@example.org or calling us at +372 666 0620.