Privacy Notice

1. Introduction

This privacy policy (hereinafter Privacy Policy) informs you of why, on what legal bases and how ADM Interactive OÜ (hereinafter ADM or we) process your personal data. This Privacy Policy also informs you on how long we retain personal data, what your data privacy rights are and how you can exercise these rights. This Privacy Policy is addressed to you as a visitor of our website (https://www.adm.ee; hereinafter Website), our existing or potential customer, or a potential applicant in an ADM recruitment procedure.

We highly value your privacy and therefore comply with the requirements of the General Data Protection Regulation (EU) 2016/679 (hereinafter GDPR) and other legislation whenever we process personal data. By making this Privacy Policy available, we meet our obligation to provide information as per Articles 13 and 14 of the GDPR.

2. Controller

The controller of your personal data is ADM Interactive OÜ;

Registry code: 10474271;

Address: Kursi 3, Tallinn 10415, Republic of Estonia; Please send any inquiries concerning personal data processing to: info@adm.ee

3. Purposes of and legal bases for processing personal data

We process your personal data to the minimum extent necessary for the purposes described in this section of the Privacy Policy. Any processing of personal data has a specific and limited purpose, as well as a legal basis, as described in detail below.

In situations where the legal basis for processing is the legitimate interest of ADM, we have thoroughly analysed the relevant processing operations and determined that the processing will not disproportionately interfere with your interests, fundamental rights and freedoms, and that your personal data will only be processed to the minimum extent necessary.

The purposes of and legal bases for processing are described in detail in the subsections below.

3.1. Entry into and performance of contracts for providing services

ADM’s core business is software development and management, especially in the areas of digital sales, service, communication and marketing solutions. In this context, ADM advises its potential and existing customers in matters concerning information system and service analysis and strategic planning. To this end, ADM conducts pre-contractual negotiations with its customers, as a result of which ADM may enter into various types of contracts, including software consultation, development, maintenance and management contracts.

ADM’s customers are legal persons, which is why personal data are processed to the minimum extent in the course of providing services. However, ADM may process the following personal data of customers who are legal persons:

  • first name and surname of the customer’s representative;
  • personal identification number of the customer’s representative;
  • title or position of the customer’s representative;
  • the customer’s representative’s right to represent the relevant company;
  • contact details (e-mail address, telephone number) of the customer’s representative;
  • personal data of the customer’s representative revealed by them in the communication (such as e-mails) between the customer’s representative and ADM.

The legal basis for the processing described in this subsection is the obligation to perform a contract between ADM and the customer or the need to take steps prior to entering into a contract (Article 6 (1) (b) of the GDPR).

Where the customer makes any personal data at their disposal available to ADM (e.g. if this is unavoidable for data migration in the course of the service being provided), ADM will act as the processor with respect to that customer, and the details of processing the relevant data must be included in the privacy policy of that customer as the controller.

3.2. Marketing and communication

If you have given us your relevant consent, e.g. entered your e-mail on the Website to be included in the mailing list and confirmed your relevant wish by clicking on the link in the check letter you received by e-mail, we will occasionally send you newsletters, including information about ADM’s activities and information that may be of interest to you. To send newsletters, we process your email address, and the legal basis for this processing operation is the consent given by you as the data subject (Article 6 (1) (a) of the GDPR).

You may withdraw your consent at any time by clicking on the “loobu uudiskirjadest” or “Unsubscribe” button at the end of each newsletter. You can also unsubscribe from newsletters by sending us a relevant notice at the e-mail address specified in Section 2 of this Privacy Policy.

Please note that withdrawal of consent will not affect the lawfulness of any previous processing based on your valid consent.

Furthermore, we may also send direct marketing messages to our potential or existing customers (legal persons). In such case, we send newsletters only to the contact details of the legal person, usually to the general contacts, but in certain cases to the e-mails of specific positions (such as head of IT, head of procurements, etc.), considering the content of the marketing message and the related professional decision-making capacity. Also in such case, you can unsubscribe from further marketing messages by clicking on the “loobu uudiskirjadest” or “Unsubscribe” button at the end of each newsletter. You can also unsubscribe from newsletters by sending us a relevant notice at the e-mail address specified in Section 2 of this Privacy Policy.

The legal basis for direct marketing addressed to legal persons arises from subsections 1031 (2) and (3) of the Electronic Communications Act. As the natural person may be identifiable through the official contact details of a legal person on certain occasions, we have followed best practice to additionally conduct a thorough analysis of legitimate interests to make sure that the relevant data processing does not disproportionately interfere with the interests or rights of any data subjects.

If you send us an e-mail or contact us using other electronic means on your own initiative, you may send us your personal data when doing so. In particular, such personal data are your:

  • first name and surname;
  • contact details (e-mail address, telephone number);
  • position and relation to the relevant company.

Depending on the content of your message, you may send us further personal data on your own initiative. The legal basis for processing the personal data you have sent to ADM on your own initiative, including for the purpose of replying to inquiries, is taking steps prior to entering into contracts at the request of the data subject (Article 6 (1) (b) of the GDPR).

3.3. Recruitment activities

From time to time we recruit new employees for various vacant positions (hereinafter Role) and offer traineeships. In the course of recruitment processes, we may publish job and traineeship offers on the Website and in recruitment environments. We therefore mainly receive personal data in the context of recruitment activities directly from you.

Further to the above, we may contact you as an applicant on our own initiative, using the information you have published on social media platforms (such as LinkedIn), for example if you have identified yourself as potentially interested in new Roles and we find that a relevant Role matches your profile. Where we use professional recruitment services, the relevant service provider acts as a processor for the purpose of processing your personal data, with whom we have entered into a data processing contract corresponding to Article 28 (3) of the GDPR.

If you apply for a job or traineeship at ADM through an advertisement in a recruitment portal or an application of a similar service provider on your own initiative, please consider that the service provider also acts as an independent controller with respect to your personal data. We therefore advise you to always read the privacy policy of the relevant service provider.

In certain cases, we may receive your personal data from third parties, such as our staff members or partners, who may inform us of your potential interest in or suitability for a particular Role.

ADM will check your suitability as an applicant for a particular Role through a multi-stage process, which may consist of the following stages depending on the Role:

  • Analysis of the materials submitted by you (CV, motivation letter, independent task, results of aptitude tests, etc.);
  • A background check against information in the national information system databases (criminal record and commercial register inquiries);
  • A background check against information in private-law databases (Creditinfo Eesti AS);
  • Contacting your previous employers to assess your suitability;
  • Individual and/or group interviews to assess suitability.

In the course of the above, ADM processes various personal data, especially the following data pertaining to you as an applicant:

  • first name and surname;
  • personal identification number;
  • contact details (address, telephone number, e-mail address);
  • criminal record and commercial register data;
  • submitted materials, including CV, motivation letter, solution of an independent task, content of interviews, results of aptitude tests etc.;
  • other information you have provided on your own initiative.

The purpose of processing personal data during recruitment processes is to assess the applicant’s suitability for the available Role, i.e. analyse the possibility of entering into an employment or other similar contract. Therefore, the basis for data processing during recruitment is, as a rule, taking steps prior to entering into a contract at the data subject’s request (Article 6 (1) (b) of the GDPR). However, if ADM contacts you on its own initiative in the context of potential recruitment, the legal basis for processing your personal data is ADM’s legitimate interest in finding the persons best suited for the vacant Roles at ADM from among potentially interested applicants.

3.4. Performance of obligations arising from legal acts

In certain cases, we have to process personal data to perform obligations arising from legal acts. Such obligations include accounting, responding to inquiries from authorities, and reporting any violations or suspicions to supervisory authorities and relevant persons.

In such situations, the legal basis for processing personal data is compliance with a legal obligation of ADM (Article 6 (1) (c) of GDPR).

4. Web cookies

Further to the purposes listed in the section above, we use web cookies on the Website to offer you a better, faster and more secure user experience. Web cookies are small text files stored in your computer, smartphone, tablet computer or other device you use to visit the Website. Web cookies give us information on how the Website is used, allow for compiling statistics on Website visitations and for displaying marketing content that may be of interest to you, and ensure the functionality and user-friendliness of the Website.

Web cookies are divided into permanent and session cookies based on their term of storage. Permanent cookies will remain in your device until the end of their storage term (or until you delete them), i.e. after closing the browser or shutting down the device. Session cookies are deleted as soon as you close your browser.

Web cookies are divided as follows based on their purpose:

  • functional, i.e. strictly necessary web cookies – functional web cookies ensure the core functions of the Website, i.e. allow navigation on the Website and enable many of its functionalities (such as filling in and memorising various fields). Functional cookies include strictly necessary cookies, without which it would be impossible to display the Website content to the user or use the Website for its intended purpose;
  • analytics and statistics cookies – these cookies collect non-personalised information on how the Website is used. For example, they inform us of which pages and sub-pages of the Website are visited the most often;
  • advertising and marketing cookies – advertising and marketing cookies allow for displaying advertisements of potential interest to the Website visitor, measuring the efficiency of an advertisement (such as the number of clicks) and regulate its repetition toward a particular visitor;
  • third party cookies – the Website also uses third party content (such as linked videos) and therefore cookies originating from other websites (such as Google or Facebook). Such cookies allow for collecting information on whether and how you use the content of such websites on our Website.

A reference to the cookie classification

The cookies used on the Website may change over time. By visiting the Website, you agree to using the cookies strictly necessary for the Website to function, and you are not asked for specific consent to the use of such cookies. Your consent is requested for using the remaining types of cookies on the ADM Website.

You can waive cookies any time by changing the browser settings and deleting the stored cookies.

5. Storage of personal data

We will store your personal data for only as long as necessary to achieve the purpose of processing as specified in Section 3 of this Privacy Policy.

Personal data processed during entry into and performance of contracts

These personal data are generally stored for the duration of the contract and, after the end of the contract, for the term of any rights of claim arising from the legislation. Personal data processed during pre-contractual negotiations or advising, which have not led to a customer contract (such as data processed during advising and price quotations) will be stored for three years after the end of the negotiations.

Personal data processed during marketing activities

These personal data are stored until the end of the need for processing, but not longer than the withdrawal of the consent that served as the legal basis for the marketing activity. If we use direct marketing addressed to legal persons, the legal basis for which is our legitimate interest, we will end the direct marketing activities and delete the contact details of the relevant legal persons upon the cessation of legitimate interest, but no later than upon opt-out by the legal person of the marketing activity.

Personal data processed during recruitment activities

These personal data are stored for two years after the end of the recruitment process and, if the process ends with the conclusion of an employment or other similar contract, also throughout the term of the contract.

Data processed to comply with legal obligations

To comply with our legal obligations and in other exceptional cases we may store personal data for a period longer than those specified above, including:

(a) to comply with legal obligations;

(b) for accounting purposes;

(c) for reasons relating to the exercise of possible rights of claim.

For example, as stated above, we store all accounting source documents (such as invoices) for seven years after the end of the financial year in which the relevant accounting entry was made.

To be able to file claims or object to any claims against us, we may store personal data for a maximum term of ten years, according to the expiration terms of the claims, and in the event of ongoing disputes, until the final settlement of such disputes.

6. Origin of and rights to access personal data

We receive your personal data mainly directly from you as a data subject representing our potential or existing customer. We may also receive your personal data if you enter your e-mail address in the Website form to join our mailing list, or if you contact us by phone or e-mail.

Access to the personal data covered by this Privacy Policy is given only to our employees for the purpose of performing their job duties and it is strictly limited to a needs basis. In certain cases, the partners and service providers providing particular services to us (such as accounting or newsletter distribution services) may have access to personal data.

7. Recipients of personal data

We may transfer your personal data to third parties only if there is a legal basis for doing so, for example if you have given us your relevant consent or if we are obliged to do so under the legislation (such as the Accounting Act).

Data, including a minimum necessary amount of personal data will be transferred to third parties particularly if we use processors (such as a newsletter service provider) to perform certain tasks in the course of our activities. In such case, we have a processing contract with the processor under Article 28 (3) of the GDPR, ensuring a high level of protection of personal data and compliance with all legal requirements and best practices.

8. Security measures

We have taken extensive information technology, organisational and physical security measures to ensure the security of personal data. Access to any personal data is strictly based on needs and positions within the organisation.

9. Links to other websites

Our website may contain references, including links to external environments, including other websites, social media articles and video environments controlled by third parties. If you click on a link, you will be directed to a third party website, the data processing through which is not

under our control. Therefore, we recommend reading the privacy policy and cookie policy of each relevant third party.

10. Data protection rights

In connection with the processing by ADM of your personal data, you have the following data protection rights under the GDPR:

Right of access to data

You have the right to ask whether and which personal data concerning you we process, on which legal bases and how. You also have the right to request a copy of your personal data being processed.

Right to rectification and erasure of personal data

You have the right to request that we rectify any mistakes in your personal data being processed (for example, if your personal data have changed). In certain cases, you have the right to request that we erase your personal data being processed. Please note that we have the right to refuse to erase certain personal data, for example if the continuation of processing is necessary to secure potential rights of claim or comply with legal obligations.

Right to restriction of processing

You have the right to request that we restrict the processing of your personal data. In such a situation, we will retain the right to process your personal data only to a limited extent, such as to secure potential rights of claim or comply with legal obligations.

Right to object

If your personal data is processed on the legal basis of ADM’s legitimate interest, you have the right to object to the relevant processing of personal data. You also have the right to object to any automated decision-making by us and to processing related to direct marketing (such as sending newsletters).

Right to data portability

If we process your personal data on the basis of your consent or a contractual obligation, you have the right to request your personal data in a structured, commonly used and machine-readable format. If this is technically feasible, you may also request that we transfer these data to another controller specified by you.

Right to withdraw consent at any time

If your personal data are processed on the legal basis of your consent, you have the right to withdraw the consent at any time. Please note that withdrawal of consent will not affect the lawfulness of any previous processing based on your valid consent.

To exercise the above rights, please contact us at the e-mail address provided in Section 2 of this Privacy Policy. Please note that data protection rights are not absolute, and for each request, we will have to determine whether and to what extent your request can be met under data protection legislation. As a rule, we will respond to your request within one month of receipt. If we cannot respond within one month, we may extend the term by two months by notifying you of the extension and its reasons within one month of receiving your request.

11. Questions and complaints

If you have any questions or complaints about the processing of your personal data, please contact us at the e-mail address provided in Section 2 of this Privacy Policy. We will reply at the earliest opportunity, but as a rule, no later than within one month of receiving your question or complaint. Considering the extent and complexity of your question or complaint, we may extend the term for replying by two months if necessary.

If you disagree with the reply received, you may complain to the supervisory authority as follows:

Data Protection Inspectorate

Address: Tatari 39, 10134 Tallinn E-mail: info@aki.ee

Telephone: +372 627 4135

12. Privacy Policy updates

We make regular efforts to ensure that our data processing and its documentation are simple, clear and transparent and meet all the requirements of legislation and best practices of data protection. We will therefore update, elaborate on and improve this Privacy Policy on a regular basis.

You will always find the latest version of the Privacy Policy on our Website.

#admpeople

Join the #admpeople conversation in social media as we highlight employee photos and stories about working at ADM.