Last Updated: 26.09.2023
At SolaInvest OÜ, we are committed to upholding the highest standards of data protection and privacy for our valued users. We recognize the importance of safeguarding your personal data and ensuring its responsible and lawful processing. That's why we proudly declare our full compliance with the General Data Protection Regulation (GDPR).
Data protection regulations play a pivotal role in safeguarding individuals' fundamental rights and freedoms in the digital age. In Estonia and throughout the European Union, these regulations are governed by a comprehensive framework known as the General Data Protection Regulation (GDPR). This framework has significantly reshaped the landscape of data protection, ensuring the responsible and lawful processing of personal data.
This GDPR Compliance Document is subject to regular review and updates to ensure ongoing compliance with GDPR requirements. All employees and contractors of SolaInvest OÜ are responsible for familiarizing themselves with this document and complying with its provisions.
1. Introduction
1.1 Purpose
This GDPR Compliance Document outlines the data protection principles, data processing activities, data subject rights, and data security measures employed by SolaInvest OÜ in compliance with the General Data Protection Regulation (GDPR).
1.2 Scope
This document applies to all data processing activities carried out by SolaInvest OÜ, including those related to the operation of our dating platform.
1.3 GDPR
This The GDPR, represents a unified approach to data protection across all EU member states. Its core principles emphasize the rights of individuals to have control over their personal data and the obligations of organizations to handle this data with utmost care and transparency. GDPR sets forth a robust framework for data protection, encompassing essential aspects such as:
1.3.1 Lawfulness, Fairness, and Transparency: Data processing must be lawful, fair, and transparent to the data subjects. Consent and legitimate purposes are key.
1.3.2 Purpose Limitation and Data Minimization: Personal data should only be collected for specific, explicit, and legitimate purposes. Data minimization ensures that only necessary data is processed.
1.3.3 Accuracy and Storage Limitation: Organizations must maintain accurate data and not store it longer than necessary for the intended purpose.
1.3.4 Integrity and Confidentiality: Adequate security measures must be in place to protect personal data from breaches, ensuring its integrity and confidentiality.
1.3.5 Accountability and Transparency: Organizations are accountable for their data processing activities and must be transparent about how data is handled.
1.4 Subject
Data Controller: SolaInvest OÜ
Data Subject: Any individual whose personal data is processed by SolaInvest OÜ.
Personal Data: Any information relating to an identified or identifiable natural person.
2. Data Protection Principles
2.1 Data Protection in Estonia
In Estonia, GDPR is implemented alongside the Personal Data Protection Act (IKS), which complements and specifies certain provisions of the regulation. Estonia has a strong tradition of embracing digital solutions, and this extends to data protection. The Data Protection Inspectorate, under the Estonian Information System Authority, oversees compliance with data protection laws in Estonia. It ensures that organizations within the country respect individuals' rights to privacy and data protection.
2.2 Data Protection in the European Union
The GDPR is not limited to Estonia but is a comprehensive legal framework applicable across the European Union. This means that the principles and obligations it outlines are consistent across EU member states. It provides a level playing field for businesses operating within the EU and reinforces the rights of individuals across borders.
SolaInvest OÜ adheres to the following data protection principles:
2.2.1 Personal data shall be processed lawfully, fairly, and transparently.
2.2.2 Personal data shall be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
2.2.3 Personal data shall be adequate, relevant, and limited to what is necessary for the purposes for which it is processed.
2.2.4 Personal data shall be accurate and, where necessary, kept up to date.
2.2.5 Personal data shall be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.
2.2.6 Personal data shall be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
SolaInvest OÜ is accountable for complying with all GDPR requirements and shall be transparent about data processing activities.
3. Data Processing Activities
To get acquainted with the Data collection information, you can check our Privacy Policy documents on https://suggie.com/privacy-policy. There you will be able to find SolaInvest OÜ collects personal data of users for which purposes.
SolaInvest OÜ has procedures in place to detect, report, and investigate data breaches.
4. Data Subject Rights
4.1 Right to Access
Data subjects have the right to access their personal data held by SolaInvest OÜ.
4.2 Right to Rectification
Data subjects can request the correction of inaccurate personal data.
4.3 Right to Be Forgotten
Data subjects have the right to request the deletion of their personal data under certain circumstances.
4.4 Right to Restriction of Processing
Data subjects can request restrictions on the processing of their personal data.
4.5 Right to Data Portability
Data subjects can request the transfer of their personal data to another data controller.
4.6 Right to Object
Data subjects can object to the processing of their personal data.
4.7 Automated Decision-Making and Profiling
Data subjects have the right not to be subject to decisions based solely on automated processing, including profiling.
5. Data Security Measures
5.1 Measures
Sensitive data is encrypted during transmission and storage. Access to personal data is restricted to authorized personnel. Only necessary data for the SolaInvest OÜ platform is collected and processed.
5.4 Third-Party Data Processors
Third-party data processors are selected based on their GDPR compliance.
6. Data Breach Response
6.1 Reporting a Data Breach
Data breaches are reported to the relevant authorities and affected data subjects as required by Republic of Estonia legislation.
6.2 Investigating a Data Breach
Data breaches are promptly investigated to determine their impact and causes.
6.3 Mitigating a Data Breach
Measures are taken to mitigate the impact of data breaches and prevent their recurrence.
7. International Data Transfers
7.1 Data Transfer Mechanisms
Data transfers outside the European Economic Area (EEA) are made using GDPR-compliant mechanisms.
7.2 Data Transfer Records
Records of international data transfers are maintained.
8. Documentation and Records
8.1 Records of Processing Activities
Records of data processing activities are maintained.
8.2 Consent Records
Records of data subject consent are maintained.
8.3 Data Protection Impact Assessments
Records of DPIAs are maintained.
8.4 Data Breach Records
Records of data breaches are maintained.
9. Privacy
9.1 Content Requirements
The privacy policy includes information about data processing activities, data subject rights, and contact information.
9.2 Updating the Privacy Policy
The privacy policy is regularly updated to reflect changes in data processing activities. It is mentioned in the beginning of the Privacy Policy document when was it updated the last time.
9.3 Consent Mechanisms
Consent mechanisms are in place for data subjects to provide informed consent.
10. Contact Information
10.1 Contact for Data Subjects
Right of data subjects to obtain information and personal data concerning them permits users of our website to request certain information regarding our disclosure of personal information to nonparties for their direct marketing purposes. To make that request, please send an email to privacy@suggie.com.
Conclusion
In conclusion, GDPR and the data protection regulations in Estonia and the EU are fundamental in preserving the privacy and security of personal data. They establish a robust framework that harmonizes data protection practices and sets a high standard for responsible data processing. Compliance with these regulations is not only a legal obligation but also a commitment to respecting individuals' privacy and data rights in the digital era.