MTÜ Sa Suudad (hereinafter referred to as the „NGO“) processes personal data lawfully, purposefully and transparently, in accordance with the European Union General Data Protection Regulation (EU) 2016/679 (hereinafter referred to as the GDPR), the Personal Data Protection Act and other applicable legislation.
We do everything we can to ensure the privacy of individuals through our internal work organization and we follow the principles of transparency and minimality when processing personal data. We also require our partners to follow the same principles.
The most commonly used terms in personal data protection:
- Data subject is an identified or identifiable natural person whose personal data are being processed.
- Personal data is any information about the data subject, including name, personal identification number, contact details, computer IP address.
- Processing of personal data are operations performed on personal data, including collection, storage, use, modification, deletion.
- Consent is a voluntary, informed and unambiguous statement of intent by the data subject, by which he or she consents to the processing of his or her personal data.
- Controller is the natural or legal person who determines the purposes and means of the processing of personal data.
- Authorized processor is a natural or legal person who processes personal data on behalf of the controller.
- Third person is a natural or legal person who is not the data subject, the controller, the processor or an employee of any of these persons.
Data protection conditions for the processing of personal data
We do not disclose the name, contact details and other information that allows the identification of the individual. The response document is delivered to the individual by e-mail (e-mails are not encrypted) and by post as a regular or registered letter (the postal service provider and the recipient of the letter are responsible for the postal risk) or by personal delivery if the individual comes to pick up the letter on site. Normal correspondence is carried out by unencrypted e-mail. When transmitting sensitive information, we ask that you agree with us in advance on a more secure method of transmission. The document is delivered using address details that the individual has disclosed to us or that the individual has clearly disclosed elsewhere in the public domain (e.g. on the web).
- Request for clarification, memorandum, request for information, application or statement
In this case, the basis for processing personal data is the requester's own initiative. We will make additional inquiries if necessary to respond, but we will disclose the personal data entrusted to us only to the minimum extent necessary to fulfill the purpose.
- Filing a complaint or appeal
We will use the personal data we receive in connection with a complaint or objection only to resolve the matter in question. We will disclose the personal data of the person submitting the complaint or objection to the other party only to the minimum extent necessary to resolve the matter.
A complaint or objection that falls within the jurisdiction of another institution shall be forwarded to the relevant institution and the person submitting the complaint or objection shall be notified of the forwarding.
- Registering for events, participating in surveys, or contacting the NGO by phone
When registering for events, we process personal data to compile a list of event participants and, if necessary, to contact the registrant.
When participating in a survey, data will be published in a non-personalized form for statistical purposes only. In the case of surveys where prizes are drawn among respondents, we process personal data to contact the respondent.
When calling the information line, we process personal data only to the extent disclosed by the caller for the purpose of providing information to the caller. Telephone calls made to the NGO are not recorded.
- Processing payments for donations and subscriptions
When you make a donation or order to us via the website, we collect the data necessary to process the payment (e.g. name, email address, donation/order amount and explanation). We forward this data to our authorized processor to securely process the payment itself. To Maksekeskus AS, who mediates the payment via a bank, bank link or payment card.
The NGO itself does not see or store your full payment card or bank account details: they are processed and stored only by Maksekeskus AS, which is responsible for processing payment data in accordance with its own data protection terms and applicable legislation. When making a payment, only the name of the payer, the payment method used, and the amount and date of the transaction remain visible to us, which we use to keep records of donations and orders and to fulfill accounting obligations.
For donations made directly by bank transfer (via IBAN), we only see and process the data that the payer has included in the transfer explanation and sender details.
- Work and applying for volunteering
When applying for a position as a trustee or volunteer assistant, we process personal data provided by the applicant to us or published in public sources to assess the applicant's suitability. The applicant has the right to review the information received and submit their own explanations or objections.
We assume that the recommenders provided in the application documents have given their consent to be contacted to obtain information about the candidate and that the candidate has given their consent to the recommenders to answer questions about themselves. The candidate is responsible for ensuring that the recommenders have given their informed consent to be contacted and to the processing of personal data for the purpose of requesting a recommendation.
Data retention
Retention periods depend on the purpose of processing and the type of document and are determined in accordance with applicable legislation or the internal rules of the NGO. More detailed information about retention periods can be requested at info@sasuudad.ee.
Documents are destroyed when the retention period expires or the purpose is fulfilled.
In relation to the processing of personal data, the data subject may:
- receive information from the NGO about the processing of their personal data, including the purposes of processing and the transfer of data.
- demand the correction of their incorrect personal data, the completion of incomplete data, and the restriction of the processing of personal data in accordance with legislation.
- The data subject has the right to object to the processing of their data if the data is processed on the basis of legitimate interest, and to request the restriction or termination of the processing if there is no legal basis for it.
- request the deletion of personal data concerning him/her, except if the NGO has a legal basis for storing and processing such personal data.
- to receive information about breaches of his or her personal data where the breach is likely to result in a high risk to his or her rights and freedoms.
- For questions regarding the processing of personal data, please contact the NGO at info@sasuudad.ee
- If the data subject finds that the NGO has violated his/her rights when processing personal data, he/she has the right to seek protection of his/her rights at any time. Data Protection Inspectorate or to the court.
Open data and restricted information
Anyone can reuse the information on the NGO's website without access restrictions, based on ethical principles and without damaging the reputation of the data source.
When collecting people's contact data, the NGO always gives the data subject (or data owner) the opportunity to provide clear confirmation that the data subject is aware of the purpose of data collection, agrees with it, and agrees to the use of their data for the purpose specified in the description of the event underlying the collection.
To protect people's privacy, restricted information is not published as public data. We do not disclose personal information without a legal basis.
References to legislation