BALTIC RESTAURANT SERVICES OÜ PRIVACY POLICY
In this privacy policy (“Privacy Policy”), we describe how Baltic Restaurant Services OÜ
(“Company”) processes the personal data of its employees, customers, or individuals
otherwise collaborating with the Company, and the measures we implement to protect personal data.
Personal data is processed in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679)
and other national and European privacy laws and regulations (collectively, “Data Protection Law”).
- SCOPE
This Privacy Policy applies to all personal data that we process as the data controller.
The Company processes, for example, the personal data of employees, temporary workers,
sole proprietors, job applicants, supplier contact persons, customers, guests, and other partners.
- PURPOSE
The purpose of this Privacy Policy is to explain what personal data we process and how and why
we do so. Additionally, this Privacy Policy describes our obligations and responsibilities regarding data protection.
This Privacy Policy does not provide an exhaustive account of our data protection activities;
specific rules and guidelines are established in various areas—such as security—
and we communicate these internally to a reasonable extent. DEFINITIONS
In this privacy policy, the following terms are used with the meanings specified below:
EEA – European Economic Area
GDPR – the EU General Data Protection Regulation (Regulation (EU) 2016/679),
which became applicable on 25 May 2018.
Personal data – any data and information relating to a natural person (an individual) that
allow that person to be identified. A person is identifiable if their identity can be determined
from the data within a reasonable scope and without disproportionate effort. Identification may be
based on, for example, a name, personal identification code, location data, an online identifier,
or a physical, physiological, genetic, mental, economic, cultural, or social characteristic,
or a combination of such characteristics.
Special categories of personal data – personal data revealing a person’s racial or ethnic origin,
political opinions, religious or philosophical beliefs, or trade union membership, as well as
genetic data, biometric data used for the unique identification of a person,
health data, or data concerning a natural person’s sex life and sexual orientation. Personal data breach – a security breach leading to the accidental or unlawful destruction, loss,
alteration, unauthorized disclosure of, or unauthorized access to, personal data transmitted, stored,
or otherwise processed.
Client – a natural person to whom the company provides services and/or
offers goods in the course of its business activities.
Third party – a natural or legal person, public authority, agency, or body other than
the data subject, the controller, or the processor, and persons who may process personal data
under the direct authority of the controller or the processor.
Cooperation partner – a natural person who is a supplier to the company or an
employee/representative/contact person of a cooperation partner that is a legal entity.
Profiling – any form of automated processing of personal data consisting of the use of personal data
to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict
aspects concerning that natural person’s work performance,
economic situation, health, personal preferences, interests, reliability, behavior, location, or
movements. Processing – an operation or set of operations performed on personal data, such as collection,
documentation, organization, structuring, storage, adaptation and alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or otherwise making available,
alignment or combination, restriction, erasure, or destruction. Processing may
take place manually or by using automated systems, such as IT systems.
Contractor – a natural person (i.e., not a company) with whom the company has concluded a contract for
services (service provision agreement); this also includes members of the company’s management bodies.
Controller – the person who decides why and how (i.e., for what purposes and by what means) personal data
are processed. Answering the following questions may help in identifying the controller:
- Who decides which personal data are stored?
- Who decides for what purposes personal data are used?
- Who decides how personal data are processed?
If a person decides on the processing of personal data in their possession and is responsible for them,
then they are the controller.
Processor – a person who processes personal data on behalf of the controller. If personal data are
in a person’s possession or are being processed by them, but they do not have the authority to decide on the processing—i.e., they are processing
them in accordance with the instructions of the controller,