Privacy Notice for SoftPOS service

Valid from 08.08.2023

Who is processing my personal data?

The controller of your personal data is Maksekeskus AS (Liivalaia 45, 10145, Tallinn, Estonia, Registration number: 12268475) and/or its Latvian branch depending on the country you are located (“Maksekeskus”).

What data types and why are being processed?

We will process your contact information to deliver the payment receipt to the e-mail address indicated by you.

What is the legal ground for the processing of my personal data?

The legal ground for the processing of your personal data is a necessity to provide you with a service you have requested (Art. 6 1) b) of General Data Protection Regulation).

To whom my personal data may be disclosed?

We may disclose your Personal Data to entities who are directly or indirectly involved in the provision of services to you and their sub‑contractors (for example, payment application provider and its subcontractors providing technical support).

In cases where personal data processing is carried out on behalf of Maksekeskus by a third party, we engage only third parties providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing will meet the requirements of the General Data Protection Regulation and applicable laws and ensure the protection of your rights.

Processing activities by third‑party processors shall always be governed by a Privacy & Data Processing Agreement or other specific terms agreed upon by Maksekeskus and such third-party processors.

Can my data be transferred outside Europe?

No, we store and process your personal data in servers within the European Union and European Economic Area (EU/EEA).

For how long my personal data will be stored?

Your e-mail address will be stored for 1 month.

What rights do I have?

We make sure all persons’ rights arising under applicable laws are always ensured. In particular, you have:

• Right of access (GDPR Art 15). You have the right to access the personal data Maksekeskus processes about you. Upon your request, we shall:
  – confirm whether or not personal data relating to you are being processed and provide information as to the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data are disclosed;
  – communicate to you about the personal data undergoing processing and about any available information as to their source;
  – provide to you with knowledge of the logic involved in any automated processing of personal data concerning you in the case of automated decisions.
• Right to rectification (GDPR Art 16). You have the right to request us to rectify any inaccurate or incomplete Personal Data we process about you;
• Right to erasure (GDPR Art 17). You have the right to request the erasure of processing of the personal data, if:
  – personal data is no longer necessary for the purposes, for which it was collected;
  – You have withdrawn consent, where personal data was processed only on the ground of consent;
  – You have objected to the processing under GDPR Article 21 (1) and there are no overriding legitimate grounds for the processing or where you objected to the processing of your personal data for the purposes of direct marketing;
  – we do not have a legal ground to process your data;
  – the personal data have to be erased for compliance with a legal obligation.
• Right to restriction of processing (GDPR Art 18). You have the right to request us to restrict further processing of your personal data if:
  – You contest the accuracy of your personal information;
  – the processing of your personal data is unlawful;
  – You have objected to the processing under GDPR Article 21 (1) – until it would be determined if legitimate interests to process personal data outweigh your interests.
• Right to data portability (GDPR Art 20). You have the right to receive the personal data processed in a structured, commonly used, and machine‑readable format and the right to transmit the personal data to another controller. This right you have in respect of your personal data, which we obtained from you and processes on the basis of your consent or due to a contract fulfillment or processes automatically;
• Right to object (GDPR Art 21). You have the right to object to the processing of your personal data, where the legal basis for such processing is either legitimate interest or public interest. If we receive such a request from you we either have to stop further processing or respond to you in writing and explain reasons why we do not comply with your request. Also, we may still process your personal data to an extent this is necessary for the establishment, exercise, or defense of our legal claims;
• Right, to lodge a complaint. You also have a right to lodge a complaint with a supervisory authority:
  – in Estonia to the Data Protection Inspectorate (website: aki.ee);
  – in Latvia to the Data State Inspectorate (website: dvi.gov.lv).
  – in Lithuania to the State Data Protection Inspectorate (website: ada.lt).

Contact details for further questions

If you would like to know more about how we process customer personal data for the provision of payment services, please refer to Maksekeskus Privacy Policy available on our web page:

– in Estonia – maksekeskus.ee/andmekaitsetingimused/

– in Latvia – makecommerce.lv/privatuma-politika/

– in Lithuania – makecommerce.lt/bendrosios-salygos-ir-privatumo-politika/

 

If you wish to exercise any of your rights, we encourage you to contact us via telephone:

– in Estonia – +372 58875115

– in Latvia – +371 25189718

– in Lithuania – +370 65550064

e-mail: dpo@maksekeskus.ee

Contact details for any privacy-related questions are the following:

• Data protection officer dpo@maksekeskus.ee