Valid from 25/05/2018
Amendments made on 29/06/2020
The principles on the basis of which Veho Baltics processes Personal Data, including Customer Data, are described in these Privacy Policy Terms and Conditions (the web page privacy terms and conditions/the Cookie Policy are accessible separately). The areas of application of these principles include the cases when the Customer purchases, has purchased or has expressed a wish to purchase goods from Veho Baltics or uses, has used or has expressed a wish to use services rendered by Veho Baltics, or is concerned with these services in any other way. The Privacy Policy Terms and Conditions also apply to Customer Relations that have arisen before their entry into force.
1. Definitions
1.1. The following terminology is used in these Privacy Policy Terms and Conditions in the following meaning:
1.1.1. Data Subject – a natural person on who Veho Baltics has data or information that can be used to identify the natural person. The Data Subjects include, for instance, natural person Customers, the dealership visitors, the people wishing a test drive or submitting requests or questions, cooperation partners, representatives of legal person Customers, and in case of rental services, both the lessee and other users of the rental car.
1.1.2. Personal Data – any information on an identified or identifiable Data Subject, including Customers.
1.1.3. Data Protection Regulation – Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
1.1.4. Customer Data – any information (including information considered as Personal Data) that is known to Veho Baltics about the Customer or their representatives.
1.1.5. Customer – any natural or legal person that uses, has used or has expressed a wish to purchase goods from Veho Baltics or to use services rendered by Veho Baltics or is concerned with services of Veho Baltics in any other way.
1.1.6. Third Party – any person who is not the Data Subject, Veho Baltics or a Veho Baltics employee and who individually or collectively with other persons determines the objectives and means of Processing of Personal Data.
1.1.7. Agreement – any agreement made between Veho Baltics and the Customer.
1.1.8. Privacy Policy Terms and Conditions – this text that lays down the principles for Processing of Personal Data by Veho Baltics.
1.1.9. Veho Baltics – Veho Baltics OÜ, Veho AS, Silwi Autoehituse AS and UAB Silberauto.
1.1.10. Veho Baltics Group – Veho Baltics OÜ, Veho AS, Silwi Autoehituse AS, UAB Silberauto and other legal persons where Veho Baltics OÜ owns more than 50% of the respective legal person’s shares or participation either directly or through its subsidiaries.
1.1.11. Processing – any operation, which is performed with the Personal Data of the Data Subject (including collection, recording, storage, alteration, systematization, granting access, use, retrieval, transmission, erasure, etc.), irrespective of the method of operation or the used means.
2. General principles
2.1. Processing of Personal Data by Veho Baltics is carried out in accordance with the requirements provided in the Data Protection Regulation, the Personal Data Protection Act, other relevant legislation and these Privacy Policy Terms and Conditions.
2.2. These Privacy Policy Terms and Conditions describe the general principles used by Veho Baltics for the Processing of Personal Data. Additional conditions for the Processing of Customer Data may also be described in Agreements, other documents concerning the goods or services and on Veho Baltics web pages.
2.3. These Privacy Policy Terms and Conditions form an integral part of Agreements made between Veho Baltics and the Customer. The Privacy Policy Terms and Conditions are applicable to the extent that these do not conflict with the conditions provided for in the Agreement or any other documents concerning the goods or services.
2.4. Veho Baltics grants the confidentiality of Personal Data within the framework of the applicable law and takes appropriate technical and organizational measures for the protection of Personal Data against unauthorised access, unlawful Processing or disclosure, accidental loss, alterations or destruction.
2.5. Veho Baltics may use processors for the Processing of Personal Data. In such cases Veho Baltics ensures that the Processing of Personal Data is carried out according to Veho Baltics’s instructions and in accordance with applicable law and these Privacy Policy Terms and Conditions, and proper security measures are implemented.
2.6. The Privacy Policy Terms and Conditions may be supplemented by privacy notices and the rules applicable to the Cookie Policy, published on the Veho Baltics Group web pages (the web page links are listed in clause 13 of the Privacy Policy Terms and Conditions).
3. Personal Data collection methods
3.1. Veho Baltics collects Personal Data using the following methods (including but not limited to):
3.1.1. Personal Data disclosed to Veho Baltics mainly by the Data Subject (e.g. through requests, applications, making Agreements);
3.1.2. Personal Data received as a result of normal communication between the Data Subject and Veho Baltics, including e-mail correspondence;
3.1.3. Personal Data manifestly made public by the Data Subject (e.g. in social media);
3.1.4. Personal Data received as a result of purchase of goods and/or services of Veho Baltics (e.g. card payments, money transfers, etc.);
3.1.5. Personal Data received from Third Parties (e.g. from the Estonian Road Administration in connection with recall of vehicles, from roadside assistance providers and/or from insurance undertakings in connection with a specific incident that has taken place with a vehicle, from the commercial or population register or any other public source or register, from the business partners of Veho Baltics
3.1.6. Personal Data combined by Veho Baltics (e.g. a list of purchase and repair history);
3.1.7. Personal Data processed as a result of visiting the web pages of cars sold and resold by Veho Baltics (detailed information will be displayed when visiting a respective web page);
3.1.8. The visits of Veho Baltics web pages (e.g. we record certain data on the web browser and operating system the Data Subject uses, including the date and time of visit, accessibility status (e.g. was the web page accessible or did the Data Subject receive an error message), the use of the web browser functions, search words entered by the Data Subject, frequency of opening the web pages, the names of the files found, transferred data volume, the web page by the use of which the web page of Veho Baltics was reached and the web page where the Data Subject moved forward from the web pages of Veho Baltics). In addition, Veho Baltics records within seven days the Data Subject’s IP address and the name of their Internet service provider for security purposes, in particular for the purpose of prevention and identification of attacks or fraud attempts against Veho Baltics’s web pages;
3.1.9. Via GPS equipment intended for the purposes of protecting Veho Baltics’s assets for rental cars with camera recordings of the Customer’s visit to Veho Baltics’s dealership or workshop.
4. Legal bases for Processing of Personal Data
4.1. In brief, Veho Baltics processes Personal Data on the following legal bases:
4.1.1. For the performance of legal obligations arising from legislation (both national and the European Union legislation);
4.1.2. For the performance of an Agreement made with the Customer or for preparation for making an Agreement; Veho Baltics may use Personal Data for the performance of an Agreement without a separate consent of the Customer;
4.1.3. On the basis of the consent of the Data Subject (including the Customer) in accordance with the limits, scope and objectives expressed in the consent – in such a case Veho Baltics will request a corresponding consent;
4.1.4. For the purposes of Veho Baltics’s own legitimate interests or the protection thereof.
5. Categories of Personal Data
5.1. The categories of Personal Data that Veho Baltics mainly collects and processes include but are not limited to are the following:
5.1.1. A person’s identification data (e.g. name, personal identification code, date of birth, data on identity document (e.g. copy of a passport, ID-card and/or driver’s licence));
5.1.2. Contact details (e.g. address, telephone number, e-mail address, language of communication);
5.1.3. Information on the Data Subject’s relations with legal persons (e.g. information transferred by the Data Subject or retrieved from public registers or received through Third Parties for making transactions on behalf of a legal person);
5.1.4. Information on the Data Subject’s authorisations (e.g. Personal Data of users of a rental car or other vehicles);
5.1.5. The data necessary for making a sale agreement of goods or provision of services (e.g. a vehicle registration number, the vehicle identification number (VIN code), other vehicle data, the credit limit set by Veho Baltics for the Customer);
5.1.6. The data concerning the sold goods or ordered services (e.g. performance or failure to perform an Agreement, made and expired Agreements, connections with vehicles, submitted applications, inquiries and complaints);
5.1.7. The data on habits, preferences and Customer satisfaction (e.g. activity of use of services, data on services and products used, including the purchase history of vehicles, Customer satisfaction survey data, Data Subject inquiries, Customer complaints);
5.1.8. The data on participation in games and campaigns (e.g. prizes won in games and campaigns);
5.1.9. Communication data (e.g. audio recordings when the Customer calls to Veho Baltics’s information line at 626 6000 or other data collected via e-mail, messages and other means of communication (including social media), and the Personal Data connected with the Data Subject’s visits to Veho Baltics web pages, or through self service communication;
5.1.10. The data on the Customer’s segment (e.g. vehicle brand and model, customer group);
5.1.11. Images of persons and activities with vehicles recorded with video cameras installed at Veho Baltics representations (including car dealerships, workshops and warehouses);
5.1.12. The data obtained and/or created in the course of performance of legal obligations, e.g. the data resulting from the queries made by investigative bodies, consumer protection, notaries, courts and bailiffs;
5.1.13. The data concerning insurance services (e.g. data on beneficiaries, insured persons, injured persons);
5.1.14. The data concerning a vehicle’s technical failure or accident, including the data on the procedure of an insured event and provision of roadside assistance service (e.g. in the case of roadside assistance, the name and contact details of the driver, event description from the roadside assistance provider; in communication with the person or insured person concerning the traffic damage the name and contact details of the driver, a description of the event);
5.1.15. A vehicle location data (for rented vehicles).
5.2. For transfer of marketing information, Veho Baltics mainly uses the following Personal Data:
5.2.1. The contact details (e.g. address, telephone number, e-mail address) and a person’s identification data (e.g. name, date of birth) of the Data Subject (including Customer);
5.2.2. Information on which segment the Customer belongs (e.g. the customer group);
5.2.3. Information on the purchased goods or services (e.g. the vehicle brand and model, the volume and quantity of various services used).
5.3. In addition to the categories of Personal Data specified in clauses 5.1–5.2, Veho Baltics may collect additional and other Personal Data from the Data Subject if this is necessary for rendering of specific services or if it is required by law that is linked to the provision of the service.
6. The purposes and legal bases for Processing of Personal Data
The Processing of Personal Data by Veho Baltics is mainly carried out for the following purposes:
6.1. To provide products and services, in particular for making and performance of Agreement with the Customer, processing the Customer’s requests, conducting a test drive and deciding upon allowing a test drive, ascertainment of the Customer’s identity, use of regular customer advantages, communication with the Customer, ensuring that the Customer fulfil their payment obligations, solving Customer complaints, explaining under what conditions to provide services and sell products, based on:
The performance of the Agreement or implementation of measures prior to the Agreement taken at the Customer’s request or for the performance of legal obligations;
The signification of the Agreement referred to in this clause also covers the insurance contracts, which are linked to the principal contract (in particular a sales contract and a commercial lease contract) or form a pre-contractual or a collateral condition for concluding a principal contract, including the insurance contracts in which the Data Subject (including the Customer) is a beneficiary. In addition, the Personal Data are processed also in cases of a technical failure of a vehicle or accident, which is necessary for the performance of a principal contract and an insurance contract in connection with the proceedings of the insured event and the provision/arrangement of roadside assistance based on:
The performance of Agreement or the legitimate interest of Veho Baltics.
6.2. To manage customer relations, in particular for keeping the Personal Data up-to-date and true and correcting or supplementing the Personal Data where necessary, by checking and supplementing the Personal Data through external and internal sources, also for keeping records of Agreements, upon giving feedback on the web page or making contact, based on:
The performance of the Agreement or implementation of measures prior to the Agreement taken at the Customer’s request, or for the performance of legal obligations, or upon the consent of the Data Subject.
6.3. To protect and safeguard the interests of the Data Subject (including the Customer) and/or Veho Baltics:
6.3.1. For improving the quality of services offered by Veho Baltics and for certifying business transactions or any other business communication (including via recorded conversations), based on:
The performance of the Agreement or implementation of measures prior to the Agreement taken at the Customer’s request, or for the performance of legal obligations, or upon the consent of the Customer, or in the legitimate interest of Veho Baltics to ensure and/or improve the service quality;
6.3.2. Images of persons and activities with vehicles recorded with video cameras installed at Veho Baltics representations (including car dealerships, workshops and warehouses) with the aim of detecting unauthorised entry into the premises, theft or other criminal offences against property and retaining the necessary proof for proper proceedings of incidents (including Customer complaints), for excluding Veho Baltics’s liability in performing repair works, and also for the purpose of improving customer service, based on:
The legitimate interest of Veho Baltics.
6.3.3. Monitoring the location of a vehicle leased to the Customer by Veho Baltics with GPS equipment in order to protect the assets of Veho Baltics in cases of theft, based on:
The legitimate interest of Veho Baltics.
6.3.4. To ensure reliable Customer relations and avoid fraud and damage, based on:
The legitimate interest of Veho Baltics.
6.3.5. To develop and/or improve the products, services or IT systems and ensure data protection, based on:
The legitimate interest of Veho Baltics or legal obligations.
6.3.6. To forward to the Data Subject (including the Customer) notifications, including notifications of a vehicle recall campaign, and storage of the corresponding notifications and contact details for the purpose of potential new notifications forwarding (e.g. when the Personal Data has been obtained from the Estonian Road Administration), based on:
The performance of the Agreement or a legal obligation, or in the legitimate interest of Veho Baltics for ensuring the service quality.
6.4. To provide additional services, organise events, conduct customer satisfaction surveys, market analyses and gather statistics:
6.4.1. To offer the Customer additional services of Veho Baltics and its cooperation partners, including personal offers and amenity services (e.g. forwarding Personal Data to lease providers and insurance providers), based on:
The Customer’s consent or the legitimate interest of Veho Baltics to offer additional services and comprehensive solutions.
6.4.2. To organise events for the Customer or make possible for the Customer to participate in the events, including:
6.4.2.1. Recording the organised events by taking general photographs and/or filming and also personal recordings of Customers.
6.4.2.2. The taken photos and the film recordings of the events organised by Veho Baltics or in which Veho Baltics has participated are the property of Veho Baltics, and Veho Baltics may process and publish them as it deems appropriate in the company intranet, on the web page, in social media channels or public media.
6.4.2.3. When participating at the public events and the events by invitation only, organised by Veho Baltics it should be borne in mind that the Customer’s personal data (e.g. their image, voice) may be recorded on the above-mentioned recordings. The Customer has the possibility to inform the recorder of their wish not to remain on a recording;
based on:
The Customer’s consent or the legitimate interest of Veho Baltics to offer both the interested individuals as well as the existing Customers information of its products, and offer the customers interesting events.
6.4.3. To conduct Customer satisfaction surveys (including contacting the Customer), market analyses and gather statistics, based on:
The legitimate interest of Veho Baltics to improve Veho Baltics’s services, improvement of the Customer’s user experience of its services and the development of new products or services or upon the Customer’s consent
6.4.4. to manage and analyse the Customer base in order to make the best and personalised offers of products and services to the Customer, based on:
The Customer’s consent or the legitimate interest of Veho Baltics to offer both the interested individuals as well as the existing Customers information of its products and services.
6.4.5. To organise games and campaigns for the Customers (including personalised and addressed campaigns), based on:
The legitimate interest of Veho Baltics to improve the user experience of services of the Customer or upon the Customer’s consent.
6.5. To avoid the misuse of its services and ensure the proper provision of services:
6.5.1. To grant and control access to its digital channels (e.g. electronic booking of service) and their functioning, to avoid unauthorised access to the digital channels and their misuse and ensure the information security, based on:
The performance of the Agreement or application of measures prior to the Agreement taken at the Customer’s request, or for the performance of legal obligations, or upon the Customer’s consent, or the legitimate interest of Veho Baltics to ensure control over the authorisations, access and functioning of Veho Baltics’s digital services.
6.5.2. To make the technical systems and the structure of information technology more effective and develop Veho Baltics’s services via testing and improvement, based on:
The legitimate interest of Veho Baltics.
6.6. For organisational purposes, particularly for transferring data within the Veho Baltics Group for the purposes of a joint Customer base management, financial management and internal administration, based on:
The legitimate interest of Veho Baltics to improve and manage the provision of its services across the Veho Baltics Group.
6.7. To certify, fulfil and protect legal requirements, in particular to record the messages and orders sent via means of communication (e-mail and the information line telephone number (see the details in clause 8 of the Privacy Policy Terms and Conditions)), and also information and other operations Veho Baltics has performed, based on: The performance of the Agreement or implementation of measures prior to the Agreement taken at the Customer’s request, or for the performance of legal obligations, or upon the legitimate interest of Veho Baltics for fulfilling legal requirements.
6.8. To cooperate with public sector institutions and transfer the required information or perform Veho Baltics’s obligations pursuant to law, based on:
the performance of legal obligations.
7. The use of data for marketing purposes, profiling and automated decision-making
7.1. Veho Baltics uses Personal Data for marketing purposes, in particular for sending offers of provision of goods and services by Veho Baltics, the customer event invitations and other marketing information or direct marketing by using means of communications (including e-mail and telephone) if the Data Subject has agreed to it. If the Customer has not given a separate consent for direct marketing, Veho Baltics may process the Customer’s Personal Data for the purposes of offering Veho Baltics’s services and products for similar products or services that the Customer has purchased or consumed, according to the legitimate interest of Veho Baltics, or for the purposes of direct marketing via regular mail according to the legitimate interest of Veho Baltics.
7.2. Veho Baltics transfers marketing information according to the vehicle brand and model and about Veho Baltics Group in general, using profiling. Profiling is processing by automated means of Personal Data that is used for ascertainment of the Data Subject’s personal preferences and interests, i.e. for selection of direct marketing addressees. Profiling is used in order that Veho Baltics could transfer only relevant information to the Data Subject in an efficient manner (e.g. information on the vehicle brand associated with the Customer).
7.3. For making a regular customer agreement, Veho Baltics uses automated decisions for determining the Customer’s credit limit (current account), which is based on the purpose and basis for the regular customer agreement. The corresponding decision will be made on the basis of the data of the Customer’s purchase volume. For more detailed logic, the Customer can ask for information directly from the customer service representative of Veho Baltics in case of interest to whom it is possible to present at once the opinions and objections of one’s own. Likewise, in the case of automated decisions the Customer has the right to demand that the made decision be reviewed by a separate employee in a nonautomated manner.
7.4. Veho Baltics wishes to customise the content of its web pages to the Customer’s interests as accurately as possible and thus improve its web pages for the Customer. In order to find out the user preferences and the most popular areas of the web pages, Google Analytics, Adobe Analytics and other current analysis tools are used.
8. Recordings of the information line number 626 6000
8.1. Veho Baltics records and stores only the phone calls to the number 626 6000 between the Data Subject and Veho Baltics. The phone calls to any other Veho Baltics telephone numbers are not recorded. Veho Baltics informs the caller every time of the phone call recording before the start of a phone call to this number.
8.2. The phone calls are recorded for the purpose of improving the quality of customer service and its assessment. Also, if necessary, the recordings will be used as evidence of what was agreed on the phone and if necessary, the recording will be sent to the Veho Baltics Group company providing the specific service in order to ensure that what was agreed will be exactly observed, based on the conclusion and performance of an Agreement or the legitimate interest of Veho Baltics.
8.3. The phone calls are recorded only on the basis of voluntary consent of the Data Subject. If you do not wish to have your phone call recorded, break in no later than after the message of recording and contact Veho Baltics either via the contact details provided in clause 14 of the Privacy Policy Terms and Conditions, or a Veho Baltics employee. The contact details of the employees of Veho Baltics companies you will find on the respective company’s web page.
8.4. As a rule, the phone call recordings are retained for one year, and up to three years maximum, unless there is a special justification for retaining a phone call recording for a longer period.
8.5. The phone call recordings are processed by Veho Baltics and access to the recordings is granted only to the individuals who need them for performing their duties.
8.6. These Privacy Policy Terms and Conditions apply regarding the consent given by the Data Subject. Veho Baltics refers to the Privacy Policy Terms and Conditions in the recording notification and the Data Subject has the possible to read the Privacy Policy Terms and Conditions.
9. Transfer of Personal Data
9.1. Veho Baltics transfers Personal Data to the following recipients:
9.1.1. Other Veho Baltics Group companies (for explanation, see clause 14 of the Privacy Policy Terms and Conditions );
9.1.2. Veho Baltics’s authorised employees;
9.1.3. Administrative agencies (e.g. law enforcement authorities, bailiffs, notary’s offices, tax authorities, supervisory authorities and financial intelligence units);
9.1.4. Third Parties associated with sales of goods, provision of services and the performance of an Agreement made with the Customer – e.g. payment intermediaries, Smart insurance broker and various insurance and lease providers, communications, IT and postal service providers, advertising and marketing partners, etc.;
9.1.5. Auditors, legal and financial consultants or any other Veho Baltics’s consultants;
9.1.6. In the case of assignment of the right of claim, the new creditor;
9.1.7. Administrators of credit register to whom information is transferred for the purpose of allowing Third Parties to assess the Customer’s payment behaviour and creditworthiness;
9.1.8. If the Customer has violated the Agreement, then debt collection service providers, courts and trustees in bankruptcy or insolvency administrators;
9.1.9. The participants and/or parties associated with payment systems and payment solutions;
9.1.10. Other individuals associated with the provision of services to Veho Baltics, e.g. providers of archiving and postal services, providers of Customer services, salespeople and other authorised persons;
9.1.11. Providers of security services (if cameras are used);
9.1.12. GPS service providers for rented vehicles with installed GPS equipment – the companies that offer the service with the respective equipment;
9.1.13. Regarding the rented vehicles with GPS equipment – access to the data collected with the equipment is also granted to the lessee in certain cases for the purpose of monitoring the vehicle location, including the location of the vehicle users;
9.1.14. The providers of roadside assistance, e.g. Roheline Laine OÜ and/or car manufacturers for the makes that Veho Baltics is a reseller;
9.1.15. The state authorities (including the Estonian Road Administration);
9.1.16. Third parties, e.g. Veho Baltics’s web pages may contain offers of third parties. When such an offer is clicked on, we transfer the necessary amount of information to the relevant provider (e.g. information that the Data Subject found this offer from Veho Baltics’s web page and, where necessary, any other information that the Data Subject has already submitted on our web pages for this purpose);
9.1.17. Social networks (such as Facebook, Instagram, Twitter, Google+, etc.). The operation of the plugins of the above mentioned social networks at Veho Baltics’s web pages is as follows:
9.1.17.1. The social plugins are deactivated when Veho Baltics web pages are visited, i.e. there is no data transfer to these network operators. Should the Data Subject wish to use any of these networks, they need to click on the corresponding social plugin to create a direct connection to the respective network server.
9.1.17.2. If the Data Subject has a user account in the network and has been logged in during activating the social plugin, the network is allowed to link this visit on Veho Baltics’s web pages to the Data Subject’s user account. To avoid such a situation, the Data Subject needs to log out of the user account before activating the social plugin.
9.1.17.3. If the Data Subject activates a social plugin, the network will transfer the content made available through the plugin directly to the Data Subject’s web browser, which links the Data Subject to Veho Baltics’s web pages. In such a situation, data transfers may occur, initiated and managed by the corresponding social network. For linking the Data Subject to the social network, the data transfer between the network and the system, and the Data Subject’s communication on this platform, the data protection provisions of the respective network apply exclusively.
9.1.17.4. The social plugin will remain active until the Data Subject deactivates it or deletes the cookies.
10. The geographical area of processing
10.1. As a rule, the Processing of Personal Data takes place within the European Union/European Economic Area (EU/EEA), and should the need arise, the transfer will only take place provided that appropriate safeguards are implemented. Appropriate safeguards include, for example:
10.1.1. A country outside of the EU/EEA where the recipient is located has an adequate level of data protection according to the corresponding European Commission decision;
10.1.2. A valid agreement exists, including standard conditions of contract or approved codes of conduct, certifications, etc. that are developed by the EU and comply with the Data Protection Regulation;
10.1.3. The recipient is certified under the data protection framework Privacy Shield (which applies to recipients located in the United States of America).
10.2. In the absence of appropriate safeguards, Veho Baltics has the right to transfer Personal Data outside of the EU/EEA in situations where:
10.2.1. The Data Subject has given an explicit consent for it and has been informed of the absence of safeguards;
10.2.2. It is necessary for the performance of an Agreement between the Customer and Veho Baltics or for applying measures prior to the Agreement taken at the Data Subject’s request;
10.2.3. It is necessary for making or performance of an Agreement in the interest of the Data Subject between Veho Baltics and another natural or legal person;
10.2.4. It is necessary for preparation, submission or defence of legal claims;
10.2.5. It is necessary in order to protect the vital interests of the Data Subject or other persons if the Data Subject is physically or legally incapable of giving consent;
10.2.6. The transfer is made from a register, which according to the European Union or a Member State law is intended for notification of the public and which is open for consultation either by the public in general or by any person who can prove a legitimate interest, but only to the extent that the conditions laid down by the European Union or a Member State law for consultation are fulfilled in the particular case;
10.2.7. The transfer is not repetitive, concerns only a limited number of Data Subjects, is necessary for the purposes of protecting the legitimate interest of Veho Baltics, which are not overridden by the interests or rights and freedoms of the Data Subject, and Veho Baltics has assessed all the circumstances concerning the data transfer and has on the basis of that assessment established suitable safeguards with regard to the protection of personal data. Veho Baltics shall inform the supervisory authority of the transfer.
10.3. For more detailed information on the transfer of Personal Data outside of the EU/EEA, the Data Subject may contact Veho Baltics.
11. The periods of storage of Personal Data
11.1. Veho Baltics does not process Personal Data longer than it is necessary for achieving the objectives concerning the respective data, including the fulfilment of obligation of data storage provided for in legislation. The period of storage may be based on the Agreements with the Customer (e.g. for the purpose of resolving a dispute arising from an Agreement made with the Customer), the legitimate interest of Veho Baltics, or applicable law (e.g. the laws related to accounting, limitation period or other private law).
11.2. We process the consent for receiving marketing offers linked to Veho Baltics’s products and services until withdrawal of the consent. You have the right to withdraw your consent at any time by submitting a corresponding request at the e-mail address klienditeenindus@veho.ee or at a Veho AS dealership on the spot. Withdrawal of consent does not affect the legitimacy of the Personal Data processing that occurred before the consent was withdrawn. We will retain your consents for three years after their withdrawal pursuant to law (limitation period of a claim arising from a transaction).
11.3. We will retain camera recordings up to 6 (six) months from the recording date unless incidents occur from whence a need will arise to retain the recording for a longer period.
12. The rights of Data Subject
12.1. The Data Subject has the following rights with regard to Processing of Personal Data:
12.1.1. To obtain information on the Processing of their Personal Data and to request a copy of the Processed Personal Data (e.g. in terms of the objectives of Processing, the categories of Personal Data Processed, recipients or categories of recipients of Personal Data, the time period of storage of Personal Data; and when the Personal Data are not collected from the Data Subject, any available piece of information as to their source of origin);
12.1.2. To request to have their the Personal Data rectified if the data changed or is otherwise inaccurate;
12.1.3. To make objections to the Processing of their Personal Data if the Processing of Personal Data is based on legitimate interest, including profiling for direct marketing purposes (e.g. reception of marketing offers or participation in polls); or to an automated decision for determining the credit limit. For example, the Customer may prohibit the use of their contact details for sending offers – for that purpose, the Customer may remove themselves from the recipient list upon reception of a marketing e-mail;
12.1.4. To request the deletion of their Personal Data, e.g. when Veho Baltics has no right to process such data or if the Processing of Personal Data is based upon their consent and they have withdrawn their consent. Such a right is not applicable when (or to that extent) the Processing of Personal Data, which are requested to be deleted is carried out also on other legal grounds, e.g. on he basis of Agreement or for performance of legal obligations;
12.1.5. To request a restriction of the Processing of their Personal Data, e.g. when Veho Baltics assesses whether the Customer has the right to have their Personal Data deleted;
12.1.6. To receive their Personal Data, which they have submitted to Veho Baltics and the Processing of which is based on their consent, or is carried out for the purpose of performance of Agreement, electronically in a commonly used and machine-readable format and, where technically possible to transfer these data to another service provider (the right to data portability);
12.1.7. To withdraw their consent to the Processing of Personal Data. In the case of withdrawal of the consent, Veho Baltics will no longer Process the Data Subject’s Personal Data for the purposes it has been done on the basis of the relevant consent. For instance, the Data Subject has the right to withdraw their consent to have their Personal Data Processed for marketing purposes at any time, by clicking the link “I do not wish to receive the newsletter any longer” at the bottom of the newsletter received, or by notifying Veho Baltics either by e-mail or by contacting a Veho Baltics dealership. The consent is valid until its withdrawal.
12.1.8. To lodge a complaint at any time to Veho Baltics, the Estonian Data Protection Inspectorate (web page: www.aki.ee) or a competent court if they find that the Processing of their Personal Data is in violation of their rights or interests.
12.2. The Data Subject can apply their rights by contacting Veho Baltics using the contact details specified in clause 14 of the Privacy Policy Terms and Conditions. Veho Baltics will reply to the submitted request without delay but no later than within one month from the receipt of the request. Should there be a need to clarify additional circumstances prior to replying to the request, Veho Baltics may extend the deadline for replying by giving a prior notice to the Data Subject.
13. Cookies
13.1. Information on the cookies used by Veho Baltics and their functions you will find in the notes regarding the cookies.
14. Responsible persons and the contact details of Veho Baltics
14.1. Veho Baltics Group companies are jointly responsible processors in terms of Processing of Personal Data (except in the cases where Veho Baltics OÜ is an independent responsible processor – for more detailed information, see “Specific provisions of the Privacy Policy Terms and Conditions of Veho Baltics OÜ”), because Veho BalticsGroup has a joint Customer base and this is in the legitimate interest of Veho Baltics Group for cross-selling, Customer management and Customer service between the Group companies operating in related fields, and therefore also serves as provision of added value by offering the Customer comfort and joint creation of more favourable conditions.
14.2. The contact details of the companies responsible for Processing of Personal Data are the following.
14.2.1. Veho Baltics OÜ, registry code 14809248, address Järvevana tee 11, 11314 Tallinn;
14.2.2. Veho AS: accessible on the web page www.veho.ee;
14.2.3. Silwi Autoehituse AS: accessible on the web page www.silwi.com;
14.2.5. UAB Silberauto (Lithuanian company, registry code 111748996): accessible on the web page http://silberauto.lt/lt/kontaktai
14.3. The Data Subjects may contact Veho Baltics with regard to inquiries and withdrawal of consent, in addition to request exercise of their rights in Processing of Personal Data and lodge complaints about the use of Personal Data.
14.4. It is possible to contact the companies of Veho Baltics Group for information and questions concerning the use of Personal Data at the e-mail address gdpr@veho.ee.
15. Validity and amendments to the Privacy Policy Terms and Conditions
15.1. Veho Baltics has the right to amend the Privacy Policy Terms and Conditions at any time unilaterally in accordance with applicable law.
15.2. Veho Baltics will inform the Data Subject on the amendment to the Privacy Policy Terms and Conditions through the web page, in Veho Baltics dealerships or by e-mail no later than one month before the amendments take effect, unless the Privacy Policy Terms and Conditions are amended as a result of amendments in legislation.
Specific provisions of the Privacy Policy Terms and Conditions of Veho Baltics OÜ:
In addition to Veho Baltics’s Privacy Policy Terms and Conditions , specific provisions of the Privacy Policy Terms and Conditions of Veho Baltics OÜ are applied in the following cases, and the processor of the corresponding Personal Data is independently Veho Baltics OÜ. The Privacy Policy Terms and Conditions of Veho Baltics are applied to the extent that is not separately and otherwise regulated in the specific provisions of the Privacy Policy Terms and Conditions of Veho Baltics OÜ.
1. Spare parts e-store
1.1. The spare parts e-store is a service provided by Veho Baltics OÜ through which the Customer can acquire the necessary spare parts in an electronic environment.
1.2. Veho Baltics OÜ processes the following categories of Personal Data in particular:
1.2.1. A person’s identification data (e.g. name);
1.2.2. Contact details (e.g. address, telephone number, e-mail address);
1.2.3. Data concerning the sold goods (e.g. performance or failure to perform Agreements, made and expired Agreements, submitted applications, queries and lodged complaints);
1.2.4. Mode of transport (e.g. use of a courier service).
1.3. Veho Baltics OÜ Processes the Customer’s Personal Data primarily to the extent necessary for making and performance of Agreement, including the delivery of goods and creation of a user account, based on:
The performance of Agreement or implementation of measures prior to the Agreement taken at the Customer’s request.
1.4. In addition, Veho Baltics OÜ may process the Customer’s Personal Data for the purpose of responding to Customer inquiries, management of Customer relations, gathering statistics, e-store service management and development, and for marketing purposes (for more detailed information, see clause 7 of Privacy Policy Terms and Conditions of Veho Baltics), based on:
The performance of the Agreement or application of measures prior to the Agreement, taken at the Customer’s request, or for the performance of legal obligations, or upon the legitimate interest of Veho Baltics OÜ, or upon the Customer’s consent.
1.5. For delivery of goods to the Customer, Veho Baltics OÜ transfers the Customer’s Personal Data, based on the Customer’s preferred means of delivery, to the following recipients: Provider of the courier service or Veho AS.
