The GDPR and the PDPA cover all personal data, including special types of personal data. These include: name, personal identification code, location information, network identifiers (attributes which lead to a particular person in a communication network), as well as physical, physiological, genetic, mental, economic, cultural and any other characteristics and the combinations thereof which allow identification, data related to payment services in banks, credit card data, digital trust service data for digital signing, non-public data about the proprietary status of a person, communication data covered by message confidentiality, real-time location determination data, credit rating and other profiling with legal consequences or significant impact. Special types of personal data include racial or ethnic origin, political views, religious or philosophical beliefs or trade union membership, genetic data, biometric data used for the unique identification of natural persons (primarily fingerprint, palm and eye iris images), health data or data concerning the sex life or sexual orientation of a natural person.\nIn conclusion, the GDPR and the PDPA cover all the information that makes it possible to identify a person, including indirectly.<\/div>\n<\/div>\n
\n\n
Which data is not covered by the GDPR regulations?<\/strong>\n\n\nThe GDPR does not cover non-personalised statistics which does not allow the association of gathered information with a particular person. For instance, being part of a segment of males in their 50s who are interested in sports.<\/div>\n<\/div>\n
\n\n
Is there any data which must definitely not be gathered?<\/strong>\n\n\nGathering special types of personal data (health, family members, sexual orientation, finances and other such) and creating segments which allow the identification of persons must definitely be avoided.<\/div>\n<\/div>\n
\n\n
Which information can be requested from participants upon organising various games?<\/strong>\nThe main principle to observe is that you can ask as much as you minimally need. For instance, in the case of a game that involves sending a physical prize, the delivery address is needed, while in the case of a prize sent by email a postal address is not needed. At times, the winner needs to be contact by phone and in such cases that is also important information.\nThe most important thing to remember here is that data may be stored until the end of the need to process them; that is, the gathered data has to be destroyed after the game has ended and the prize has been drawn.\nOnly the contact details of those who have granted their consent to the further processing of their data (e.g. for receiving offers or newsletters) may be kept.<\/div>\n<\/div>\n
\n\n
Which information may be disclosed about the winners of the prize in a game and when?<\/strong>\nThe disclosed information must definitely be specified in the campaign terms and conditions which should also specify the disclosure period. If the aim of disclosure is to inform the participants of the winner, personal data has to be removed after the prize has been handed over, but if the campaign terms and conditions stipulate otherwise, the information may be kept. This particularly applies in campaigns where participants have to send images or videos which are later published on a webpage.\nThe principle that a data subject has the right to be forgotten must also be observed.<\/div>\n<\/div>\n
\n\n
Which personal data does Postimees Grupp transmit to the party ordering a game? <\/strong>\nPostimees Grupp applies the principle that if the party ordering a game draws a prize, the information necessary for drawing and delivering the prize shall be transmitted, as well as the data of the participants who have agreed to receive offers.\nIf the prize is drawn and delivered by Postimees Grupp, the data of the participants who have agreed to receive offers is transmitted to the party ordering the game and the rest of the data is destroyed after the prize has been drawn and the term of submitting complaints has expired.\nThese principles have been established to ensure that the processing of data in environments owned by Postimees Grupp is in accordance with the consent granted by data subjects.<\/div>\n<\/div>\n
\n\n
What must be kept in mind when a third party is involved in gathering or processing data?<\/strong>\n\n\nData subjects must be informed of all parties who process their data and for what purpose.<\/div>\n<\/div>\n
\n\n
How long may the gathered personal data be stored?<\/strong>\nData subjects must be informed of all parties who process their data and for what purpose.\nHow long may the gathered personal data be stored?\nData may be stored until the end of the need to process them; that is, the gathered data has to be destroyed after the game has ended and the prize has been drawn.\nOnly the contact details of those who have granted their consent to the further processing of their data (e.g. for receiving offers or newsletters) may be kept. If the objective of gathering data is to subsequently continue forwarding offers, the data may be kept until the user withdraws his or her consent. <\/div>\n<\/div>\n
\n\n
In what format and on what data media may personal data be stored?<\/strong>\nPersonal data must be stored in a manner which ensures the security of the data and excludes the accessibility of the data to third persons. Data may be stored in a cloud, but it must be ascertained that the cloud is sufficiently secure.\nDetailed rules are stipulated in a data processing agreement between the customer and Postimees Grupp.<\/div>\n<\/div>\n
\n\n
What must be done when the gathered personal data has leaked?<\/strong>\n