2. Controller and contact person in data protection matters
responsible processor of your personal data is Solid House OÜ .
Registration code: 12966883.
Address: Pärnu mnt 160a, Tallinn 11317, Republic of Estonia.
The contact person for data protection issues is Tiina Sten.
E-mail address: firstname.lastname@example.org.
3. Purposes and legal bases of personal data processing
3.1. General information
Solid House uses a customer data register for the secure processing and storage of customer data related to its services. When processing personal data contained in the customer data register, Solid House complies with all legal requirements and best practices.
3.2. Purposes of personal data processing
Solid House processes personal data only to the minimum extent necessary to achieve the purposes presented in this chapter. Any processing of personal data has a specific and limited purpose and legal basis, which is described in more detail below.
3.2.1. Pre-contractual negotiations, conclusion and execution of contracts
Solid House processes personal data in the course of pre-contractual negotiations and the conclusion of various contracts, as well as for the exercise of rights and obligations arising from the respective contracts. The legal basis for relevant data processing is Article 6(1)(b) of the IKÜM.
The relevant contracts may be:
- customer agreements (e.g. brokerage service agreements between Solid House and the seller or lessor of a particular property);
- Mediation of the contract between Solid House's customer and the customer's counterparty (e.g. buyer or tenant) and preparation and negotiation by Solid House on behalf of the customer;
- agreements between Solid House and providers and users of expert real estate services (e.g. real estate valuation service and real estate management service).
3.2.2. Fulfillment of legal obligations
to the Law on the Prevention of Money Laundering and the Financing of Terrorism (hereinafter referred to as " Money PTS "), persons mediating the purchase or sale of immovable property and the use of immovable property in their economic activities are obliged to implement various due diligence measures both when establishing a business relationship and during its duration. During the implementation of appropriate due diligence measures, Solid House may process your personal data to the extent stipulated in RahaPTS. Personal data collected solely for the purpose of preventing and detecting money laundering and terrorist financing will not be processed for any other purpose without a separate legal basis.
Solid House, as the accounting entity, is also required to preserve the original accounting documents, including documents that may contain personal data, for seven years from the end of the financial year when the economic transaction was recorded in the accounting register based on the original document.
We would like to point out that if you refuse to provide the personal data required to fulfill Solid House's legal obligations, Solid House will not be able to start or continue a customer relationship with you.
In those and other situations where Solid House processes personal data to fulfill an obligation arising from legislation, the legal basis for processing personal data is the need to fulfill the legal obligation of the responsible processor, i.e. Article 6(1)(c) of the GDPR.
3.2.3. Marketing activities, customer relationship management and promotion
If you have given us your consent, we will occasionally send you newsletters and other information related to Solid House services and potentially of interest to you. The legal basis for sending newsletters as a personal data processing operation is the consent of the data subject (Article 6(1)(a) of the GDPR).
Please note that withdrawal of consent does not affect the legality of data processing based on prior, valid consent.
Solid House also uses the personal data contained in the customer data register for the purpose of managing and developing customer relations and services, for the purpose of compiling statistics and, if necessary, for the realization of legal obligations and claim rights. The legal basis for relevant data processing is a legitimate interest based on the need to develop Solid House's business operations and service quality (Article 6(1)(f) of the GDPR).
At the same time, based on consent, Solid House may collect personal data from those who wish to participate in the presentation event of a specific real estate object or those who are present at the presentation event in order to find out the purchase or service interest of the persons, to create a later customer relationship/provide services or for other marketing purposes. On the basis of legitimate interest, Solid House may process the personal data of persons participating in real estate presentation events also for the purpose of crime prevention, monitoring and investigation.
Solid House uses web cookies on the website https://www.solidhouse.ee and its intermediate and subpages (hereinafter " Website ") , the purpose of which is to provide you with a better, faster and safer user experience. Information related to the use of web cookies is reflected in more detail on our web cookies information page, which is available here.
4. Personal data to be processed
- customer's first and last name, address and preferred language of communication;
- personal identification number of a natural person representing himself or a legal entity;
- information related to billing and collection;
- information related to the content of the contractual relationship, such as the services provided to the client, the period of their use, data on the quotation and its acceptance, the date of conclusion of the contract, information regarding the real estate object, details related to the brokerage fee, information regarding the service provider;
- information about permitted and prohibited ways of processing personal data, such as the permissibility of direct marketing;
- real estate objects of interest to the client and other relevant information provided by the client himself;
- information about service events;
- information about customer-related complaints and their processing;
- information concerning the lessee's creditworthiness and other information concerning the assessment of solvency;
- the purpose of contacting the customer (customer contact);
- information about the content of the customer contact and information about further planned activities.
- first and last name, date of birth and social security number;
- name, date of birth and personal identification number of the representative;
- the authority of the person at the legal entity;
- first and last names, dates of birth and citizenship of the members of the management board of a legal entity or a similar governing body;
- first and last name, date of birth and social security number of the actual beneficiary;
- the name of the document used for personal identification, the document number or other identifying information, information about the issuer of the document, a copy of the document, and in the event that remote authentication has been used for personal identification, information about the procedure used for remote authentication and related details;
- information about the person's field(s), quality and scope of business, economic situation, reason, background and nature of transaction or use of service;
- information about the origin of funds;
- information necessary to carry out the person's national background and sanction check.
5. Storage of personal data
Personal data related to the conclusion of contracts and the exercise of contractual rights and the fulfillment of obligations are generally stored for the duration of the respective contract and after the termination of the contract until the expiration date of the claim rights arising from legislation (maximum 10 years). Personal data processed during pre-contractual negotiations or consultation, which have not yet led to the conclusion of a contract (e.g. data processed during consultation and price negotiations), will be stored for 3 years from the end of the respective negotiations.
Personal data related to the fulfillment of obligations arising from RahaPTS will be stored for five years from the end of the business relationship, unless a different retention period is prescribed by legislation or if the further storage of the information in question is necessary for the sake of ongoing criminal or other criminal proceedings, for the sake of court proceedings or for Solid House for the realization of claim and defense rights. The original accounting documents are stored in accordance with the seven-year storage obligation stipulated in the Accounting Act.
Other personal data are deleted immediately after the need for processing or the legal basis, including consent, ceases to exist.
6. Origin of personal data
Solid House mostly receives personal data directly from the data subject in connection with the conclusion of the contract or prior negotiations, but also during real estate presentation events, through the contact forms on the Solid House website, and by participating in customer satisfaction surveys and raffles. In certain cases, Solid House also receives personal data from national and other registers (for example, during the implementation of due diligence measures resulting from RahaPTS).
7. Recipients of personal data
Solid House may transmit and publish the Customer's personal data only if there is a corresponding legal basis. For example, Solid House may disclose the Customer's personal data to the authorities of the state and local government units upon receipt of a corresponding legitimate request. For the purpose of fulfilling the contract, Solid House may disclose personal data related to the transaction to the banks of the transaction parties and to providers of expert services related to the real estate object, e.g. to the real estate manager and appraiser.
Solid House may also disclose personal data to persons whose professional consulting services Solid House uses in its economic activities (e.g. law and consulting firms). Also, Solid House may be obliged to disclose personal data in a situation where it is related to criminal, court or other legal proceedings.
Solid House does not transfer personal data outside the European Union or the European Economic Area.
Solid House may also use authorized processors of personal data to perform specific tasks in its activities. Authorized processors can be, for example, other companies belonging to the Solid House group, owners of real estate mediation, sales and marketing systems, as well as entities that maintain real estate sales announcement portals.
8. Security measures
Solid House has implemented extensive IT, organizational and physical security measures to ensure the security of the customer data register and the personal data contained therein. Access to the customer data register is strictly need-based and user-based, and the corresponding access rights are issued only by the main user of the register to fulfill work obligations related to a specific position. Solid House's IT infrastructure is protected by firewalls, passwords and other high-level security measures. Solid House's information assets are located in locked and guarded rooms, which can only be accessed by persons with the appropriate permission to perform specific work duties.
In a situation where Solid House has involved an authorized processor in the processing of personal data, Solid House and the relevant authorized processor have entered into a data processing agreement in accordance with Article 28, paragraph 3 of IKÜM, which ensures a high level of personal data protection, compliance with all legal requirements and best practices.
9. Data protection rights and their exercise
In connection with the processing of your personal data by Solid House , you have the following data protection rights as a result of IKÜM:
- The right to request access to personal data
You have the right to request information about whether and which personal data and on what legal basis and manner Solid House processes about you. You also have the right to request a copy of the personal data processed about you.
- The right to request correction and deletion of personal data
You have the right to demand that Solid House correct errors contained in the personal data processed about you (for example, if the personal data has changed). Also, in certain cases, you have the right to request that Solid House delete the personal data processed about you. We point out that Solid House may have the right to refuse the deletion of specific personal data, for example, if the continuation of processing is necessary to ensure possible claim rights or to fulfill legal obligations.
- The right to restrict the processing of personal data
You have the right to demand that Solid House restricts the processing of your personal data. In such a situation, Solid House retains the right to process your personal data only to a limited extent, for example to ensure possible claim rights or to fulfill legal obligations.
- The right to object
If the legal basis for the processing of your personal data is Solid House's legitimate interest, you have the right to object to the corresponding processing of personal data. You also have the right to object to any automated decision-making by Solid House and the processing of personal data related to direct marketing (e.g. sending newsletters).
- The right to the transfer of personal data
You have the right to demand that Solid House provide you with personal data in a structured, commonly used format and in a machine-readable form. If it is technically feasible, you also have the right to request that Solid House transfer personal data to another data controller indicated by you.
- The right to withdraw consent at any time
If the legal basis for the processing of your personal data is consent, you have the right to withdraw the corresponding consent at any time. Please note that withdrawal of consent does not affect the legality of data processing based on prior, valid consent.
10. Profile analysis and automated decisions
Solid House does not process your personal data for the purpose of profile analysis or for making automated decisions.
11. Questions, complaints and disagreements
If you do not agree with the answer you received, you have the right to file a complaint with the Data Protection Inspectorate (address: Tatari 39, Tallinn 10134; e-mail: email@example.com ; phone: +372 627 4135).
Information about data protection authorities of other European Union countries is available here: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm .