PERSONAL DATA PROCESSING POLICY
We want you to know what information we collect about you and how we process it.
Our goal is to ensure integrated and transparent data protection in order to be a reliable partner that provides your service and respects your rights.
Greenergy Data Centers (hereinafter GDC) processes the personal data in accordance with
Regulation (EU) 2016/679 (GDPR) of the European Parliament and of the Council and the PersonalData Protection Act.
LEGAL GROUNDS FOR PERSONAL DATA PROCESSING
1) Legitimate interest
Legitimate interest means that GDC wants to use personal data first and foremost to improve our services and service provision, for the development of services and for the promotion of client communication and business activities, all of which is not strictly necessary for the performance of a contract. This way GDC can provide our client with services just like clients expect us to do. Additionally, GDC will be able to compile statistics necessary for making the right business decisions. This overview concerning the processing of personal data on the basis of legitimate interest is not exhaustive. In the event of reasonable necessity and to a reasonable extent, GDC may process data on the basis of legitimate interest for other purposes as well, provided it is in compliance with legislation.
2) Performance of a contract
The processing of personal data in order to perform a contract primarily manifests in allowing a certain result for our services and this cannot be achieved by avoiding the processing of personal data. GDC has identified what type of personal information it needs to use for the provision of a service in order to ensure the quality level set out in the relevant contract, is therefore able to keep the processing of personal data to a minimum.
3) Compliance with an obligation arising from legislation
Compliance with the obligations arising from the law stipulates data processing that GDC is required to conduct, as GDC as a service provider is required to do so by law.
LEGALITY OF THE PROCESSING OF PERSONAL DATA
When processing personal data, the GDC ensures that:
the processing is lawful, fair and transparent to the data subject;
personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes;
the personal data is relevant, important and limited to what is necessary for the purpose for which it is processed;
personal data is accurate and, where necessary, kept up to date and all reasonable steps are taken to ensure that personal data which is inaccurate in relation to the purpose of the processing is erased or rectified without delay;
personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purpose for which the personal data is processed;
personal data is processed in a way that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.
PERSONS WHOSE PERSONAL DATA IS PROCESSED
The GDC processes the personal data of the following persons:
GDC former and current employees;
GDC recruitment candidates to recruit and contact candidates;
GDC contractors and their representatives to fulfill and manage the legal obligations agreed in the contracts;
GDC website visitors to provide website service and compile web usage statistics;
persons who contact GDC`s client support;
persons who send queries to the GDC;
data center visitors and customers;
persons who are in the field of sight of GDC security cameras to ensure the safety of guests, staff and the GDC.
Processing of personal data when recruiting staff
GDC processes personal data that a candidate for a job or internship at GDC has disclosed about himself/herself in the recruitment process. The purpose of the processing is to assess whether the candidate is suitable to fill the post.
To this end, the GDC processes the following personal data: basic data (name, surname, date of birth), contact details (telephone number, e-mail address, address of residence), data on education and work experience, data on other relevant skills (additional training, language or IT skills) and other relevant information that the candidate has considered important to provide when applying.
When processing the data of job and internship candidates, the GDC relies on the information published and submitted by the candidate himself / herself and on information obtained from public sources. The candidate has the right to inspect the information gathered by the GDC and to share explanations and objections.
The documents submitted by the candidate can only be consulted by those involved in the recruitment and selection process. These documents and data will not be disclosed to third parties. If the candidate has given us the name of the referrer, we assume that we can communicate with the referrer without further permission.
Legal basis: legitimate interest
Data retention period: 1 year
Processing of personal data of GDC contractual partners and their representatives
The GDC processes the data of the contractual partners and their representatives that are necessary for the conclusion and performance of the contracts. To this end, the GDC processes the following personal data: basic data (name, surname, position) and contact details (telephone number, e-mail address, address).
Legal basis: performance of the contract
Data retention period: 7 years
Processing of personal data of GDC clients and their representatives
The GDC processes the data of the clients and their representatives that are necessary for the performance of the client contracts. To this end, the GDC processes the following personal data: name, surname, position, personal identification code or document number, car registration number and contact details (telephone number, e-mail address).
Legal basis: performance of the contract
Data retention period: 7 years
Processing of personal data of visitors to GDC website
GDC website processes the visitor's IP address or other network identifiers to provide the website service and to compile web usage statistics in order to develop the website and make it more convenient for the visitor.
The GDC website uses Google Analytics, a web analytics service that collects general information about your use of our websites. For example, Google Analytics collects data about visitor location, browser and operating system version, time and duration of visit, and number of visits to and movement between GDC websites. We only see the information we collect in a non-personalized form and use the information we provide to improve the usability of our websites.
Legal basis: legitimate interest
Data retention period: 2 months
Processing of personal data of persons contacting GDC First Line Support
Incoming calls to the GDC client support are recorded and notified to the caller at the beginning of the call. The recordings are used to ensure better service and are kept unpersonalized. Recordings are automatically destroyed by the recording system after a certain time. If client does not want to be recorded, he/she can cancel the call and choose another way to receive information (for example, by sending an e-mail or regular mail).
Legal basis: performance of a contract
Data retention period: 6 months
Processing of personal data when visiting a data center
Upon entering the GDC data center, guests entering the building will be first received by a security guard working at the guest entrance, who has previously been provided with the name, surname, personal identification number, document number and organization of the person visiting the building. Security guard has the right to ask guest for an identity document to verify his/her identity. The guest is given a guest card, which gives the guest access to the data center premises.
There is 24-hour video surveillance in and around the GDC. The movement of persons in the building and on the territory (car parks, areas adjacent to the building) is recorded for security reasons.
Video recordings and door card logs are managed by GDC.
Legal basis: legitimate interest
Data retention period: video recordings are retained for 90 calendar days and door card logs for 1 year.
Transfer of personal data to third parties
The GDC may transfer personal data to third parties without the consent of the data subject:
who has a contract with the GDC and who process personal data on behalf of the GDC for a specific purpose and / or obligation.
Such third parties may also be located outside the Republic of Estonia, the European Union or the European Economic Area. When we transfer your personal information to such persons, we will take all necessary legal measures to ensure that your right to privacy is properly protected.
We implement all technical and organizational measures in order to guarantee the security and integrity of the personal Data and in order to protect personal Data against accidental or unlawful destruction or accidental loss, alternation, unauthorized disclosure or access.
Your rights
Everyone has the right to information about the processing of their personal data. To do so, please contact GDC: info@greenergydatacenters.com
If we refuse to release data or provide information on the processing of personal data, we are obliged to give reasons. We will notify you of the decision to refuse within five working days of receiving the application.
Everyone has the right to demand that we correct personal data about them. To do so, please contact the GDC by e-mail: info@greenergydatacenters.com
If GDC has (no longer) a legal basis for the use of personal data, you can request that we stop using your data or delete it. If we process your personal data on the basis of your consent, you have the right to withdraw your consent.
You have the right to submit a challenge or complaint to the Data Protection Inspectorate or to file an appeal with an administrative court regarding the activities of GDC when processing personal data.