This privacy notice describes, how Reterra Estate OÜ and its subsidiaries (for the purposes of this privacy notice limited company Reterra Estate, registry code 12809907, address Jõe 4a, 10151 Estonia, its subsidiaries and related companies, who are acting under the brands Reterra Estate or Reterra, hereinafter We or Reterra) process the personal data of potential and existing customers, persons related to them, sales contacts, website and social media visitors, and other data subjects who come into contact with Reterra Estate within the scope of its services (hereinafter you). This privacy notice applies if you use, have used, or have expressed an intention to use our services, including visiting our website or providing us with your e-mail address to receive newsletters, or if you have submitted an application as a candidate or an employment application.
In the described cases, we act as the controller of your personal data and are responsible for their processing.

COLLECTION OF YOUR PERSONAL DATA. We collect your personal data in the following ways:

• you provide us with your personal data yourself (e.g., by contacting us via phone, e-mail, or over the website, via social media channels, at our office, during customer days or other public events organized by us or via other online channels, or uploading your CV on our website);
• your personal data is provided to us by a third party (e.g., a broker or when a third-party payment service provider confirms whether your payment was successful or not);
• we have collected your personal data ourselves, including automatically. See also our cookie policy in this section.

PERSONAL DATA PROCESSED.We process the following personal data of the following data subjects:

• When subscribing to the newsletter on our website, we process data about your name and contact details (e-mail).
• When registering on our website to express interest in development projects, we process data about your name and contact details (phone and e-mail) and about your preferences regarding the apartment (size, price).
• When registering and participating in our customer days, we process your name and contact details (address, phone, and e-mail) and your preferences regarding the apartment (size, price).
• When entering into a contract with us, we process data about your name, ID number, contact details (address, phone and e-mail) and marital status; we also process relevant data (except data on marital status) about your authorized representative.
• When applying for job with us, we process your name and contact details (address, phone number and e-mail) as well as information about your education, skills, previous employment, etc.
• When participating in our customer days or other public events organized by us, we process your image (videos and photos).
• If you are on the territory of our development object, we will process your image, all other personal data and activities that are visible in the video surveillance area of the territory.

PURPOSE AND LEGAL BASIS OF PROCESSING. We process your personal data for the following purposes and on following legal bases:

• to enter into and perform any contract concluded with you; on the basis of our legitimate interest, e.g. to contact you for marketing purposes, if based on our previous contact it can be assumed that you are interested in the particular offer, if you have not expressed dissatisfaction or objected to such contact. In such case according to our judgment, your interests and rights do not outweigh our legitimate interest in marketing our products and services;
• to ensure the performance of the contract concluded with you, including to identify, prove and file claims about violation of the contract or legislation. In case you have breached the contract or the law, your interests or rights do not outweigh our legitimate interest;
• to collect statistics about website visits and service usage and other non-personalized technical information about the use of the website with the aim of improving the website and services;
• to contact you for feedback about our services and products or conducting a customer satisfaction survey, if you have not expressed dissatisfaction or objected to such contact;
• to fulfill our legal obligations.

Your personal data may also be processed, if it is necessary in a particular case for our or a third party’s legitimate interest, unless such interest is outweighed by your interests or fundamental rights and freedoms for which personal data must be protected. Also, if it is necessary to protect the vital interests of you or another natural person.

We do not process personal data specific to special categories.

PROCESSING ON THE BASIS OF CONSENT. We may also process your personal data based on your consent (e.g., sending newsletters for direct marketing purposes). If processing is based on your consent, you may withdraw it at any time by contacting us using the contact details below or by clicking on the “unsubscribe” link at the end of each letter. We note that the withdrawal of consent does not affect the lawfulness of processing based on the consent that was carried out before the withdrawal of consent.

AUTHORIZED PROCESSORS. We use carefully selected service providers (authorized processors) to process your personal data. In doing so, we remain fully responsible for your personal data.
We use the following categories of processors: data storage service providers, e-mail service providers, customer relationship management service providers, brokerage service providers, construction service providers, marketing service providers, payment service providers, and job placement service providers.
If you would like to get more detailed information about our authorized processors (such as their names and locations), please contact us using the contact details below.

THIRD PARTIES.
We will only share your personal data with third parties if it is set in this privacy notice, as required by applicable law (e.g. if we are required to share personal data with authorities) or with your consent.
We may share your personal data with subsidiaries acquired by Reterra Estate OÜ, our auditors, and legal advisors. The legal basis for such sharing is our respective legal obligation or legitimate interest.

TRANSFER OF PERSONAL DATA OUTSIDE THE EUROPEAN UNION
Our authorized processors may process your personal data outside the European Union (including the United States). We only transfer your personal data outside the European Union if we have a legal basis to do so, including to the recipient of the data: i) who is located in a country where, in the judgment of the European Commission, the protection of personal data is ensured at an adequate level (this includes organizations certified under the Privacy Shield); or ii) on the basis of a contract that meets the requirements of the European Union for the transfer of personal data to personal data processors located outside the European Union.
If you would like more detailed information about the transfer of your personal data outside the European Union (e.g., the names of the recipients and the legal basis for the transfer), please contact us using the contact details below.

SECURITY
We implement technical and organizational security measures to protect your personal data, taking into account (i) the level of technology, (ii) the costs of implementation, (iii) the nature, scope, context and purposes of the processing, and (iv) the risks to you. Such security measures include access management, employee training, two-factor authentication, data encryption, among others.

RETENTION OF DATA
We will retain your personal data for as long as necessary for the purpose for which it was collected, as long as it is necessary to protect our interests, or as long as required by applicable law.

If you have entered into a contract with us, we will retain your personal data as follows:

• in accordance with Estonian accounting and taxation laws, we retain data related to accounting documents for seven (7) years from the end of the relevant financial year;
• in accordance with the statute of limitations set forth in Estonian law, we retain personal data related to contractual claims for a maximum of 10 years from the date the claim becomes due.

If you have registered your interest in one of our products, we will retain your personal data for five (5) years from the day of our last in contact with you.
If you have participated in our customer day and you have not entered into any contract with us, your personal data will be retained for five (5) years from the date of the corresponding customer day. We store photo and video material recorded by us for five (5) years from the date of recording.

If you have applied for a job with us, but the application turns out to be unsuccessful, we will store your personal data for one (1) month from the confirmation of the selected candidate for the position for which the application was made. Based on your separate consent, we retain the relevant data for up to six (6) months from the end of the recruitment process. If you have provided us with your contact information and uploaded your CV on our website, we will store your personal data for up to six (6) months from the date of delivering the data.
We retain data obtained through cookies on our website in accordance with the cookie policy.

YOUR RIGHTS
You have all data subject rights with respect to your personal data to the extent provided by applicable legislation.
These rights include requesting:
• access to your personal data;
• a copy of your personal data;
• correction of incorrect or incomplete personal data;
• deletion of personal data;
• restriction of processing of personal data;
• transfer of personal data;
• objecting to the processing of personal data based on legitimate interest and processed for direct marketing purposes.
In order to exercise your rights, please contact us using the contact details below. If you believe that your rights have been violated, you have the right to file a complaint with the Data Protection Inspectorate or a lawsuit in court.

CHANGING THE PRIVACY NOTICE
If our personal data processing practice changes or we need to change the Privacy Notice due to applicable data protection legislation, other legislation, case law or guidelines or practice issued by competent authorities, we have the right to unilaterally change the Privacy Notice at any time. In such event, we will notify you by e-mail in reasonable time in advance before the changes take effect.

APPLICABLE LAW
Since we are a company registered in the Republic of Estonia, the law of the Republic of Estonia applies to the processing of your personal data.

CONTACTS
If you have any questions regarding the processing of your personal data or if you want to exercise your rights as a data subject, please contact us using the following contact details: address Jõe tn 4a, Tallinn 10151, e-mail address info@reterra.ee or phone +372 6 001 004.