2. Content of personal data

• Identification and contact details: first and last name, personal identification code, contact details (email address, postal address, telephone number);
• Work-related data: position, employer;
• Other data: the scope and duration of services ordered, inquiries made on the website or by email, information related to customer communication, including communication with potential clients, volunteers, and donors; any other personal data disclosed by the data subject through the use of our website or in the course of receiving our services, including free services.

The above-mentioned personal data are collected in the course of using the Organization’s services — when making a donation, subscribing to the newsletter, responding to surveys/studies, during communication, or in any other manner, including on the initiative of the data subject. In the case of donations, the NGO Crisis Research Center is the data controller; the NGO Crisis Research Center transmits the personal data necessary for processing payments to the authorized processor Maksekeskus AS.

We also collect non-personalised information, including data on the duration of website visits, the number of clicks, and user behaviour, but we do so solely for analytical purposes and to improve the convenience of the Organization’s website. We use only secure services. In addition to the above, we have the right to collect data that are available in public registers.

We process personal data when a legal basis exists and only for as long as necessary to fulfil the purposes set out in this privacy policy. These personal data processing terms describe how we collect and process personal data when acting as a data controller.

When acting as a data processor, we operate in accordance with the data processing agreements concluded between us and the data controllers, as well as the applicable legislation. We keep confidential and secure all other information disclosed to us in the course of using our services.

4. Security measures

We process personal data only when a legal basis exists and for legitimate purposes. To ensure the security of personal data, we use appropriate measures and store personal data in a way that guarantees their security and confidentiality. Access to personal data is granted only to individuals for whom it is necessary in connection with the performance of their work duties, the provision of services, or to whom the disclosure of personal data is permitted under the personal data processing terms or applicable legislation. We implement the necessary organizational, physical, and IT security measures to ensure the protection of personal data.

Our employees are obligated under their employment and/or service agreements, as well as under applicable legislation, to keep personal data entrusted to them in the course of their work confidential; this confidentiality obligation is indefinite and applies to both current and former employees.

When we transmit personal data to authorized processors acting on our behalf, we ensure their reliability and conclude appropriate agreements and data processing contracts with them.

If a personal data breach occurs and it is likely to pose a risk to the rights and freedoms of the data subject, we will notify the Estonian Data Protection Inspectorate of the breach. In addition, we will take measures to stop the breach as soon as possible.

We are not responsible for any misuse of your personal data resulting from malware on your computer or other device.

5. Recipients

We have the right to disclose and transmit personal data without your prior consent to authorized processors acting on our behalf and under appropriate data processing agreements, as well as when necessary to comply with obligations arising from legislation. To protect our rights, we also have the right to disclose personal data to third parties.

With your consent and in accordance with these personal data processing terms, we may disclose and transmit personal data to our cooperation partners.