1. The controller of personal data collected in the e-shop of the University of Tartu Library (‘e-shop’) is the University of Tartu (‘university’; registry code 74001073, address Ülikooli 18, 50090 Tartu, Estonia). The data subjects whose personal data the university processes are customers who are natural persons.
2. In the e-shop, the university processes the following personal data of customers:
2.1. name, telephone number, address and mail address. The processing of these personal data is necessary for managing orders, including providing customer support and delivery of goods;
2.2. data on purchases (date, goods and quantity) for an overview of purchased goods and services and for analysing customer preferences;
2.3. financial data (e.g. bank account number) for making refunds to customers;
2.4. the IP address or other web identifiers of e-shop customers for providing the e-shop as an information society service and for web use statistics.
3. Legal basis
3.1. The legal basis for the processing of personal data is a sales contract made with the customer.
3.2. The legal basis for the processing of personal data may also be the performance of a legal obligation (for example, accounting duties or a consumer dispute).
3.3. The legal basis for the processing of personal data may also be the consent of the customer.
4. Transfer of personal data to third persons
4.1. If the customer has chosen Omniva or Itella smartpost parcel terminal as the method of delivery, the university sends the customer’s name, telephone number and email address to Omniva OÜ (registry code 12670875) or to Itella Estonia OÜ (registry code 10891224). The university will not pass the customer’s personal data to other persons without the customer’s consent, except if otherwise provided by law.
4.2. The University of Tartu passes the personal data necessary for making payments to the processor of data, AS SEB.
5. Security and access to data
5.1. Personal data are stored in the university’s servers.
5.2. Access to personal data is only allowed to university employees whose duties include the management of the e-shop, to solve technical problems related to using the e-shop and provide customer support.
5.3. Relevant physical, organisational and IT security measures are applied to protect the personal data from accidental or unlawful destruction, loss, changing or unauthorised access and publication.
5.4. The university passes personal data to processors of the e-shop (for example, provider of transport service) on the basis of contracts made by the e-shop with the processor. Processors must ensure adequate protective measures when processing personal data.
6. Storage
The e-shop stores the personal data of a registered user (incl. data on purchases) until the customer account is active. Registered user can request for their account to be deactivated by contacting our customer support at raamatupood@utlib.ee. When the user account is closed, the university will erase all personal data related to the customer from the eshop. The university preserves the personal data of both registered and unregistered users for solving consumer disputes and accounting for seven years.
7. Rights
Depending on the legal basis of processing of personal data, data subjects have the right:
7.1. to obtain confirmation as to whether the university processes their personal data, and access the data collected concerning them;
7.2. to demand the rectification of inaccurate personal data collected concerning them, and completion of incomplete personal data;
7.3. to demand the university to delete, without undue delay, their personal data which the university no longer has a legal basis to process or which the university no longer needs for the purpose for which it was collected or otherwise processed;
7.4. to withdraw their consent at any time, if the personal data are processed on the basis of data subject’s consent. This does not affect the legality of data processing that occurred before the withdrawal of the consent;
7.5. to demand the university to the restrict the processing of their personal data, in case:
7.5.1. the data subject has contested the personal data on the basis of accuracy. The university restricts the processing until the accuracy of the data is verified;
7.5.2. the processing of personal data is illegal, but the data subject does not request the deletion of the data;
7.5.3. the university no longer needs the personal data for processing, but the data subject needs them to assert, exercise or defend legal claims;
7.5.4. the data subject has filed an objection to processing personal data. The university restricts the processing until it is verified whether the university’s lawful reasons outweigh the data subject’s reasons;
7.6. to receive the personal data which they have submitted to the university and communicate them to another controller. The right to hand over the data applies solely to the personal data which the data subject has communicated to the university and which the university processes by automated means and on the basis of consent or contract;
7.7. to file an objection against processing their personal data, if the processing of data is based on legitimate interest, or if the processing is necessary for the performance of public duties or for public interest.
8. Registered users can access and change or edit their personal data in the user profile of the e-shop. Unregistered users can exercise the rights related to their personal data by contacting the customer support of the e-shop. Data subjects may contact the university’s data protection specialist with any questions relating to the processing of their personal data and to exercising the rights of the data subject, by email at andmekaitse@ut.ee.
9. If the customer believes that the way how the university processes personal data conflicts with the legislation governing the processing of personal data, the customer is entitled to contact the Data Protection Inspectorate (email info@aki.ee, telephone number +372 627 4135) or another agency, primarily the competent supervisory authority of place of residence or work.
10. On its website (raamatupood.utlib.ee), the e-shop uses cookies. A cookie is a small piece of information that a website transfers to the cookie file on your computer in order to provide a better user experience. We use the following types of cookies:
10.1.1. session cookies, which are temporary and are erased immediately after the browser is closed. The e-shop uses session cookies to ensure the proper functioning and convenient use of the website;
10.1.2. persistent cookies, which are stored on the visitor’s computer or device after the browser is closed. The e-shop uses persistent cookies to identify visitors who have visited the website before, and store their user preferences (products they have added to their cart);
10.1.3. third-party cookies. The university uses cookies created by third parties for website statistics; using the services provided by Google Analytics.
10.2. Visitors who do not allow cookies must change their browser’s privacy settings. This may restrict the visitor’s access to the services and functions provided on the e-shop's website.