Privacy policy

General provisions

1.1. This Privacy Policy sets out the principles governing the collection, processing and storage of personal data. Personal data is collected, processed and stored by the controller of the personal data, the Tartu Art Museum (hereinafter referred to as the Data Controller).

1.2. For the purposes of this Privacy Policy, a Data Subject is a Customer or other natural person whose personal data is processed by a Data Controller.

1.3. For the purposes of this Privacy Policy, a Customer is anyone who purchases goods or services from the website of a Data Controller.

1.4. The Data Controller complies with the data processing principles set out in the legislation, including processing personal data lawfully, fairly and securely. The Data Controller is able to confirm that personal data have been processed in accordance with the law.

Collection, processing and storage of personal data

2.1. The personal data collected, processed and stored by the Data Controller are collected electronically, mainly through the website and e-mail.

2.2. By sharing his or her personal data, the Data Subject grants the Data Controller the right to collect, organise, use and manage the personal data that the Data Subject directly or indirectly shares with the Data Controller when purchasing goods or services from the website, for the purposes specified in the Privacy Policy.

2.3. It is the Data Subject’s responsibility to ensure that the data they provide is accurate and complete. Knowingly providing false information will be considered a breach of the Privacy Policy. It is the Data Subject’s responsibility to inform the Data Controller immediately of any changes to the data provided.

2.4. The Data Controller shall not be liable for any damage caused by the provision of false information by the Data Subject to the Data Subject or to third parties.

Processing of Customers’ personal data

3.1. The Data Collector may process the following personal data of a data subject:

3.1.1. First name and surname;

3.1.2. Date of birth;

3.1.3. Phone number;

3.1.4. E-mail address;

3.1.5. Delivery address;

3.1.6. Bank account number;

3.1.7. Payment card details;

3.2. In addition to the above data, the Data Collector has the right to collect data about the Customer that is publicly available.

3.3. The legal basis for the processing of personal data is Article 6(1)(a), (b), (c) and (f) of the GDPR:

a) the Data Subject has given his or her consent to the processing of his or her personal data for one or more specific purposes;

b) processing of personal data is necessary for the performance of a contract entered into with the Data Subject or in order to take steps at the request of a Data Subject prior to entering into a contract;

c) the processing is necessary for compliance with a legal obligation to which the Data Controller is subject;

f) the processing of personal data is necessary for the purposes of legitimate interests pursued by the Data Controller or by a third party, unless such interests override the interests of the Data Subject or the fundamental rights and freedoms for which the personal data must be protected, in particular when the Data Subject is a child.

3.4. Processing of personal data for the purposes for which it is processed:

3.4.1. Purpose of processing: security and safety