Processing of personal data
PROCESSING OF PERSONAL DATA
The controller of personal data is Hawaii
Express OÜ, Harju County, Tallinn, Pirita district, Pirita tee 102, 12011,
PURPOSE AND LEGAL BASIS OF PROCESSING
No personal data is collected when the
consumer makes a cash transaction in the store.
To perform a contract
One of the legal bases for the use of
personal data is from Article 6 of the Personal Data Protection Act -
performance of the contract and taking measures prior to the conclusion of the
contract (paragraph 1 p b)
When the consumer makes a transfer
transaction in the store, the payment service provider (bank) managing the
Hawaii Express OÜ payment terminal collects the personal data necessary for the
transaction, which will later be reflected in the Hawaii Express OÜ account
When carrying out a transaction in the
online store, the consumer can enter their bank details themselves and complete
the transaction. In the course of this transaction, the consumer can
additionally choose whether they will pick up the goods themselves or wants the
goods delivered to their desired destination. If the goods are picked at the
store, information is needed about the person who comes to pick up the goods,
to make sure that Hawaii Express OÜ issues the goods to the right person.
If the consumer wants the delivery of the
goods, the data to be entered are the following personal data: the consumer's
name, contact data (e-mail address or telephone number, see below), address and
account number. Also in the previously described case, when making a
transaction, the payment service provider (bank) used by Hawaii Express OÜ
collects the personal data necessary for the transaction, which will later be
reflected in the account statement of Hawaii Express OÜ. In the case of
delivery, in addition to the above, the consumer enters the delivery location
and chooses the delivery method (parcel machine, courier). By entering the
aforementioned data, the consumer also gives an order for the transfer of their
personal data to the respective logistics partner performing the delivery.
Depending on the delivery method, it is necessary for the consumer to select
and enter the address of the delivery location and the corresponding contact
method (phone number or e-mail address to send a message about the arrival of
the goods at the parcel machine or at another destination). Personal data is
used here in order to provide the logistics partner with the contact details
needed to make the delivery or to provide the parcel service, as well as to
identify the person, e.g. when handing over the goods from the store, where to
identify the goods when handing them over from the store, so that the goods are
handed over to the authorized person.
In addition, the consumer can open an
account in the online store to receive discounts and track their purchase
history. The account system is a customer-based discount enabling system
created by Hawaii Express OÜ, through which regular customers can get various
goods and services cheaper, free or more conveniently than non-account holders.
When using the account, Hawaii Express OÜ collects data about the consumer's
shopping habits (including purchase history), through which certain discounts
are accumulated for the consumer, which the consumer can realize according to
data primarily for the purpose of determining the consumer's purchasing habits,
in order to offer the consumer only such goods and services for sale in the
future, in which the consumer is expected to be interested.
When opening an account, personal data such
as first name, last name, e-mail address and telephone number are required. The
e-mail address includes information on changes to user conditions and
newsletters (if the consumer has previously made such a choice on the website).
These personal data are also used in the conclusion and fulfillment of possible
future contracts, if the account holder decides to make a purchase. The e-mail
address is also sent to the e-mail address when making purchases, including an
invoice and product use/assembly instructions, if the nature of the purchased
product requires such availability. In summary, the existence of an e-mail address
serves the purpose of making it possible to send and read (watch, in case of a
usage video) more specific documentary and voluminous material sent by mail.
However, the phone number fulfills the purpose of quick and immediate
notification, where the consumer's interest in faster notification is assumed
(e.g. notification of the presence of the goods at an address, notifications if
e-mails are not answered, etc.). The phone number will be forwarded to the
logistics partner in order to send a quick notification of the presence of the
goods during future transactions. When ordering a delivery, the address of the
delivery destination is added to the list of personal data.
If the consumer physically opens an account
on the spot in the store, they have the opportunity to receive a loyal
customer’s card, in which case, in addition to the personal data required to
open the account, the personal code of the loyal customer’s card holder is also
required, which also excludes misunderstandings about possible namesakes, etc.
case. The loyal customer’s card is virtual, i.e. a separate physical loyal
customer’s card is not issued. Since the loyal customer’s card is based on an
ID card, the physical presentation of the ID card in every store allows one to
make purchases with the benefits of their account.
One of the legal bases for the use of
personal based on Article 6 of the Personal Data Protection Act - consumer
consent (paragraph 1 pa), namely the consumer has the right to additionally
give their consent to receive the newsletter, which they can withdraw at any
time by informing about it by e-mail to firstname.lastname@example.org.
Hawaii Express OÜ assumes that the consumer wishes to close their account when
withdrawing their consent to the processing of personal data such as name or
e-mail address or telephone number.
One of the legal grounds for the use of personal data is the legitimate interest from Article 6 (paragraph 1 p f) of the Personal Data Protection Act.
When using the account, Hawaii Express OÜ collects data for various statistical reasons, especially when determining the sales shares and profitability of goods and services, etc. In the above mentioned situation, the personal data received from the consumer is transformed into numerical units during the processing of personal data and thereby anonymized and the use of personal data is limited to this, since the statistical result and what will happen in the future do not contain the personal data of the consumer and it is not possible to identify a specific consumer from the surface of the numbers used in the statistics. In this processing of personal data, no profile analysis is performed and no automated decision-making takes place. Making such statistics is not illegal, is sufficiently clearly defined, is real and currently occurring. The interests of the data subjects have been taken into account, it is not possible to draw conclusions about specific consumers from the surface of the statistics, the collected data form different sets of numbers, which give the company economic indications. In this way, it is not possible for third parties to identify any consumer in the statistics or associate them with any number. Hawaii Express OÜ does not publish these statistical data, they are used internally by the company for further economic decisions. Therefore, such use of personal data of consumers is a suitable solution for the compilation of statistics, as it is the only possibility for the raw data of such statistics. This is also necessary because the goal of obtaining accurate and up-to-date indications from statistics that are economically important cannot be achieved with other, less burdensome measures. It is also moderate processing, insofar as the data subject's data is anonymized for further processing, and all possible interference ends therewith.
DATA STORAGE PERIOD
Personal data is stored taking into account
possible expiration dates for claims arising from civil transactions, including
taking into account possible requirements for delivery of goods, compliance
with their quality and possible crimes committed.
In this way, the general rule is to keep
personal data for 3 years from the transaction (the general deadline for the
expiration of the transaction). However, there are also exceptions to the
mentioned rule, which result from the law, specific case-specificity and the
definition below in the tree of accounts. In this way, but not only, for
example, Hawaii Express OÜ has the obligation to keep the data (including
personal data) contained in the original documents related to accounting for 7
years (Section 12 (1) of the Accounting Act). If there is reason to suspect
intentional damage or there is a risk that Hawaii Express OÜ is suspected of
intentional damage, the statute of limitations for such an act is 10 years. As
a result, even in the previously described cases, it is justified to keep such
personal data for self-protection, which allows to defend oneself against, for
example, claims presented in court or helps to prove such claims. It is also
justified in the case of court decisions that have entered into force to keep
the personal data contained therein, especially in the case of pending court
decisions, for up to 10 years from the date of entry into force of the
decision. Pursuant to § 157 of the General Part of the Civil Code Act, the statute
of limitations for a claim recognized by a judgment is 10 years, which starts
from the entry into force of the judgment or the issuance of another
enforcement document, but not before the claim becomes enforceable.
Account activity depends on the individual
consumer. There are consumers who use the account almost daily, and there are
also consumers who do not use the account for years, but remain loyal to Hawaii
Express OÜ and still turn to Hawaii Express OÜ when they have a problem. This
is understandable and depends on both the quality of the goods (long
durability) and the consumer's own activity when using the item. In practice,
it has happened that even a purchase 5 years ago has maintained such loyalty.
In the case of such inactive accounts, based on its practice, Hawaii Express OÜ
sends a reminder to the consumer no later than 5 years after the loss of
activity on the account, allowing the consumer to choose whether he wants to
delete the account or not. If no response is received, the account will be
The previous storage information regarding
the deadlines concerns both the consumer's purchase history, correspondence
with the consumer as well as the data history related to the consumer's
PROHIBITION OF USE, CORRECTION, DELETION OF
The Consumer shall have the right at any
time to prohibit the collection and use of their personal information except to
the extent required to recover a claim under the contract or to deliver the
goods. The Consumer has the right to request access to the data and demand
their correction or deletion. In case of the existence of such a wish, it must
be reported by e-mail to email@example.com.
The use of electronic personal data for
direct mail takes place only if the Consumer has given separate consent for
this on the website www.hawaii.ee under their account settings.
When making purchases with encrypted data
communication banks, the Consumer ensures the security of their personal bank
identifiers and HJ Web Store does not have access to them.
INFORMATION ABOUT RECIPIENTS OF PERSONAL
DATA AND CATEGORIES OF RECIPIENTS
The categories of processing performed on
behalf of Hawaii Express OÜ as the responsible processor are most easily
presented by reference to the name of the service used. The data may be
submitted to such authorized processors as: data hosting and other IT service
provider, accounting service provider, courier/transport service/valley machine
service provider, legal aid service provider and financial service provider
Hawaii Express OÜ requires co-responsible
and authorized processors to comply with the Personal Data Protection Act in
the processing of personal data.
FILING OF COMPLAINTS
The data subject would have the right to
submit a complaint against the data processor to the Data Protection
Inspectorate ☎ 627 4135; ✉ firstname.lastname@example.org.