Processing of personal data

PROCESSING OF PERSONAL DATA

CONTROLLER

The controller of personal data is Hawaii Express OÜ, Harju County, Tallinn, Pirita district, Pirita tee 102, 12011, info@hawaii.ee

PURPOSE AND LEGAL BASIS OF PROCESSING PERSONAL DATA

No personal data is collected when the consumer makes a cash transaction in the store.

To perform a contract

One of the legal bases for the use of personal data is from Article 6 of the Personal Data Protection Act - performance of the contract and taking measures prior to the conclusion of the contract (paragraph 1 p b)

When the consumer makes a transfer transaction in the store, the payment service provider (bank) managing the Hawaii Express OÜ payment terminal collects the personal data necessary for the transaction, which will later be reflected in the Hawaii Express OÜ account statement.

When carrying out a transaction in the online store, the consumer can enter their bank details themselves and complete the transaction. In the course of this transaction, the consumer can additionally choose whether they will pick up the goods themselves or wants the goods delivered to their desired destination. If the goods are picked at the store, information is needed about the person who comes to pick up the goods, to make sure that Hawaii Express OÜ issues the goods to the right person.

If the consumer wants the delivery of the goods, the data to be entered are the following personal data: the consumer's name, contact data (e-mail address or telephone number, see below), address and account number. Also in the previously described case, when making a transaction, the payment service provider (bank) used by Hawaii Express OÜ collects the personal data necessary for the transaction, which will later be reflected in the account statement of Hawaii Express OÜ. In the case of delivery, in addition to the above, the consumer enters the delivery location and chooses the delivery method (parcel machine, courier). By entering the aforementioned data, the consumer also gives an order for the transfer of their personal data to the respective logistics partner performing the delivery. Depending on the delivery method, it is necessary for the consumer to select and enter the address of the delivery location and the corresponding contact method (phone number or e-mail address to send a message about the arrival of the goods at the parcel machine or at another destination). Personal data is used here in order to provide the logistics partner with the contact details needed to make the delivery or to provide the parcel service, as well as to identify the person, e.g. when handing over the goods from the store, where to identify the goods when handing them over from the store, so that the goods are handed over to the authorized person.

In addition, the consumer can open an account in the online store to receive discounts and track their purchase history. The account system is a customer-based discount enabling system created by Hawaii Express OÜ, through which regular customers can get various goods and services cheaper, free or more conveniently than non-account holders. When using the account, Hawaii Express OÜ collects data about the consumer's shopping habits (including purchase history), through which certain discounts are accumulated for the consumer, which the consumer can realize according to the terms of use of the respective account. Hawaii Express OÜ collects such data primarily for the purpose of determining the consumer's purchasing habits, in order to offer the consumer only such goods and services for sale in the future, in which the consumer is expected to be interested.

When opening an account, personal data such as first name, last name, e-mail address and telephone number are required. The e-mail address includes information on changes to user conditions and newsletters (if the consumer has previously made such a choice on the website). These personal data are also used in the conclusion and fulfillment of possible future contracts, if the account holder decides to make a purchase. The e-mail address is also sent to the e-mail address when making purchases, including an invoice and product use/assembly instructions, if the nature of the purchased product requires such availability. In summary, the existence of an e-mail address serves the purpose of making it possible to send and read (watch, in case of a usage video) more specific documentary and voluminous material sent by mail. However, the phone number fulfills the purpose of quick and immediate notification, where the consumer's interest in faster notification is assumed (e.g. notification of the presence of the goods at an address, notifications if e-mails are not answered, etc.). The phone number will be forwarded to the logistics partner in order to send a quick notification of the presence of the goods during future transactions. When ordering a delivery, the address of the delivery destination is added to the list of personal data.

If the consumer physically opens an account on the spot in the store, they have the opportunity to receive a loyal customer’s card, in which case, in addition to the personal data required to open the account, the personal code of the loyal customer’s card holder is also required, which also excludes misunderstandings about possible namesakes, etc. case. The loyal customer’s card is virtual, i.e. a separate physical loyal customer’s card is not issued. Since the loyal customer’s card is based on an ID card, the physical presentation of the ID card in every store allows one to make purchases with the benefits of their account.

Consent

One of the legal bases for the use of personal based on Article 6 of the Personal Data Protection Act - consumer consent (paragraph 1 pa), namely the consumer has the right to additionally give their consent to receive the newsletter, which they can withdraw at any time by informing about it by e-mail to eshop@hawaii.ee. Hawaii Express OÜ assumes that the consumer wishes to close their account when withdrawing their consent to the processing of personal data such as name or e-mail address or telephone number.

Legitimate interest

One of the legal grounds for the use of personal data is the legitimate interest from Article 6 (paragraph 1 p f) of the Personal Data Protection Act. 

When using the account, Hawaii Express OÜ collects data for various statistical reasons, especially when determining the sales shares and profitability of goods and services, etc. In the above mentioned situation, the personal data received from the consumer is transformed into numerical units during the processing of personal data and thereby anonymized and the use of personal data is limited to this, since the statistical result and what will happen in the future do not contain the personal data of the consumer and it is not possible to identify a specific consumer from the surface of the numbers used in the statistics. In this processing of personal data, no profile analysis is performed and no automated decision-making takes place. Making such statistics is not illegal, is sufficiently clearly defined, is real and currently occurring. The interests of the data subjects have been taken into account, it is not possible to draw conclusions about specific consumers from the surface of the statistics, the collected data form different sets of numbers, which give the company economic indications. In this way, it is not possible for third parties to identify any consumer in the statistics or associate them with any number. Hawaii Express OÜ does not publish these statistical data, they are used internally by the company for further economic decisions. Therefore, such use of personal data of consumers is a suitable solution for the compilation of statistics, as it is the only possibility for the raw data of such statistics. This is also necessary because the goal of obtaining accurate and up-to-date indications from statistics that are economically important cannot be achieved with other, less burdensome measures. It is also moderate processing, insofar as the data subject's data is anonymized for further processing, and all possible interference ends therewith.

DATA STORAGE PERIOD

Personal data is stored taking into account possible expiration dates for claims arising from civil transactions, including taking into account possible requirements for delivery of goods, compliance with their quality and possible crimes committed.

In this way, the general rule is to keep personal data for 3 years from the transaction (the general deadline for the expiration of the transaction). However, there are also exceptions to the mentioned rule, which result from the law, specific case-specificity and the definition below in the tree of accounts. In this way, but not only, for example, Hawaii Express OÜ has the obligation to keep the data (including personal data) contained in the original documents related to accounting for 7 years (Section 12 (1) of the Accounting Act). If there is reason to suspect intentional damage or there is a risk that Hawaii Express OÜ is suspected of intentional damage, the statute of limitations for such an act is 10 years. As a result, even in the previously described cases, it is justified to keep such personal data for self-protection, which allows to defend oneself against, for example, claims presented in court or helps to prove such claims. It is also justified in the case of court decisions that have entered into force to keep the personal data contained therein, especially in the case of pending court decisions, for up to 10 years from the date of entry into force of the decision. Pursuant to § 157 of the General Part of the Civil Code Act, the statute of limitations for a claim recognized by a judgment is 10 years, which starts from the entry into force of the judgment or the issuance of another enforcement document, but not before the claim becomes enforceable.

Account activity depends on the individual consumer. There are consumers who use the account almost daily, and there are also consumers who do not use the account for years, but remain loyal to Hawaii Express OÜ and still turn to Hawaii Express OÜ when they have a problem. This is understandable and depends on both the quality of the goods (long durability) and the consumer's own activity when using the item. In practice, it has happened that even a purchase 5 years ago has maintained such loyalty. In the case of such inactive accounts, based on its practice, Hawaii Express OÜ sends a reminder to the consumer no later than 5 years after the loss of activity on the account, allowing the consumer to choose whether he wants to delete the account or not. If no response is received, the account will be deleted.

The previous storage information regarding the deadlines concerns both the consumer's purchase history, correspondence with the consumer as well as the data history related to the consumer's account.

PROHIBITION OF USE, CORRECTION, DELETION OF PERSONAL DATA

The Consumer shall have the right at any time to prohibit the collection and use of their personal information except to the extent required to recover a claim under the contract or to deliver the goods. The Consumer has the right to request access to the data and demand their correction or deletion. In case of the existence of such a wish, it must be reported by e-mail to eshop@hawaii.ee.

The use of electronic personal data for direct mail takes place only if the Consumer has given separate consent for this on the website www.hawaii.ee under their account settings.

When making purchases with encrypted data communication banks, the Consumer ensures the security of their personal bank identifiers and HJ Web Store does not have access to them.

INFORMATION ABOUT RECIPIENTS OF PERSONAL DATA AND CATEGORIES OF RECIPIENTS

The categories of processing performed on behalf of Hawaii Express OÜ as the responsible processor are most easily presented by reference to the name of the service used. The data may be submitted to such authorized processors as: data hosting and other IT service provider, accounting service provider, courier/transport service/valley machine service provider, legal aid service provider and financial service provider (bank).

Hawaii Express OÜ requires co-responsible and authorized processors to comply with the Personal Data Protection Act in the processing of personal data.

FILING OF COMPLAINTS

The data subject would have the right to submit a complaint against the data processor to the Data Protection Inspectorate ☎ 627 4135; ✉ info@aki.ee.