General Principles and Definitions 1.1. This personal data processing policy (hereinafter referred to as the Policy) sets out the principles of personal data processing followed by Baltic Restaurants Estonia AS (hereinafter referred to as BRE), the obligations of BRE, and the rights of data subjects. 1.2. Personal data, as defined in this Policy, refers to any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, personal identification code, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. 1.3. Processing of personal data includes any operation or set of operations performed on personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, erasure, or destruction.
Principles of Personal Data Processing 2.1. In the processing of personal data, BRE adheres to the principles of human dignity, the legitimate interests, and fundamental rights of the data subject, and follows the principles of transparency and legality. 2.2. BRE processes the personal data of employees working under an employment contract or a service contract for the purpose of managing the employment relationship. BRE processes the personal data of its contractual partners, their employees, and service users solely for the purpose of fulfilling contracts. BRE uses the data only for the purpose for which it was collected and to the extent necessary to achieve that purpose. 2.3. BRE processes personal data only with the consent of the data subject or for the performance of a contract to which BRE is a party. 2.4. BRE collects only the data necessary for the proper performance of the contract. When providing services in a pre-school educational institution, the pre-school institution provides BRE with the necessary information for the performance of the contract (including the child’s name, personal identification code, parent’s name, personal identification code, and the number of meal days). The purpose of data collection is to prevent incorrect invoicing based on incorrect child data.
