2.1. Poker 360 OÜ is a legal person; registry code: 14443178; registered address: Kiisa 8b, Tallinn 11313.

2.2. Poker 360 OÜ may process personal details:

2.2.1. as a data controller, determining the purposes of and the means for such processing;

2.2.2. as a data processor based on the data controller’s instructions;

2.2.3. as a recipient to the extent to which personal details are transferred to them.

2.2.4. The list of data processors for Poker 360 OÜ and other details are accessible so that users and other interested parties can become acquainted with them.

2.3. This Poker 360 OÜ privacy policy forms an integral part of the contract that is entered into between Poker 360 OÜ and the client and of the general terms and conditions.

2.4. The privacy policy is applicable to any data subjects and all employees and partners of Poker 360 OÜ who have access to the personal details that are held by Poker 360 OÜ, which must operate pursuant to the rights and obligations that have been established by the privacy policy.

2.5. The privacy policy may be complemented by privacy-related notices which are displayed on the website or on devices. Such notices may also be used to amend or complement the privacy policy.

3.1. Poker 360 OÜ always keeps in mind the data subjects’ interests, rights, and freedoms in the processing of personal details.

3.2. The aim of Poker 360 OÜ is the responsible processing of personal details based on best practice, and always being prepared to demonstrate its compliance in terms of processing with the defined purposes.

3.3. All of the processes, instructions, operations, and activities of Poker 360 OÜ which are related to the processing of personal details are based on the following principles:

3.3.1. Lawfulness. There are legal grounds for processing personal details, such as consent;

3.3.2. Fairness. The processing of personal details is fair, focussing above all on ensuring that the data subjects have enough knowledge and information in regard to how their personal details are being processed such as, for example, through a register of processing operations (see article 13: important documents, instructions, and procedures);

3.3.3. Transparency. The processing of personal details is transparent for data subjects. Among other things this means that such processing takes place via an account that has been designed for this purpose and through the register of processing operations which explains in simple language why, how, and when personal details are processed.

3.3.4. Purposefulness. Personal details are collected for legal and accurately and clearly-determined purposes and are not processed in any manner which would conflict with these purposes at a later date. The data subject can at any time acquaint themselves with the purpose behind any such processing of personal details for a specific purpose with register of processing operations.

3.3.5. Minimalisation. Personal details are relevant, important, and restricted only to what is necessary from the perspective of the purpose behind the processing of such personal details. OÜ Poker 360 processes personal details on the basis of the principle of minimum processing and those personal details which are not required or are no longer required for the purpose for which they were collected will be deleted;

3.3.6. Accuracy. Personal details are accurate and, if necessary, are updated, and all reasonable measures are implemented to ensure that such personal details which are incorrect for the purposes of processing personal details are immediately deleted or corrected.

3.3.7. Restriction on retention. Personal details are only retained in a form which enables the identification of the data subjects as long as it is necessary to serve the purpose for which the personal details are being processed. This means that if Poker 360 OÜ would like to retain the personal details longer that is necessary based on the purpose behind the collection of the data, Poker 360 OÜ will anonymise the data so that the data subject is no longer identifiable. In the case of details which Poker 360 has received through a customer relationship or another similar relationship, Poker 360 OÜ retains such details in compliance with best practice, and those details which are processed based on consent being given are, in general, retained until consent is withdrawn. The period of time in which details are retained  in the case of the various purposes behind processing are specified in the register of processing operations.

3.3.8. Reliability and confidentiality. Personal details are processed in a manner which ensures the proper security of all data, including protecting it from unauthorised or unlawful processing and from accidental loss, destruction, or damage by using reasonable technical and organisational measures. Poker 360 OÜ has internal rules, guidelines for employees, and separate contracts with each data processor which serve to establish best practice, a regular risk assessment, and proper technical and organisational measures that are used in the processing of personal details;

3.3.9. Data protection by default and by design. Poker 360 ensures that all systems which are used are compliant with the required technical criteria. Proper data protection measures are planned within the course of updating or designing any information or data system (eg. information systems and business processes are constructed based on the requirements of pseudonymisation and encryption).

3.4. In the processing of personal details, Poker 360 OÜ always proceeds by observing the aim of being able to prove that the aforementioned principles are being followed, and that the Data Protection Official can be contacted in order to obtain further information about observing the principles.

4.1. A detailed list of the personal details that are being processed by Poker 360 OÜ can be found in the Poker 360 OÜ register of processing operations.

4.2. Poker 360 OÜ collects the following categories of personal details which includes, among other things, the following:

4.2.1. those personal details which are disclosed to Poker 360 OÜ by the data subject;

4.2.2. those personal details which are generated during the course of normal communications between the data subject and Poker 360 OÜ;

4.2.3. those personal details which have clearly been made public by the data subject (eg. via social media);

4.2.4. those personal details which are generated during the course of using Poker 360 OÜ’s services (eg. when using the Poker 360 OÜ online store);

4.2.5. those personal details which are generated as a result of visiting and using the website (eg. the amount of time spent on the website);

4.2.6. those personal details which are received from third parties;

4.2.7. those personal details which are created or combined by Poker 360 OÜ (thanks to emails which are exchanged within the framework of the customer relationship and also thanks to the order history).

4.3 Poker 360 OÜ is the data controller. Poker 360 OÜ transfers those personal details which are required for making payments to the following data processor: Maksekeskus AS.

4.4 Poker 360 OÜ processes the following data:

• first name and surname;
• email address;
• delivery address (house number and street, postal code, and city);
• telephone number.

4.5 Personal details are used in the administration of the customer’s orders and for delivering the goods that they have ordered.

5.1. Detailed information about personal details and the list of those personal details that are processed by Poker 360 OÜ, also including the methods, processes, and means of processing, can be found in Poker 360 OÜ’s register of processing operations.

5.2. Poker 360 OÜ only processes personal details based on consent being provided or on legal provisions. The legal grounds for processing personal details include, among other things, legitimate interest and a contract between the data subject and Poker 360 OÜ.

5.3. Based on consent being provided, personal details are only processed by Poker 360 OÜ within the limits, to the extent, and for the purposes determined by the data subject. In the case of consent being provided, Poker 360 OÜ operates pursuant to the principle that each consent must be provided in a manner which is clearly distinguishable from other questions, in an understandable and easily accessible form, and in clear and simple language. Such consent can be provided in written format, or electronically, or in the form of a verbal expression of intention. The data subject grants consent voluntarily, specifically, knowingly, and unambiguously such as, for example, by ticking a box on the website.

5.4. When a contract is agreed, brought into validity, and used as a basis for providing a service, further details which are related to the processing of personal details may be established within the specific contract, but Poker 360 OÜ may process personal details for the following purposes:

5.4.1. to implement measures prior to the entry into force of the contract if requested by the data subject;

5.4.2. to identify the customer to the extent required based on due diligence;

5.4.3. to carry out duties on behalf of the customer in connection with providing the services;

5.4.4. to communicate with the customer;

5.4.5. to ensure that the customer fulfils their payment obligations;

5.4.6. to file, realise, and defend claims.

5.5. Processing the applicant’s personal details for the purpose of entering into an employment contract based on the established grounds for entering into a contract and upon legitimate interests includes the following:

5.5.1. processing the data that has been provided to Poker 360 OÜ by the applicant for the purpose of entering it into an employment contract;

5.5.2. processing those personal details that have been received from the individual who is listed by the applicant as being a referee;

5.5.3. processing those personal details that have been collected from national databases and registers and from public (social) media.

If the applicant is not selected then those personal details that have been collected for the entry into force of an employment contract are retained by Poker 360 OÜ for a period of two years for the purpose of being able to offer the applicant employment should a suitable position become vacant. Two years after the date upon which the application for a position was submitted, the personal details of the unsuccessful candidate are to be deleted.

5.6. ‘Legitimate interest’ refers to the interests of Poker 360 OÜ in the management of the company in order to be able to provide the best possible services in the market. Based on those grounds which arise due to legal requirements, personal details are only processed by Poker 360 OÜ after they have careful been assessed in order to ensure that Poker 360 OÜ has a legitimate interest based on which the processing of the personal details is required, and which is compliant with the interests and rights of the data subject (which means conducting what is known as the three-stage test). Based on the presence of a legitimate interest, personal details may primarily be processed for the following purposes:

5.6.1. to ensure a customer relationship which is based on the spirit of trust such as, for example, the processing of personal details which is strictly necessary in order to be able to determine actual beneficiaries or to prevent fraud;

5.6.2. to administrate and analyse the customer base in order to improve the availability, selection, and quality of the services and products and in order to be able to provide the best, more fully personalised offers to the customer with their consent;

5.6.3. those identifiers and personal details that are collected when an individual uses the websites, mobile applications, and other services. Poker 360 OÜ uses data that is collected for an analysis of the websites or for an analysis of the mobile and information society services, to ensure and improve functionality, to conduct statistical analyses, to analyse the visitor’s behaviour and user experience, and to provide a better and more personalised service;

5.6.4. to organise campaigns, including personalised and directed campaigns, to conduct customer and visitor satisfaction surveys, and to measure the efficiency of the marketing activities that are being carried out;

5.6.5. to analyse the behaviour of the customer or the visitor in various sales channels and on the websites;

5.6.6. monitoring the customer service – Poker 360 OÜ may record notices or orders that are communicated with the company’s premises or via a means of communication (such as email, telephone, etc), as well as other information and operations that are communicated or carried out by Poker 360 OÜ, and may use the recordings to prove that such orders have been placed or other operations carried out if this proves to be necessary;

5.6.7. for the purposes of the network, information, and cyber security such as, for example, measures that are implemented in order to combat piracy, to ensure the security of the websites, and to make and store backup copies;

5.6.8. for organisational purposes. Primarily for financial management and for the internal transfer of the personal details by Poker 360 OÜ within the group for internal administration purposes which include processing customer or employee personal details;

5.6.9. to draw up, submit, or defend legal claims.

5.7. In order to fulfil those obligations which are imposed by legal requirements, Poker 360 OÜ processes personal details so that it can carry out its legal obligations or so that it is able to exercise the usage that is permissible under legal requirements. For example, legal requirements prescribe the obligations that are present in the processing of payments or in observing rules that are related to money laundering.

5.8. If personal details are processed for purposes other than those for which they were initially collected or those purposes are not based on the consent that was granted by the data subject, Poker 360 OÜ will carefully assess the permissibility of any such processing. The intended new purpose behind any such processing is always publicly accessible via the register of processing operations (see article 13: ‘Important documents, instructions, and procedures’). In order to determine whether or not processing for the new purpose is compliant with the purpose for which the personal details in question were initially collected, Poker 360 OÜ will take various points into consideration as follows, amongst other things:

5.8.1. the connection between the purpose for which the personal details were collected and the purpose behind the planned further processing;

5.8.2. the context for the collection of the personal details, especially the connection between the data subject and Poker 360 OÜ;

5.8.3. the category of the personal details, especially regarding whether those personal details that have been processed are of a special category or if they are related to criminal convictions or offences;

5.8.4. the potential consequences for the data subjects of any planned further processing;

5.8.5. the existence of relevant protective measures which may include encryption or pseudonymisation.

6.1. Poker 360 OÜ cooperates with individuals to whom Poker 360 OÜ may transfer data within the framework and for the purposes of any cooperation agreement that may be in place, with such data being related to the data subjects, including their personal details.

6.2. Such third parties may include parties which are included within the same group as Poker 360 OÜ, or advertising and marketing partners, those companies which organise customer satisfaction surveys, debt collection companies, credit registers, and IT partners, or individuals, authorities, and organisations which mediate or provide email or postal services, provided that:

6.2.1. the respective purpose behind the use of the data and the act of processing that data are both legal;

6.2.2. the personal details are processed based on instructions that have been issued by Poker 360 OÜ and which are based on a valid contract;

6.2.3. the details of such data processors have been disclosed to the data subjects (see article 13: ‘Important documents, instructions, and procedures’).

6.3. Poker 360 OÜ only transfers personal details outside of the European Union under the following circumstances:

6.3.1. the European Commission has decided that the country in which such personal details will be received has adequate protection ensured;

6.3.2. Poker 360 OÜ has implemented sufficient protective measures (such as ensuring that the group’s internal rules are binding or that standard data protection clauses are valid);

6.3.3. the data subject has granted clear consent for the transfer of their personal details after being notified by Poker 360 OÜ of the potential risks of such a transfer which may arise from a lack of a decision regarding the adequacy of protection or of the potential absence of relevant protective measures;

6.3.4. the transfer is required for the performance of a contract that has been entered into between the data subject and the data controller or for the implementation of pre-contractual measures which are based upon an application that has been filed by the data subject;

6.3.5. the transfer is necessary for the entry into or the performance of a contract between the data controller and another natural or legal person in the interests of the data subject;

6.3.6. the transfer is required for compelling reasons which may arise from a position of public interest;

6.3.7. the transfer is required for drawing up, the submission, or defending legal claims;

6.3.8. the transfer is required in order to protect the significant interests of the data subject or other persons if the data subject is physically or legally unable to provide consent;

6.3.9. such details are transferred from a register which is designed for the notification of the public pursuant to the legal requirements of the EU or the Member State and are accessible either by the wider public or by anyone who can prove that they have a legitimate interest, but only to the extent to which the terms and conditions for providing access to such details are prescribed by the legal requirements of the EU or the Member State and these can be fulfilled in the specific case;

6.3.10. the transfer is not repeated, it only involves a limited number of data subjects, it is required to protect the legitimate interests of Poker 360 OÜ which are not outweighed by the interests, rights, or freedoms of the data subject, and if all circumstances which are related to the transfer have been assessed and suitable protective measures have been implemented to protect the personal details in question. Poker 360 OÜ notifies the Estonian Data Protection Inspectorate of such transfers.

6.3.11 Poker 360 OÜ is the data controller. Poker 360 OÜ transfers those personal details that are required for making payments to the following data processor: Maksekeskus AS.

7.1. Poker 360 OÜ only retains personal details for the strict minimum period of time required. Information on the retention periods for personal details can be found in Poker 360 OÜ’s register of processing operations (see article 13: ‘Important documents, instructions, and procedures’). Following the expiry of the retention period, the personal details are destroyed by using best practice methods and pursuant to the respective procedure that has been established by Poker 360 OÜ.

7.2. Poker 360 OÜ has established the instructions and rules of procedure in order to ensure the security of the personal details by implementing organisational and technical measures (see article 13: ‘Important documents, instructions, and procedures’). Further information about the security measures that are implemented by Poker 360 OÜ can also be obtained from the Data Protection Officer of Poker 360 OÜ.

7.3. In the event of any incident which may be related to the personal details, Poker 360 will implement all measures that are necessary in order to mitigate the consequences of any such incident and to decrease the relevant risks in the future. Among other things, Poker 360 OÜ records all incidents and notifies the Data Protection Inspectorate and the data subject of any related incident, either directly (eg. by email) or publicly (eg. through the news).

8.1. The services that are provided by Poker 360 OÜ, including its information society services, are not designed for use by children.

8.2. Poker 360 OÜ does not knowingly collect data regarding persons who are under thirteen years of age and, in the event that it would knowingly do so, it will proceed based on the wishes of the parent or guardian (including gaining consent for having magazines addressed to a child).

8.3. If Poker 360 OÜ becomes aware that it has collected personal details from a child or about a child, Poker 360 will make the maximum effort to stop any processing of such personal details.

9.1. Those rights which are related to consent are as follows:

9.1.1. the data subject may at any time notify Poker 360 of their intention to withdraw their consent where this has been granted for processing their personal details.

9.1.2. any consent which has been granted to Poker 360 OÜ can be viewed, amended, or withdrawn by contacting Poker 360 OÜ. The contact details can be found in article 15 of this privacy policy.

9.2. The data subject also has the following rights in connection with the processing of their personal details:

9.2.1. the right to receive information or the data subject’s right to receive information about personal details that have been collected about them. The data subject can access information in Poker 360 OÜ’s register covering its processing operations (see article 13: ‘Important documents, instructions, and procedures’), which also includes further information on how they can exercise their right to access information. Other sources of such information are also available.

9.2.2. The right to acquaint oneself with information which includes, among other things, the data subject’s right to be able to receive a copy of those of their personal details that are being processed. Among other things, the customer can acquaint themselves with the personal details that have been collected by Poker 360 OÜ.

9.2.3. The right to correct inaccurate personal details. Among other things, the data subject can correct inaccurate data (see article 13: ‘Important documents, instructions, and procedures’).

9.2.4. The right to be able to delete the data: ie. in certain cases, the data subject may request the deletion of their personal details such as, for example, where such details are being processed based only on consent having been provided.

9.2.5. The right to request a restriction in the processing of personal details. This right will arise under various circumstances such as, for example, if the processing of such personal details is not permitted under legal requirements or if the accuracy of the data is challenged by the data subject. The data subject may request a restriction of the processing of their personal details for a period of time which enables the data controller to verify the accuracy of the personal details. This right can also be exercised if the processing of the personal details is unlawful, but the data subject does not request a deletion of their personal details.

9.2.6. The right to transfer the data: ie. in certain cases, the data subject has the right to have their personal details transferred to them or to another data controller in a machine-readable format.

9.2.7. Those rights which are related to automatic processing refer to, among other things, the fact that the data subject may, based on their specific situation, object at any time to the processing of their personal details based on automated processes. To clarify, Poker 360 OÜ may process their personal details in order to be able to make automated decisions which serve to promote its business (such as the segmentation of visitors in a marketing context and sending customised messages to visitors, or within the context of beginning an employment relationship, or in order to ensure that our employees follow our internal security rules). Automated processing may also partly be based on data which originates from public sources. Customers may prevent any decision-making that is based on automated data processing if this can be categorised as profiling;

9.2.8. The right to receive an assessment by the supervisory authority on whether or not the processing of the data subject’s personal details is lawful;

9.2.9. The right to receive compensation for damages if the processing of personal details results in the occurrence of any damages to the data subject.

10.1. The process of exercising one’s rights covers the following points:

10.1.1. The data subject may address any questions, requests, or complaints which are related to the processing of their personal details to Poker 360 OÜ or to the Data Protection Officer at Poker 360 OÜ by using the contact details specified in article 14.

10.1.2. Poker 360 OÜ also encourages the data subjects to use the website as a starting point when it comes to finding answers to questions where these are related to their personal details.

10.2. Submitting complaints:

10.2.1. If the data subject believes that their rights have been violated by the processing of personal details, the data subject may address their complaints to Poker 360 OÜ or can file them with the Data Protection Inspectorate or through the courts.

10.2.2. The contact details of the Estonian Data Protection Inspectorate can be found in the inspectorate’s website at: http://www.aki.ee/et/inspektsioon/kontaktid-nouandetelefon.

11.1. Poker 360 OÜ may collect data about visitors to the websites or other information society services by using cookies (ie. small fragments of text which are saved by the visitor’s browser on the hard disc of the visitor’s computer or another device) or other similar technologies (eg. IP address, device information, or location data), and may process any such data.

11.2. Poker 360 uses that data which is collected in order to enable the provision of the service based on the visitor’s or customer’s habits, to ensure the best quality of the service, to notify the visitor and the customer of the content, to recommend content, to update advertising provision, to increase the efficiency of marketing efforts, and to facilitate logging and data protection. Any data which is collected can also be used to count visitor numbers and to record the usage habits of those visitors.

11.3. Poker 360 uses session, permanent, and advertising cookies. Session cookies are automatically deleted after each visit; permanent cookies are retained for the repeated use of the website, and advertising cookies and third parties cookies are used by the websites of the partners of Poker 360 OÜ which are connected to the Poker 360 OÜ website. Poker 360 OÜ does not check on how such cookies are generated and, therefore, information about such cookies can be obtained from third parties. Please read the explanatory documents to learn more about cookies (see article 13: ‘Important documents, instructions, and procedures’).

11.4. Visitor consent for the use of cookies on the website, under the settings for an information society service, or via the web browser.

11.5. Most browsers permit cookies. The visitor is unable to use all of the website’s functionality without fully permitting cookies. The visitor can control cookie permissions via their web browser settings, or through the information society services settings, and via such platforms which serve to improve privacy levels (see article 13: ‘Important documents, instructions, and procedures’).

12.1. Important contact details for Poker 360 OÜ’s data subjects:

12.1.1. Poker 360 OÜ can be contacted concerning personal details-related issues by emailing info@poker360.ee or by calling 5620 1385.

13.1. Poker 360 OÜ has the right to unilaterally amend this privacy policy. Poker 360 will notify the data subjects of any such amendments via the Poker 360 website, via email, or in another manner.

13.2.  The date for the final amendment of the privacy policy and the entry into force of any amendments:

Published on: 04.07.2018

Applicable to new and existing visitors and customers as of 04.07.2018