Datenschutzrichtlinie

1. Privacy Protection Principle

The purpose of this Privacy Policy is to define the actions in terms of processing and protection of personal data collected in connection with the provision of services electronically on the transactional platform available at the domain caret.pro by the company CARET EUROPE OÜ, based in Tallinn at Lõõtsa tn 2b 11415 Tallinn Estonia, entered into the register at the District Court in Harju province under number 16624843, with a share capital of 1.002.50000 EUR, having tax identification number: EE102562446 (hereinafter referred to as „Administrator“ or „Company“).

We have designated a Data Protection Officer who can be contacted at [email protected].

The Administrator carefully selects and applies appropriate technical and organizational measures to ensure the protection of the processed personal data. Personal data related to Users and other persons whose data has been reported by the User are protected by the Administrator against their disclosure to unauthorized persons and other cases of disclosure or loss or unauthorized modification of the indicated data and information.

2. Purpose, Scope, and Legal Basis of Personal Data Processing

Personal data is processed by the Administrator in accordance with the law and exclusively for purposes related to its activities, including:

Scope	Purpose and Legal basis of Personal Data Processing
Activities aimed at concluding and implementing the contract and conducting business:	Performing activities related to the conclusion and execution of an electronic service contract on the terms set out in the Terms and Conditions for Buyers or Terms and Conditions for Sellers (based on Article 6(1)(b) GDPR) in particular: Taking actions related to the user registration/account setup Providing electronic services in terms of user account management Providing electronic services in connection with the management of sales contracts concluded by Users via the caret.pro platform  Contacting Users in matters related to the provided services Ensuring traffic safety on the caret.pro platform, counteracting abuses, frauds Undertaking actions before concluding a contract, in particular delivering an offer at the request of the person whose data it concerns Establishing business relationships, including responding to questions in connection with user contact (based on Article 6(1)(f) GDPR in connection with the realization of legally justified interests of the Administrator consisting in responding to directed inquiries) Contact with the User’s employees (based on Article 6(1)(f) GDPR in connection with the provision of electronic services) Providing newsletter service (based on Article 6(1)(b) GDPR) Fulfilling a legal obligation incumbent on the Administrator regarding tax and accounting obligations (based on Article 6(1)(c) GDPR in connection with tax and accounting regulations) Considering and handling complaints (based on Article 6(1)(b, c, or f) GDPR in connection with the necessity for the Administrator to fulfill the contract concluded with you, fulfill a legal obligation, and in connection with the legally justified interest of the Administrator, which is defense against claims) Marketing of products or services of own or third parties, including displaying contextual or behavioral advertising, contacting users, enabling participation in competitions, promotional actions (based on Article 6(1)(f) GDPR in connection with the realization of legally justified interests of the Administrator consisting of caring for the interests of the Administrator and promoting goods or services of the Administrator) Pursuing or securing claims or defense against them (based on Article 6(1)(f) GDPR in connection with the realization of legally justified interests of the Administrator concerning the protection of rights of the Administrator and User) Archiving data after closing the User’s account (based on Article 6(1)(c) GDPR in connection with legal regulations and on the basis of Article 6(1)(f) GDPR for data stored in archives and security copies – legally justified interest is pursuing claims or protection against such claims and ensuring data integrity in IT systems) Providing data is a requirement for registration (setting up a User Account) is voluntary but necessary to provide electronic services within the transactional platform available at the caret.pro domain. Some processing activities within the provision of services are legally regulated, their provision is necessary to provide services and fulfill legal obligations by the Administrator.
Other Processing Based on Consent	For purposes each time specified in the content of the consent (Article 6(1)(a) or Article 9(2)(a) of the GDPR). Providing data is voluntary but necessary to achieve the objectives specified in the content of the consent. Consent can be withdrawn at any time in the manner specified by the Administrator when obtaining the consent. The withdrawal of consent does not affect the legality of the processing carried out before its withdrawal.
Delivering the Website	Researching user preferences and behaviors on the caret.pro website using cookie technology (Article 6(1)(a) of the GDPR), Conducting statistical and analytical activities, including activity analysis, traffic management on the caret.pro website (based on Article 6(1)(f) of the GDPR in connection with the implementation of legally justified interests of the Administrator regarding optimization within the caret.pro domain), Creating a User profile and sending personalized advertising (Article 6(1)(a) of the GDPR), Technical content delivery, maintenance, and technical support of the service, ensuring service security, preventing fraud, and rectifying errors, adapting the service to user needs (Article 6(1)(f) of the GDPR), Communication of the Administrator with Users on matters related to the operation of the site and data protection based on your consent (Article 6(1)(a) of the GDPR) or in order to take actions that you have requested before setting up a User Account (Article 6(1)(b) of the GDPR) or if we are obligated to fulfill a legal obligation on us, e.g., to implement your rights related to personal data protection (Article 6(1)(c) of the GDPR), Conducting online chat conversations using software installed on the website based on your consent (Article 6(1)(a) of the GDPR) or in order to take actions that you have requested before setting up a User Account (Article 6(1)(b) of the GDPR). Providing data is voluntary, but necessary to achieve the above-mentioned purposes. Details on the use of cookies can be found in the Cookie Policy.
Newsletter	Sending a newsletter containing marketing content to your email address, based on your consent (Article 6(1)(a) of the GDPR or if processing is necessary to implement the legally justified interest of the Administrator, in this case, informing about news and promotions (based on Article 6(1)(f) of the GDPR)).
Marketing	Distribution of personalized or general marketing communications and information about offers within our services, website, third-party online platforms including on social media portals, in accordance with applicable legal regulations based on your consent (Article 6(1)(a) of the GDPR).
Social Media	Responding to a question asked or a message sent, based on consent, i.e., Article 6(1)(a) of the GDPR, Sending information, including marketing content, if you have given your consent, based on Article 6(1)(a) of the GDPR, Responding to an inquiry about an offer or responding to an offer sent to us and carrying out actions that you have requested, based on Article 6(1)(b) of the GDPR, Creating a user profile and sending personalized advertising (Article 6(1)(a) of the GDPR). Providing data is voluntary, but necessary to achieve the above-mentioned purposes. There is a so-called joint administration between us and social media platform providers to a certain extent. This means that together with the providers of these platforms, we are responsible for your personal data, and you can exercise your rights under the GDPR against each of the administrators. Details regarding data processing principles on social media can be found in the privacy policies of individual services: LinkedIn Privacy Policy Facebook Privacy Policy Instagram Privacy Policy YouTube Privacy and Terms TikTok Privacy Policy
Recruitment	Conducting the recruitment process (based on Article 6(1)(c) of the GDPR and your Article 6(1)(a) of the GDPR and Article 9(2)(a) of the GDPR for data not covered by the above regulations) and based on your consent, also in subsequent employee recruitments, Providing information about the progress of the ongoing recruitment process – based on your consent (Article 6(1)(a) of the GDPR). Providing data is voluntary, but to the extent specified by the regulations, necessary to participate in recruitments.
Other Processing Based on Legally Justified Interests of the Administrator	Your personal data may also be processed based on Article 6(1)(f) of the GDPR if processing is necessary for the following purposes arising from the legally justified interests pursued by the Administrator: Internal administration and work organization, including conducting internal supervision and reporting (the legally justified interest is to ensure the optimal functioning of the enterprise), Ensuring the security of network and IT processes (the legally justified interest is the protection of people and property), Conducting an assessment of User satisfaction, the Administrator may carry out measurements of loyalty and satisfaction with the services provided by the Administrator, in connection with the optimization of provided services and adapting them to the needs of Users).

 

3. Data Recipients

The recipients of personal data processed by the Administrator may be:

• Entities acting on behalf of the Administrator, responsible for the service of the internet platform caret.pro, and entities providing services in this regard for the Administrator (e.g., companies providing Internet delivery services, entities providing server space), providers of plugins and cookies for the website (such as DoubleClick, Criteo, RTB House, Index Exchange, OpenX);
• companies providing software, in particular: accounting, office (including Microsoft), sales and marketing;
• companies providing maintenance or ITSM services;
• courier and/or postal companies;
• companies providing services in the field of HR and payroll and accounting;
• banks and insurance companies;
• companies providing marketing services;
• companies providing support in employee recruitment;
• in case of giving appropriate consent, these will also include: LinkedIn Ireland Unlimited Company, Meta Platforms Ireland Limited, Google Ireland Ltd., TikTok Technology Limited, and TikTok Ireland

4. Retention Period

Personal data is stored for the period of holding your User Account on the caret.pro platform. After this period, the data may be processed based on the legal obligations of the administrator (e.g., regarding the storage of accounting documents), or a legally justified interest (defense against claims that may be made against the administrator). In the case of processing to respond to a query – for 1 year after the end of correspondence.

5.Control of Personal Data Processing

The Administrator ensures the realization of rights for individuals whose personal data are processed, according to legal provisions, including: the right to access the content of their personal data and receive a copy of them, their rectification, amendment, deletion in situations where processing does not occur to fulfill an obligation arising from the law, data portability, and the right to request a restriction of personal data processing.

You also have the right to object at any time to the processing of personal data based on Article 6(1)(f) of the GDPR. If you object to the processing of personal data for purposes arising from legally justified interests pursued by the Administrator, your personal data will not be processed by us for this purpose. The reason for this objection must be your particular situation, hence when submitting the application, please indicate this particular situation. Upon receiving the objection, we will stop processing your data for the purpose or purposes to which you have objected unless we demonstrate the existence of valid legally justified reasons for processing, overriding your interests, rights, and freedoms, or if we demonstrate grounds for establishing, pursuing, or defending against claims.

In the case of voluntarily giving consent to data processing, each person whose data is processed has the right to withdraw consent to data processing. Withdrawal of consent does not affect the processing which the Administrator performed before its withdrawal.

In all matters regarding personal data processing, you can contact us at: [email protected]. Everyone whose data is processed has the right to lodge a complaint with the Estonian Data Protection Authority (Estonian Data Protection Inspectorate, 39 Tatari St., 10134 Tallinn).”

6. Principles of Transferring Your Personal Data Outside the EEA

Except in cases of explicit consent, your personal data are not transferred to recipients in third countries, i.e., outside the European Economic Area (EEA), or to international organizations.

If appropriate consent is given, personal data may be or will be made available to LinkedIn Ireland Unlimited Company, Meta Platforms Ireland Limited, Google Ireland Limited, TikTok Technology Limited, and TikTok Ireland (Services). Due to the transnational nature of data flow within these Services, there is a transfer of your data outside the EEA, including to countries for which the European Commission has not determined an adequate level of protection.

Data protection in the case of Meta Platforms Ireland Limited and Google Ireland Limited is ensured by an appropriate certificate, on the basis of which the European Commission, in accordance with Article 45 of the GDPR, has determined that they provide an adequate level of protection. In other cases, protection mainly consists of the application of Standard Contractual Clauses along with appropriate safeguards (including data encryption). More information on data processing in these Services can be found in the privacy policies of the Services.

LinkedIn Privacy Policy

Facebook Privacy Policy

Instagram Privacy Policy

YouTube Privacy and Terms

TikTok Privacy Policy

Your personal data is processed in this way for marketing purposes (we use marketing tools, social media platforms, and cookies and social plugins on our website) and for maintaining communication with the customer (social media – Facebook, LinkedIn). Data is transferred solely based on your explicit consent.

7. Automated Decision Making, Including Profiling

Based on your personal data, we may perform profiling and make automated decisions (about displaying advertisements) as referred to in Articles 22(1) and 4 of the GDPR. This can take place on the caret.pro website. Profiling is performed for the marketing of our own services.

LEGAL INFORMATION

Trademarks and logos presented on the caret.pro website are protected by law and international agreements, and their use without appropriate consent is prohibited.

All works (in particular: photos, texts, catalogs, graphics) presented on the caret.pro website are legally protected, and their use without the prior written consent of CARET EUROPE OÜ is strictly prohibited.

This information does not violate the absolutely binding legal provisions, in particular regarding competition protection. In case of contradiction between the provisions of this information and absolutely binding legal provisions, those provisions shall apply, and the rest of the information remains valid.

Contents provided by CARET EUROPE OÜ do not constitute an offer in the sense of the Civil Code, but only an invitation to negotiations.