Privacy Policy

Personal Data Processing by OÜ Torni Hostel

1. General Provisions

1.1. For the purposes of this procedure, the responsible personal data processor is OÜ Torni Hostel (hereinafter: hostel), reg. code 11136278; address Fr. R. Kreutzwaldi 52, 51006 Tartu; email roland@rohemucampus.ee.

1.2. The hostel processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679, the Personal Data Protection Act, and other applicable legislations.

1.3. The hostel adheres to the principles set out in § 6 of the Personal Data Protection Act when processing personal data.

1.4. The hostel confirms that the hostel employees who, due to their duties, handle and process personal data:

1.4.1. have familiarized themselves with this procedure;

1.4.2. keep confidential any personal data or information about individuals that they become aware of while fulfilling their work assignments.

2. Definitions Used in the Procedure

Personal data is data of an identified or identifiable natural person, regardless of the form or manner in which it is presented.

Sensitive personal data is personal data that, if disclosed, could significantly harm the privacy of the individual.

Data subject is a natural person whose personal data is being processed.

Processing of personal data includes any operation performed on personal data, such as collection, storage, organization, maintenance, modification, disclosure, access, inquiry, extraction, use, transmission, cross-use, combination, closure, deletion, or destruction, or multiple such operations, regardless of the method or means of performing these operations.

Responsible processor is an employee who determines the purposes and means of processing personal data.

Authorized processor is a person who processes personal data on behalf of the responsible processor. An authorized processor is usually an external third party.

3. Purpose and Actions for Processing Client Personal Data

3.1. The purpose of processing personal data is to create and execute a rental contract, including preparing and signing the contract, realizing rights arising from the contract, and fulfilling obligations arising from the contract.

3.2. The hostel asks the client only for the personal data necessary for concluding and executing the contract (first and last name, gender, personal identification code, date of birth, nationality, phone number, home address, email address, educational institution, specialty and course, IBAN account number, and for foreign students, foreign employees, or guests, SWIFT (BIC) code, bank’s and account holder’s details).

3.3. Personal data is processed for the following purposes:

3.4. Access to personal data processing and modification is limited to only hostel employees who need it for their work. Client personal data is handled as confidential information.

3.5. The hostel retains client personal data as long as it is deemed necessary to fulfil/achieve the purposes or as required by law.

3.6. The hostel does not disclose personal data to third parties without the client’s consent, except when required by law.

4. Processing Personal Data During Recruitment and Application Process

4.1. The hostel processes the personal data of applicants during the recruitment and application process, and such data is stored for one year.

4.2. The personal data of a job applicant includes: identifying information (first and last name, date of birth, personal identification code); contact details (email, phone number, home address); data necessary to evaluate the candidate’s suitability for the position (education, qualifications, work experience); nationality; and for foreign nationals, data confirming the right to reside and work in Estonia.

4.3. The selected applicant will be contacted for the purpose of signing an employment contract.

4.4. Applicant data is not disclosed to other applicants or unrelated persons.

5. Personal Data Processed During Employment Contract Conclusion

5.1. The data necessary for concluding an employment contract are specified in the Employment Contracts Act.

6. Personal Data Processed During Employment

6.1. The hostel has the right to request documents containing personal data from the employee in the following cases:

6.1.1. when the employee changes their name (in a form suitable for reproduction);

6.1.2. when the employee wishes to go on parental leave or uses a special leave related to a minor child for the first time (in a form suitable for reproduction, including the child’s first and last name and personal identification code);

6.1.3. employment health-related documents.

Data voluntarily processed by the employee:

6.1.4. data of minors when applying for special leave;

6.1.5. a document confirming partial work capacity loss if the employee wishes to use additional benefits provided by law;

6.1.6. contact person’s phone number, e.g., in case of work accidents.

6.2. The hostel may transfer employee personal data to third parties if required by law.

6.3. Access to personal data for processing is granted only to individuals who have a contractual or legal obligation to process personal data.

6.3.1. The hostel may use authorized processors for data processing and it ensures that personal data is processed according to the hostel’s instructions, implementing appropriate security measures.

7. Use of Photographs

7.1. The hostel may take and publish photographs of itself in the hostel website’s photo gallery or on social media associated with the hostel.

7.2. Any other recording via photo or video, which is not of a public or publicly directed nature, including the purpose of using the recorded material, must be agreed upon in advance among the participants, and no participant’s image may be shared without their consent.

7.3. Hostel employees do not share photos, videos, or audio recordings of clients and guests.

8. Use of CCTV Cameras

8.1. Individuals are informed about the use of CCTV cameras by signage at the hostel’s external doors (camera image and the text “video surveillance”).

8.2. CCTV cameras are installed based on the principle of minimalism, and the collected data is used and processed solely for its collection purpose. The purpose of CCTV use in the hostel is to protect property and ensure safety.

8.3. Hostel employees monitor live footage from CCTV cameras intermittently or when a real threat occurs.

8.4. The hostel discloses video recordings to third parties (e.g., law enforcement agencies) only upon formal request and/or legal obligation.

8.5. Recordings are stored according to the capacity of the recording system.

9. Data Subject Rights

9.1. The data subject (client, employee) has the right to access personal data collected about them and, if necessary, request correction or supplementation of inaccurate data.

9.2. If the processing of data is based on consent, the data subject has the right to withdraw it at any time. This does not affect data processing performed before the withdrawal.

9.3. More information about data protection can be requested at roland@rohemucampus.ee.