Processing personal data

• Eliis Tarkvara OÜ (hereinafter "Eliis") processes the following personal information for the purpose of personal identification and communication:

  • Name and surname of ELIIS user;

  • ELIIS user identification code;

  • Contact information of ELIIS user - telephone number, home address, e-mail address.

• Personal data is processed as necessary to provide the ELIIS service. For details on how data is used, see the relevant sections below.

• If the user is not involved in any role (municipality official, parent, kindergarten director, teacher, caterer, etc.) and does not have any pending applications for role-based entitlements, the user's account will automatically be deleted from ELIIS after 12 months of inactivity.

• ELIIS users' data is stored for up to 7 (seven) years.

• Eliis is not responsible for the accuracy, completeness and relevance of the information entered by the ELIIS user.

• The kindergarten that has entered data in ELIIS is the data controller of the entered data. Eliis is the data processor.

• As part of its core functionality, ELIIS records and processes data about children, including attendance records, diary entries, meal information, developmental observations, and related administrative data. The kindergarten is the data controller for all data entered about children in their care. Parents and guardians may contact the kindergarten directly for questions about their child's specific data. Eliis does not use children's data for any purpose beyond providing the ELIIS service to the kindergarten.

• Eliis does not give out or transmit personal information to third parties, except if:

  • such an obligation is required by law;

  • it is required to resolve a request;

  • the person has given his/her consent.

• The user has the right to withdraw consent at any time by submitting a signed request to info@eliis.eu.

• Withdrawal of consent does not affect the lawfulness of processing that took place prior to the withdrawal.

• Notwithstanding the withdrawal of consent, Eliis may continue to process personal data if there is another legal basis for doing so.

Legal basis for processing

• Eliis processes personal data on the following legal bases under Article 6 of the General Data Protection Regulation (GDPR):

  • Performance of a contract (Art. 6(1)(b)) — processing of account data (name, identification code, contact information) necessary to provide access to the ELIIS service;

  • Legal obligation (Art. 6(1)(c)) — processing required by applicable law, including retention of data for accounting and record-keeping purposes;

  • Legitimate interests (Art. 6(1)(f)) — processing for security, fraud prevention, system integrity, and activity logging, where these interests are not overridden by the user's rights;

  • Consent (Art. 6(1)(a)) — processing for optional communications such as service-related email notifications. Consent may be withdrawn at any time in "My Settings" in ELIIS.

• Data entered by kindergartens about children and staff is processed by Eliis as a data processor on behalf of the kindergarten (data controller), who is responsible for ensuring an appropriate legal basis exists for that processing.

User's data protection rights

• ELIIS user has the following rights regarding the processing of personal data:

  • the right to request access to personal data concerning himself/herself;

  • the right to request rectification of data;

  • the right to request the deletion of data;

  • the right to restrict the processing of personal data;

  • the right to object to the processing of personal data;

  • the right to file a complaint to the Data Protection Inspectorate;

  • the right to receive personal data in a portable format and transfer it to another controller;

  • the right not to be subject to a decision based solely on automated processing — Eliis does not use automated decision-making or profiling that produces legal or similarly significant effects on users;

• The use of the above rights is subject to the conditions and limitations arising from the General Data Protection Regulation of the European Union.

• To exercise a right, the user must submit a written or electronic request to info@eliis.eu specifying which right is being invoked. If necessary, Eliis will ask the user for additional information to fulfil the request.

• If the preconditions for the use of the right are met, Eliis shall fulfil the request within 1 (one) month of receipt. If necessary, Eliis may extend this deadline by 2 (two) months by notifying the user.

• If Eliis has grounds to refuse the request, Eliis will send a reasoned refusal decision within 1 (one) month.

• Regarding your child's data: As a parent or guardian, you may exercise data subject rights on behalf of your child. Since the kindergarten is the data controller for data entered about your child in ELIIS, requests relating to your child's data should be directed to the kindergarten. Eliis can assist where the data is processed directly by Eliis.

Security

• Eliis takes your privacy and personal data protection very seriously. We keep our employees and people responsible for administering ELIIS up to date with our privacy principles.

• ELIIS is hosted on Amazon Web Services (AWS) infrastructure located in the European Union. AWS acts as a subprocessor and processes data solely to provide hosting services. Data stored in ELIIS does not leave the EU as part of core hosting operations.

• To protect ELIIS from unauthorized access, modification, breach, or disclosure, we use SSL to encrypt all data in transit. This ensures that all data between the user's computer or mobile device and ELIIS servers is securely encrypted.

• By entering someone else's e-mail address in your profile, you could make your account and personal information visible to that person. We recommend carefully checking the accuracy of your personal information.

Cookies

• ELIIS uses text files called cookies to enhance user-friendliness, assist with navigation, keep track of session data, and help Eliis with service planning.

• A cookie is a small text file that the ELIIS web server sends to the user's web browser and is stored on the user's computer or smart device. Cookies allow the user's preferences (for example, language selection) to be remembered.

• ELIIS uses the following cookies:

  • Functionality and Performance Cookies - These cookies support the functioning and functionality of the ELIIS website. Using these cookies, the website identifies the user and, if you wish, remembers the customer login information.

  • Analytical Cookies - Google Analytics is used to collect user statistics. Google Analytics is operated by Google LLC, based in the United States. Data collected via analytical cookies may be transferred to and processed in the United States. This transfer is governed by Google's Data Processing Terms and Standard Contractual Clauses approved by the European Commission. For more information, see Google's Privacy Policy.

  • Cookies used for Multimedia presentations, that record the technical information needed to play video or audio, such as image quality, network connection speed, and buffering parameters.

• Users have the right to refuse cookies. If desired, the user must modify the settings of his/her web browser.

• When blocking cookies, the user must take into account that some ELIIS features may no longer be available.

Changes to this policy

• This Privacy Policy is updated from time to time as the service and applicable law evolve. The latest version is always available on this site. Users will be notified of material changes by email or via a notice in ELIIS.

Questions

• If you have any questions or concerns about your privacy, this Privacy Policy or cookies used in ELIIS, you can contact us by e-mail info@eliis.eu.