Personal Data

Personal data means any information relating to an identified or identifiable natural person that reflects that person’s physical, psychological, physiological, economic, cultural or social characteristics, relationships and affiliations.

Please note: The information below does not cover:

the processing of personal data on websites linked from the website of the Estonian National Museum but not operated by the Estonian National Museum (external links).

the processing of data relating to legal persons and institutions, or the processing of a natural person’s data where such data are processed in connection with that person’s professional duties;

Legal Bases for Processing Personal Data

The Estonian National Museum processes personal data on the following legal bases:

a legal basis, including a statutory obligation or task;
performance of a contract;
the legitimate interest of the controller;
for journalistic purposes where there is a public interest;
for the purposes of academic, artistic and literary expression;
recording in a public place;
debt-related data where there is a legitimate interest;
for the protection of life, health, property, rights and freedoms, including security cameras; for research and statistical purposes;
consent, including the principle that data collected for one purpose will not be used for a new purpose without fresh consent. Consent may be withdrawn.

Processing of Personal Data at the Estonian National Museum

In the course of our work, we collect personal data, including sensitive and private information. Through our internal working arrangements, we seek to ensure that your privacy is infringed as little as possible.

Video Recordings

Video recording is carried out on the premises and grounds of the Estonian National Museum for security purposes. The data are processed by the security service provider, and access to the recordings is granted only to those persons for whom such access is necessary for the performance of their duties. Recordings are generally retained for up to 30 days.

Online Shop

Personal data used when making purchases from the Estonian National Museum’s online shop are treated as confidential information. Customer data are used solely for the purpose of fulfilling orders and are not disclosed to third parties, except where necessary for the performance of the order or where required, on a proper legal basis and in the form prescribed by the legislation of the Republic of Estonia.

At the final stage of placing an order, the customer is directed to a reliable certified card payment system to make payment. Secure data transmission channels are used there, and your data are protected.

Website

When visiting the website, the data collected and stored about the visitor are limited to:

the IP address of the computer or computer network being used;
the name and address of the internet service provider of the computer or computer network being used;
the time of the visit (time, date, year).

IP addresses are not linked to information that identifies an individual. Data are collected regarding which parts of the website are visited and how long visitors stay there. The data collected are used to compile visitor statistics in order to develop the website and make it more convenient for visitors.

The Museum’s website may contain links to other websites that do not belong to the Estonian National Museum, and we are not responsible for the privacy policies of such websites.

Applying for a Job or Internship at the Estonian National Museum

All documents related to an application contain personal data (for example, the application together with accompanying documents, correspondence with the applicant, and information gathered about the applicant from public sources). The applicant has the right to know what data the Museum has collected about them. The applicant also has the right to review the data collected by the Museum, to provide explanations, and to raise objections.

At the Museum, only a very limited number of employees involved in the recruitment process may review application documents. These documents and data are not disclosed to third parties. The Museum guarantees confidentiality to applicants, but assumes that it may communicate, without requesting additional permission, with persons whom the applicant has named as referees.

Applicants’ data are information subject to restricted access, and third parties, including competent authorities, may gain access to them only in cases provided for by law.

Likewise, in the case of other competitions (for example, scholarship competitions), information about a person’s participation in the competition is not disclosed, except in the event of a positive decision.

The Estonian National Museum grants access to applicants’ documents only to persons involved in the decision-making process of the competition.

Applications for positions at the Estonian National Museum, together with accompanying documents, are retained for one year after the end of the recruitment competition, with the applicant’s consent.

Correspondence, Enquiries and Applications

All submitted enquiries contain personal data (for example, name, contact details, a description of issues relating to the individual, etc.). Personal data may also be contained in letters received from other institutions (for example, a copy of a reply to a person’s enquiry).

Personal data are used for responding to enquiries. Where it is necessary to make an enquiry to a third party for that purpose, personal data are disclosed only to the minimum extent necessary. Correspondence with private individuals is generally subject to restricted access. If someone wishes to inspect a person’s correspondence and submits an information request, the content of the letter is reviewed and a decision is made as to whether the document can be disclosed in part or in full. Personal contact details, such as address or telephone number, are removed from any document that is disclosed. In other cases, restriction of access depends on the content of the document. The possible legal grounds for restricting access are set out in the Public Information Act. Documents subject to restricted access are disclosed only to those authorities and persons who have a direct legal right to receive them under the law (for example, a pre-trial investigator or a court). Enquiries and letters addressed to the Museum are retained in accordance with the institution’s records management procedures. Documents exceeding their retention period are destroyed.

Complaint or Challenge

When submitting a complaint or a challenge, you should also take into account that, in some cases, your personal data, in particular your name and the fact that you submitted a complaint or challenge, and in certain cases also the content, may become known to third parties, or your name and the fact of the complaint or challenge may be published in our document register. In accordance with the Public Information Act, the correspondence data published there include the name of the sender and recipient and the type of letter: “Complaint” or “Challenge”. If you express a clear wish, your first name and surname will not be entered in the document register; instead, only initials or the notation “Private individual” will be used.

In the public part of the document register, the full title or subject area of a letter containing sensitive information is not indicated; only “Complaint” or “Challenge” is shown. Correspondence with a private individual is subject to a general restriction on access: if someone wishes to inspect your correspondence and submits an information request for that purpose, we assess whether partial or full disclosure of your complaint or challenge, and of the reply, would significantly infringe your privacy, or whether your complaint or challenge and the reply contain other information subject to restricted access. The legal grounds for restricting access are laid down in section 35 of the Public Information Act. Your personal contact details, such as email address, telephone number or home address, are not disclosed, except where you represent a legal person or an institution.

The personal data contained in your complaint are used to resolve the complaint. If, in this connection, enquiries must be made to other persons or institutions, no more of your personal data are disclosed to them than is necessary for preparing the response.

Processing of Personal Data on the Basis of Legislation

The Estonian National Museum uses the Museum Information System (MuIS), in which personal data are processed on the basis of legislation.

The purpose of the information system is to enable:

the uniform and electronic registration, as museum objects, of items of cultural value in accordance with the prescribed procedure;
the centralised and systematic storage of data collected, upon admission to the museum and during subsequent research work, concerning museum objects, items of cultural value deposited with the museum for more than one year (hereinafter: deposited items), and items included in the auxiliary collection;
the electronic registration of operations performed with museum objects, deposited items and items included in the auxiliary collection, as well as changes in their condition and location;
the free presentation to the public, through a web interface, of museum objects and deposited items.

Right of access to one’s data. Right to request rectification and erasure of inaccurate data. Right to data portability.

Everyone has the right to access personal data collected about them. If the personal data have not been published on the website, a request may be submitted in order to obtain the data, provided that it is digitally signed by the person concerned, i.e. the person must be identifiable. Where possible, the data are provided in the manner requested by the applicant within five working days of registration of the request. If the personal data are subject to restricted access, the Museum must verify the identity of the applicant. For paper copies, a fee of up to EUR 0.19 per page may be charged starting from the 21st page issued. A request will be refused if compliance with it could:

harm the rights and freedoms of another person;
hinder the prevention of a criminal offence or the apprehension of an offender;
make it more difficult to establish the truth in criminal proceedings;
endanger the protection of the confidentiality of a child’s parentage.

Everyone has the right to request the rectification of inaccurate personal data concerning them.

“Data provided” should be understood as all data that a person provides directly, either personally or through some activity of that person resulting in the data being transmitted to the processor. If the data processor has carried out various analyses on the data provided by the person and has created new value-added data, those data do not fall within the scope of the right to data portability. Data portability applies only to data where the legal basis for processing is either the person’s consent or a contract concluded between the person and the data processor.

Accordingly, where data processing is carried out solely on the basis of law, the right to data portability does not apply. Only those personal data that the processor processes by automated means are subject to portability. For example, personal data existing only on paper do not fall within this category. A person may also require one data processor to transmit the data directly to another data processor, where this is technically feasible.

Data Protection Specialist

For all questions related to the processing of your personal data at the Estonian National Museum, you can obtain an answer by sending an email to andmekaitse@erm.ee.