Processing Personal Data
Contact details of the data protection specialist at the National Library of Estonia:
andmekaitse@nlib.ee
+372 630 7131
Data Protection Officer
National Library of Estonia
Narva Road 11, 15015 Tallinn
Estonia
-
1.1. Personal data are any data that enables to identify a natural person. Processing of personal data at the National Library of Estonia (hereinafter National Library) is any act performed with personal data, except for the operations carried out with the data of legal persons and the processing of personal data on the web pages that have been cited on the library’s web pages (external links).
1.2. Special categories of personal data include personal data that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purposes of uniquely identifying a natural person, data concerning heath, and data concerning a natural person’s sex life or sexual orientation.
1.3. The National Library processes personal data to the extent necessary for the achievement of purposes of processing personal data in compliance with the Personal Data Protection Act of the Republic of Estonia and the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
-
2.1. The Rules for Users of the National Library regulate the registration of its users and the the services limited to its registered users.
2.2. The National Library receives the personal data of its user personally from the user, dependent on the used service, and from the Population Register when checking the right of representation and in the case of legal claim. Dependent on the service and the choices of the user of the service, the National Library may process the following data:
2.2.1. the data for identifying the person, including the person’s name, personal identification code or the date of birth, user identifier or the number of library card, username of the social media account, the number of ID card;
2.2.2. contact details, including e-mail address, telephone number, and postal address;
2.2.3. if the user of the service is under guardianship, the data about his or her guardian, including the data for identifying the guardian and his or her contact details;
2.2.4. the data on the area of activity and hobby of the user of the service;
2.2.5. employment data or the data related to the academic studies of the researcher who applies for accessing the personal archives maintained by the National Library, including the name of the educational or employing institution, and the research theme and the academic degree of the researcher.
2.2.6. the data on communication, including data on notification that have been delivered by e-mail or letter, on social mediaon, on chat, on the platform on online meeting or over the telephone;
2.2.7. data on the bookings of individual work and groupwork rooms, including the time of the booking;
2.2.8. the data on the use of the services and user satisfaction, including the data on the services used and the activity of using services, and the feedback of service user;
2.2.9. the data on the offences of the Rules for Users of the National Library, the data on overdue lendings, and on contractual claims;
2.2.10. data on a disability, disorder or illness that prevents reading a printed text.2.3. The National Library may process the personal data of its registered usersfor the following purposes and on the following legal bases:
2.3.1. in order to register as a user and to create and administer the user account and to enable to log in to different databases and IT systems set up for registered users – the processing shall be carried out with the consent of the user of the service;
2.3.2. in order to provide services, send notifications and communicate with the user of the service, including for answering the requests, managing bookings, and informing of the expiration of user’s rights or the arrival of the due date – the processing shall be carried out to perform a concluded contract, or to prepare a contract;
2.3.3. in order to provide the services deisgned for persons with disability, disorder or illness that prevents them from reading a printed text – the processing shall be carried out to perform the duties pursuant to law;
2.3.4. in order to provide access to personal archives – the processing shall be carried out to perform a duty of public interest, to perform a concluded contract or with the consent of the user of the service;
2.3.5. in order to ensure and improve the quality of services, and to develop and enhance the services by asking for feedback – the processing shall be carried out with the consent of the user of the service;
2.3.6. in order to settle disputes on contested complaints and decisions, and to prove, exercise and protect legal claims, including those involving the damage caused by the user of the service who is under guardianship – the processing shall be carried out to perform a concluded contract, or to perform the duties pursuant to law;
2.3.7. in order to perform duties arising from other legislation, e.g. at the request of law enforcement authorities, bailiffs, tax authorities, or courts. -
3.1. In addition to processing the personal data of registered users (see clause 2), the National Library also processes the personal data in the course of providing other services, including using computers or wifi, participating in events, educational programmes or trainings, ordering a newsletter, services provided to publishing houses and other libraries.
3.2. The National Library receives the personal data of the user of the service personally from the user, dependent on the used service, and from the Population Register in the case of a legal claim. The National Library may, dependent on the service and the choices of the user of the service, process the following data:
3.2.1. the data for identifying the person, including the person’s name, personal identification code or the date of birth, the number of ID card;
3.2.2. contact details, including e-mail address, telephone number, and postal address;
3.2.3. data on links with the legal person, inclusing the name of the representative and his or her connection with the legal person or data on self-employed person;
3.2.4. data on services provided and relsted financial data;
3.2.5. data on the bookings of studios, including the time of the booking;
3.2.6. the data on communication, including the content of inquiries, data subject’s requests and information requests that have been delivered by e-mail or letter, on social media, on chat, or over the telephone;
3.2.7. the fact of using the services provided on the online meeting platform, the length of the meeting and the written text on the platform;
3.2.8. photos and other recordings from the events of the National Library, including (e-)trainings and public events;
3.2.9. the data on the participation in games, competitions and campaigns, including prizes won;
3.2.10. upon visiting the part of the building closed to general public, the name of the visitor, the time od the visit and the organisation visited;
3.2.11. data on a car, including the registration number and type of the car;
3.2.12. the data on the use of the services and user satisfaction, including the data on the services used and the activity of using services, and the feedback of service user;
3.2.13. images on security camera recording, descriptions of security incidents and statements by persons involved;
3.2.14. special categories of personal data, including the data on the categories of disability when entering the National Library’s building with a guide dog;
3.2.15. the data collected to perform duties pursuant to law, including the data on the monitoring of the service provided at authorised workstations.3.3. In addition to the purposes and legal bases referred to in clause 2.3, the National Library processes the personal data of the users of the service, inter alia, for the following purposes and on the following legal bases:
3.3.1. in order to provide or acquire services, including for administering orders, communicating with contractual party, organinising trainings, educational programmes and other events and issuing training certificates – the processing shall be carried out to perform a concluded contract or to prepare a contract;
3.3.2. in order to respond to inquiries and to register to trainings, educational programmes and other events organised in the National Library, to enable watching the recording of the events – the processing shall be carried out with the consent of the user of the service;
3.3.3. in order to record audiobooks for persons with the disability, disorder or illness that prevents reading a printed text – the processing shall be carried out to perform a concluded contract or to prepare a contract;
3.3.4. in order to ensure and improve the quality of services, and to develop and enhance the services by asking for feedback – the processing shall be carried out with the consent of the user of the service;
3.3.5. in order to cover the events and activities of the National Library in (social) media – the processing shall be carried out with the consent of the user of the service;
3.3.6. in order to send newsletters, to inform of new literature, to advertise the services provided by and events of the National Lirbrary, organising campaigns and games, informing the winners of the win and giving the prize to the winner – the processing shall be carried out with the consent of the user of the service;
3.3.7. accepting or exchanging the books in the Repository Library – the processing shall be carried out with the consent of the user of the service;
3.3.8. in order to manage data on paying the service fee and arrears, including for collecting the arrears – the processing shall be carried out to perform a concluded contract or to perform the duties pursuant to law;
3.3.9. in order to manage the parking in the parking slots belonging to the National Library – the processing shall be carried out with the consent of the user of the service;
3.3.10. in order to ensure internal order on the territory and reading area of the National Library, to prevent the misuse of and protect the property of the National Library, to ensure the safety of employees and other service users – the processing shall be carried out to perform the duties pursuant to law or to perform a concluded contract;
3.3.11. in order to ensure persons with disability the access to the building and services of the National library – the processing shall be carried out with the consent of the user of the service;
3.3.12. in order to realise the rights of the data subjects relsted to the data protection – the processing shall be carried out to perform the duties pursuant to law;
3.3.13. in order to perform duties arising from other legislation, e.g. at the request of law enforcement authorities, bailiffs, tax authorities, or courts. -
4.1. In addition to the previous, the National Library processes the personal data of its users dependent on the website visited and IT-system used:
4.1.1. the data on the accounts generated in electronic databases and the data that are recorded while logging in to the accounts and using the functions therein, including the records saved and searches performed by the user, and other similar data;
4.1.2. data collected in the logs of different IT-systems and websites, including IP addresses, the dates and time of visits, the addresses of these web pages from where the web pages of the National Library have been visited and what has been visited, information on the used web browser, operating system and device;
4.1.3. MAC-address, IP-address and the time of connecting with and disconnecting from wifi;
4.1.4. upon printing from the user’s computer, the name of the printed file, the amount and time of printing;
4.1.5. analytical data, including moving around on the website, length of visits.4.2. The use of cookies on the websites of the National Library
4.2.1. A cookie is a text file that is stored on the computer of the person who visits the web page.
4.2.2. The National Library uses cookies on its web pages in order to make the use of web pages convenient to the visitor and develop its web-based services.
4.2.3. The visitor of the web page can independently manage the cookie notification and storage settings in his or her web browser settings and delete cookies that have been already stored.
4.2.4. The National Library mostly uses the absolutely necessary cookies that enable the visitor to move around on the website and analytical cookies. More detailed information on the cookies used on particular websites are provided on those websites.4.3. The National Library may process the personal data for the following purposes and on the following legal bases:
4.3.1. to manage the accounts of users in order to provide services that the user has requested from the National Library – the processing shall be carried out with the consent of the user of the service and in case of the Publisher’s Portal (Kirjastajaportaal) to perform a duty of public interest;
4.3.2. in order to provide free wifi service and to enable printing through the user computers – the processing shall be carried out with the consent of the user of the service;
4.3.3. in order to personalise visits to the web pages – the processing shall be carried out with the consent of the user of the service;
4.3.4. in order to collect statistics on the use of the web pages for acquiring information what is and what is not functional on the web pages of the National Library – the processing shall be carried out with the consent of the user of the service;
4.3.5. the National Library keeps the activity and system logs in order to solve problems that have occurred in the course of using its systems – the processing shall be carried out to perform a duty of public interest and to perform the duties pursuant to law;
4.3.6. the National Library regularly makes backups of electronic databases, web pages and the data on their use in order the preserve data – the processing shall be carried out to perform a duty of public interest and to perform the duties pursuant to law. -
5.1. Your personal data shall be processed for the purposes of librarianship and determining copyright status, if you have been treated in a publication or you have authored a publication. These data are retrieved from the publications, publishers, and public sources, including the Succession Register or the Population Register. The National Library may process, inter alia, the following personal data:
5.1.1. data on the author and other persons connected to the publication, including the connection with the publication, the person’s name, pseudonym, dates of life, title, clerical status or noble rank, patronymic in the case of Russian names, connections to Estonia, professional status or area of activity, and gender, membership in organisations, kinship ties, source of the data (if not the publication itself);
5.1.2. the data for identifying the copyright holder, publisher and its representatives, person donating and person recommending publications, including the person’s name and personal identification code;
5.1.3. contact details of the copyright holder, publisher and its representatives, person donating and person recommending publication, including e-mail address, telephone number, and postal address;
5.1.4. the data on communication with the copyright holder, publisher and its representatives, person donating and person recommending publication;
5.1.5. other data about the person, including special categories of personal data that may be disclosed in publications.5.2. The National Library processes personal data, inter alia, for the following purposes in librarianship:
5.2.1. in order to describe publications and their parts, to register publications in the database of the Estonian National Bibliography, and to collect, preserve and make available publications and personal archives – the processing shall be carried out to perform the duties of public interest pursuant to the National Library of Estonia Act and the Legal Deposit Copy Act;
5.2.2. in order to create the network of recommenders for the purposes of forming collections Library – the processing shall be carried out with the consent;
5.2.3. in order to collect, preserve and make available digital publications – the processing shall be carried out to perform the duties of public interest pursuant to the Legal Deposit Copy Act;
5.2.4. in order to digitise or reproduce publications or their parts in accordance with the Copyright Act – the processing shall be carried out to perform the duties of public interest;
5.2.5. to enable text and data mining in digitised publications or parts of the publications in accordance with the Copyright Act – the processing shall be carried out to perform the duties of public interest;
5.2.6. in order to determine copyright and access matters and the holders of rights – the processing shall be carried out to perform the duties pursuant to the Copyright Act;
5.2.7. in order to make open data available for re-use – the processing shall be carried out to perform the duties pursuant to the Public Information Act;
5.2.8. in order to respond to inquiries and to introduce collections – the processing shall be carried out to perform the duties of public interest pursuant to the National Library of Estonia Act;
5.2.9. in order to assign international standard numbers to books, serials, and printed music – the processing shall be carried out to perform the duties of public interest pursuant to the National Library of Estonia Act. -
6.1. The National Library processes the personal data of employees who work for the library on the basis of employment contract or authorisation agreement, trainees, job or traineeship applicants and volunteers.
6.2. The National Library receives the personal data of the persons referred to in the clause 6.1 personally from the user and on the basis of his or her work, and partially from the third persons. The National Library may process personal data, inter alia, for the following purposes:
6.2.1. the data for identifying the person, including the person’s name, personal identification code or the date of birth, and the number of ID card;
6.2.2. contact details, including e-mail address, telephone number, and postal address;
6.2.3. family-related data, including the names and personal identification codes of dependents;
6.2.4. financial data, including bank account number, the amount of salary and benefits, and other related data;
6.2.5. registration number and type of car;
6.2.6. professional or educational data, including data on education and/or previous jobs, and other information that is written in the CV and cover letter and shall be evident during the job interview or communication with referees;
6.2.7. employment-related data, including the position, working and rest time and vacations, information about training and business trips, the summaries of performance appraisal as well as probational interviews, information about work results;
6.2.8. the fact of using the services provided on the online meeting platform, the length of the meeting and the written text on the platform;
6.2.9. images caught on security cameras and other information gained by electronic means, including while using key cards;
6.2.10. photographic or video images that have been recorded at the events of the National Library or held at the National Library, including trainings;
6.2.11. the image and name on the personnel ID card and on the intranet of the National Library;
6.2.12. the logs of the use of IT systems;
6.2.13. the data on amending, extending, terminating of the employment contract, including breaches of the terms;
6.2.14. the special categories of personal data, including the data concerning heath such as information on healthy days and days of sickness, the results of medical examination, information on the incapacity for work, pregnancy and the state of intoxication, and the data on trade union membership.6.3. The National Library may process the personal data of the persons referred to in the clause 6.1, inter alia, for the following purposes and on the following legal bases:
6.3.1. in recruitment process – the processing shall be carried out to conclude a contract and to perform the duties pursuant to the Employment Contracts Act;
6.3.2. in order to decide the terms of the employment contract, including work duties and obligations – the processing shall be carried out to conclude and perform a contract and to perform the duties pursuant to the Employment Contracts Act;
6.3.3. in order to pay remuneration, benefits and taxes – the processing shall be carried out to perform a contract and to perform the duties pursuant to the Employment Contracts Act;
6.3.4. in order to evaluate work performance, to define training and development needs, to make a decision whether to promote an employee, and to monitor compliance with the Employment Contracts Act and the rules of work organisation of the National Library – the processing shall be carried out to perform a contract, and to perform the duties and obligations pursuant to the Employment Contracts Act, the rules of work organisation of the National Library, and the job description for the position;
6.3.5. in order to communicate with the person both in the process of him or her applying for the position or traineeship as well as during the employment or traineeship, or in the relationship with the person acting as a voluntary helper – the processing shall be carried out to conclude and perform a contract and to perform the duties pursuant to the Employment Contracts Act;
6.3.6. in order to provide the benefits, vacations and retirement related to the employment relationship – the processing shall be carried out to perform a contract;
6.3.7. in order to prepare documents for a business trip – the processing shall be carried out to perform a contract and to perform the duties pursuant to the Employment Contracts Act;
6.3.8. in order to take evidence on a breach of the rules of work organisation or the Employment Contracts Act – the processing shall be carried out to perform a contract and to perform the duties pursuant to the Employment Contracts Act;
6.3.9. in order to make a decision to continue or terminate the employment relationship – the processing shall be carried out to perform a contract and to perform the duties pursuant to the Employment Contracts Act;
6.3.10. in order to referee someone and to write a reference letter – the processing shall be carried out with the consent of the person;
6.3.11. in order to enable and organise free parking – the processing shall be carried out with the consent of the emplyee;
6.3.12. in order to prevent the misuse of and protect the assets of the National Library and to ensure the security of the employees and the users of the service – the processing shall be carried out to protect the legitimate interest of the National Library;
6.3.13. other cases of processing personal data, of which the National Library shall notify the data subject in advance and ask for prior consent, if these are not arising from a contract or the law.6.4. The National Library processes the special categories of personal data for the following purposes and on the following legal bases:
6.4.1. in order to evaluate the state of health necessary for working and work ability and to manage the days of sickness – the processing shall be carried out to perform a contract, and to perform the duties pursuant to the Employment Contracts Act;
6.4.2. the data on the state of health are used at work for creating working environment that conforms to special needs – the processing shall be carried out to perform duties pursuant to law;
6.4.3. the data on the trade union membership are used for paying the trade union membership fee, for ensuring the protection arising from the collective agreement and legislation – the processing shall be carried out to perform duties pursuant to the collective agreement and law. -
7.1. The National Library preserves personal data as long as it is necessary to attain the objective for which purpose these data were collected or in compliance with the requirements pursuant to law.
7.2. The National Library preserves the personal data of its registered user for three years starting from the last time they used a service.
7.3. Photographs and videos of the events held at or related to the National Library are permanently preserved or until consent is withdrawn.
7.4. Pursuant to the Security Act, the National Library preserves security camera recordings for a month, whereupon they are deleted.
7.5. The National Library permanently preserves the answers to capacious reference questions; the personal data therein remain confidential.
7.6. The National Library preserves the data of the employees and job applicants as follows:
7.6.1. The National Library deletes or destroys (on paper) the data of job applicants not later than a year after the competition for the position has ended, when the possible right of claim extinguishes;
7.6.2. The National Library preserves the documentation related to the employees and the data therein up to ten years after the expiry of the employment relationship and, in the case of the employment relationships that have been entered into before 1 July 2009, up to fifty years after the expiry of the employment relationship;
7.6.3. The National Library permanently preserves the registration journals of employment record books in its archive and makes them available solely for the purposes of historical and scientific research.7.7. The preservation of personal data to be processed in connection with the use of the databases and web pages of the National Library depends on the purposes for preserving the personal data:
7.7.1. automated logs related to the use of web pages preserve from 25 minutes up to 45 days, dependent on the type of the log; however, their backups shall be preserved up to two years;
7.7.2. the visitor statistics of the web pages are preserved up to 50 months;
7.7.3. the user of the web page can any time delete the cookies that the web pages of the National Library have stored in his or her web browser;
7.7.4. while creating an account on the web pages, the user can himself or herself delete his or her personal data. If the backup copy of the data has already been made, the backup may be preserved up to two years.7.8. The National Library permanently preserves the data collected for the purposes of librarianship, in determining copyright status and providing access to digital objects, and in determining the holders of rights.
7.9. Document retention periods are determined in the “The document classification scheme of the National Library”.
-
8.1. The access to personal data is granted only to these employees of the National Library, who need it for performing their work duties in order to provide service that has been requested. For instance, customer service providers have access to the database of users.
8.2. The employees of the National Library, whose work involves dealing with personal data, have a contractual obligation to maintain the confidentiality of personal data that have been disclosed to them during their employment and not to make these data accessible to third parties.
8.3. The disclosure of personal data to third persons shall take place solely pursuant to law, in the cases of a justified need, or with the consent of the person:
8.3.1. user management platform – management of the contacts of the registrered users and data related to lendings;
8.3.2. net promoter score platform – in order to ask for feedback, the e-mail address of the user of the service is transferred;
8.3.3. newsletter platform – in order to send the newsletter, the e-mail address of the user of the service is transferred;
8.3.4. e-mail platform and platform for collaboration and sharing documents – all e-mails and their content;
8.3.5. application fot online chat – content of the inquiry, e-mail address and name of the person;
8.3.6. online meeting platform – the fact of using the service, the length of the meeting and the written text on the platform;
8.3.7. the platform of the Search Portal of the National Library – IP address and, if the person uses „My Library Card“ function, also his or her e-mail address and telephone number are transferred;
8.3.8. provider of postal services – name and postal address are transferred;
8.3.9. e-learning environment – the name, e-mail address and other data of e-learner that he or she has voluntarily provided are transferred;
8.3.10. platform of the analytics of the web pages – the visitor statistics of the web pages of the National Library, including IP addresses are transferred;
8.3.11. provider of accounting and human resources services – the data required by the accounting and human resources management rules are transferred;
8.3.12. provider of IT services – all data related to the use of the IT-systems of the National Library are tranferred;
8.3.13. provider of debt collection services – the data for identifying the person, his or her contact details, and data on the financial claim are transferred;
8.3.14. the social media platforms of the National Library – photographs and video recordings of the public events, held at the National Library, are transferred;
8.3.15. Estonian Tax and Customs Board, Estonian Health Insurance Fund, Estonian Unemployment Insurance Fund, Estonian National Social Insurance Board – name, personal identification code, the amount of salary, and information on benefits and taxes are transferred;
8.3.16. security service provider ¬– the recordings of security cameras and the personal data of the persons related to the breaches of the internal rules of the National Library, including the data on the breaches are transferred;
8.3.17. publishing an application, a request for information, a memorandum, or a contract concluded with the National Library in the document register of the National Library pursuant to the Public Information Act – the data required by the Public Information Act are transferred;
8.3.18. company organising parking – car registration number, type, parking time;
8.3.19. platform for advertising job vacancies – data necessary for applying for a job;
8.3.20. authorities, including law enforcement authorities, bailiffs, or courts, if they have legal grounds for lodging the application – the personal data which may be requested on legal basis are transferred.8.4. The data collected for the purposes of librarianship, including the data related to copyright are disclosed to third persons, inter alia, in the following cases:
8.4.1. data on publications and related persons are added to pan-Estonian e-catalogue;
8.4.2. data on publications and related persons, annotations of the publication or the publication itself is sent on a CD to persons with disability, disorder or illness that prevents them from reading a printed text;
8.4.3. person ordering has ordered a digital copy of a publication through the EOD platform;
8.4.4. transferring digital publications to the National Library for adding them to the Digital Archive;
8.4.5. Estonian and international databases that aggregate data on publications, persons related to these publications and copyright matters;
8.4.6. in the course of other activities of librarianship nature, including interlibrary lending. -
9.1. Data subject has the following rights in regard to the personal data that the National Library processes:
9.1.1. Data subject has the right to access his or her personal data that the National Library collects about him or her as well as to require the transference of the personal data that has been automatically processed and which processing is based on a concluded contract or on your consent (see clauses 2–7). In such cases, the National Library shall transfer the personal data either to the data subject or, if it is technically possible, at his or her request to the organisation specified by him or her in a structured, widely used file format and in machine-readable form.
9.1.2. Data subject has the right to demand the correction of inaccurate data or the deletion of his or her personal data. Data subject can exercise this right via his or her personal user account on user management platform or via the settings of his or her user accounts on the web pages of the National Library.
9.1.3. If data subject is of the opinion that his or her personal data are inaccurate or the National Library unlawfully processes his or her personal data, he or she has the right to demand the restriction of processing his or her personal data until the National Library has made a relevant decision.
9.1.4. If the processing of personal data is based on consent, the data subject has the right to withdraw it at any time.9.2. To exercise the rights referred to in clause 9.1, the data subject must submit an autographic application on paper to the information specialist or a digitally signed electronic application to the data protection specialist on the e-mail address: andmekaitse@nlib.ee, keeping in mind that the rights referred to in clauses 9.1.2 and 9.1.4 can only be exercised by the data subject himself or herself.
9.3. The data subject has the right to file objections against the processing of his or her personal data, if the processing is based on legitimate interest or on the performance of a duty of public interest (see clauses 2–7). To file the objections, the data subject must submit an autographic application on paper to the information specialist or a digitally signed electronic application to the data protection specialist on the e-mail address: andmekaitse@nlib.ee.
9.4. The National Library shall deny the application submitted on the basis of clause 9.2, if the request of the data subject is clearly unfounded or excessive, or the basis for the denial of the application are pursuant to law.
9.5. The data subject has the right to recourse to the Estonian Data Protection Inspectorate or to the courts in order to protect his or her rights.
-
10.1. You have the right to receive explanations of the processing of your personal data and your rights. To get these explanations, the National Library asks You to contact its information specialist or, if your thorough questions need more detailed answers, send a letter to the data protection specialist at the National Library to the email address: andmekaitse@nlib.ee.
10.2. Data protection specialist at the National Library of Estonia:
e-mail: andmekaitse@nlib.ee; telephone: (from abroad add +372) 630 7131;
postal address: Data Protection Officer, National Library of Estonia, Tõnismägi 2, 15189 Tallinn, Estonia