Privacy statement for customer and partner register

Last updated on 8 February 2024

Your privacy is important to us. In this privacy statement, we provide information about what personal data Empower 4Wind OÜ processes, how it processes it and for what purposes.

Controller of personal data

Empower 4Wind OÜ (hereinafter E4W)
Registry code: 11949894
Mõigu 3, Tallinn
10112, Estonia

Contact information for this register

If you have any questions about the processing of personal data or the exercising of your rights under the EU Data Protection Regulation, you can write to our Data Protection Officer at kaisa.aadna@empower.ee

Name of the register

The register of customers, the register of approved suppliers and the register of approved subcontractors (hereinafter referred to as the Register). The Register contains the personal and contact details of former and current customers, approved suppliers and subcontractors.

The nature and purposes of processing and the legal bases

Processing of personal data is necessary for conducting and managing customer relations or cooperation within E4W.

The purpose of processing personal data is to maintain customer relationships, cooperate with partners, support sales, develop business and services and maintain customer communication in regard to contract performance. Personal data is processed only to the extent necessary.

Based on data protection regulations, E4W processes personal data on the following legal bases:

a) Customer relationship management and development, business and service development and risk management

We process personal data for the purposes of communicating with customers and partners (including communication related to potential or terminated contracts) and managing customer relationships. We may also process personal data for the purpose of monitoring and analysing the use of services to ensure the quality and security of services.

The legal basis for processing is Empower 4Wind’s legitimate interest.

We believe that the purposes identified in this privacy statement are essential to the business of the company and therefore we have a legitimate interest in processing personal data. E4W ensures that the processing of personal data is proportionate to the interests of the data subject and corresponds with their expectations.

The data subject has the right to object to the processing of personal data according to the requirements of the EU Data Protection Regulation insofar as the processing is based on the legitimate interest of E4W.

b) Performance of contracts, offering and providing services

We process personal data for the purposes of complying with a customer or cooperation contract and for communicating about compliance with contracts and the provision of services.

The legal basis for processing is a contract.

Processing of personal data is necessary to conclude an agreement and to fulfil the contractual obligations between the customer or partner and E4W.

c) Statutory requirement

Fulfilment of the requirements and obligations stated in laws, regulations or decisions from authorities and supervisors (e.g. Accounting Act, Prepayment Act).

The legal basis for processing is a legal obligation.

E4W undertakes to process personal data to comply with its legal obligations.

Categories of personal data contained in the Register

The Register consists of personal data related to the customers’ and partners’ contact persons in the following categories:

first name and surname
contact details (e.g. phone number, email address)
name of the company represented
customer and contract information (e.g. name of the contact person for ordering and invoicing purposes)
position and profession

Duration of processing

Personal data is processed at least for the duration of the customer and contractual relationship. Personal data will also be stored after the termination of the customer and contractual relationship for the period necessary to fulfil the purposes defined in this privacy statement.

Personal data is erased after the claim period related to a specific customer relationship or service has elapsed. This period is typically ten (10) years. The information of potential customers is stored as long as the storage is necessary for establishing a customer relationship.

E4W estimates regularly the need for data storage, taking into account the applicable legislation.

Sources of personal data

Personal data is primarily collected directly from the customer or cooperation partner. Personal data may also be collected from other sources upon the data subject’s consent.

To the extent permitted by law, personal data may be collected from registers of third parties, such as:

the Population Register
registers of other authorities, e.g. Trafi, commercial register and register of foundations
contact service providers
credit information registers

Transfer of personal data and categories of recipients of personal data

Personal data will not be transferred to third parties without the consent of the data subject.

Personal data will not be transferred outside the European Union (EU) or the European Economic Area (EEA) unless it is necessary in regard to the purposes of processing determined above. If personal data is transferred outside the EU or the EEA, E4W must implement suitable safeguards in order to comply with the requirements of applicable data protection legislation. E4W may for instance conclude an agreement with a customer operating outside the EU or the EEA in accordance with the standard data protection clauses adopted by the European Commission.

Security of processing

E4W has put in place adequate technical and organisational data protection measures to safeguard the personal data of data subjects against loss, misuse or other equivalent unlawful access. Secure processing of personal data is ensured by providing instructions as well as managing access to provide access to the designated employees of E4W. Personal data is only processed by employees who are authorised to do so in the framework of their work duties.

Data subject’s rights

The data subject may exercise their rights by contacting the Data Protection Officer using the information provided in section 2. The data subject has the following rights under the General Data Protection Regulation (GDPR):

The right to obtain confirmation as to whether personal data concerning them is being processed and, if so, to have access to the personal data.
The right to have incorrect or incomplete information corrected or completed.
The right to request erasure of personal data concerning them.
The right to restrict the processing of personal data, where applicable, according to the GDPR.
The right to receive the personal data concerning them that they have provided to a controller in a structured, commonly used and machine-readable format and the right to transmit this data to another controller.
The right to object to the processing of personal data, where applicable, according to the requirements of the GDPR.
The right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to them infringes that set out in the GDPR.

Changes to this privacy statement

Empower 4Wind seeks to develop its services continuously and thus reserves the right to change this privacy statement. This privacy statement may also be updated to reflect any changes in applicable laws. We encourage data subjects to periodically review this privacy statement.