Website Privacy Policy

The Company collects and processes personal data in accordance with the legislation regulating the protection of personal data of the EU and the Republic of Estonia. 

The scope of personal data processing depends on the services used and the information provided by the service user or web browser. 

The Company processes Visitors' personal data on the following bases: 

• on the basis of your actively expressed consent, which you give by contacting us and by transmitting your personal data or by other active activities; 
• for the purpose of implementing our legitimate interests (managing the website, providing relevant information to customers, etc.); 
• to fulfill obligations stipulated by law. 

The aim of the Company is to accurately, fairly and legally process personal data, to process data only for the purpose for which they were collected, and to process them in accordance with clear and transparent principles and requirements for personal data processing, as stipulated by legislation. 

Processing of personal data for direct marketing purposes.

The Company processes your personal data for direct marketing purposes in the following cases: 

• if the Company receives your explicit consent to process such data, such as when subscribing to our newsletter, etc. (your consent is the basis of data processing); 
• if you are a customer of the Company and have not expressed your opposition to the processing of your personal data for the purpose of direct marketing and marketing of similar services or products (the basis of data processing is the legitimate interest of the Company to inform its customers about its services and products). 

 The following personal data are processed for direct marketing purposes: name, e-mail address, phone number.

The Privacy Policy of the Company's loyalty program “Thank You”, in which we explain how we use your personal data in marketing activities and how we protect them, can be found HERE. 

Your personal data may be processed for direct marketing purposes in the following ways: 

• to send you our newsletter by e-mail about offers, promotions and news; 
• to send you offers or similar information by e-mail.

Please note that you can unsubscribe from our newsletter at any time by clicking on the appropriate link at the bottom of the newsletter.

The Company also processes your personal data in cases where you contact us and submit an inquiry or ask a question or send us other information by e-mail to klienditugi@maxima.ee, by calling our customer support line +372 800 2121 or via social networking channels, or by filling out a paper form in our stores or office. 

To protect your personal data, we ask you to adhere to at least the following minimum requirements: do not refer to personal data in the headers of e-mails or requests or in the names of attachments (your name, surname, address, phone number, e-mail, social security code, date of birth, bank account number, national car registration number, real estate data, health data, other special (sensitive) data, etc.); do not refer to your personal identification number, health data or other special (sensitive) data in the text of an e-mail, inquiry or request, and transmit the remaining personal data only to the extent necessary to fulfill the purpose of your message. 

The Company processes your data in the aforementioned cases to manage inquiries and complaints, to ensure the quality of services, to protect its rights and legitimate interests. The data provided to us will be transferred to our contractual partner only on the basis of your clearly expressed consent. 

When you call our customer support line +372 800 2121, we save your phone number and process the information you provide, including sensitive data related to your purchases, etc., to analyze your question, provide you with information and ensure the quality of our services. 

If you provide any personal data during the conversation, such as your name, surname, address, phone number, etc., we will use this data to analyze your question, send you the necessary data, answer the question and resolve the request or claim. We can also analyze your opinions and suggestions in order to improve the quality of our activities and services. The legal basis for the processing of personal data is our legal obligation to review and respond to your inquiries, as well as our interest in the evaluations of our customers, the analysis of which helps us to improve the quality of the services we provide. 

In order to protect your personal data, we ask you to adhere to at least the following minimum requirements during the conversation: do not unnecessarily refer to your personal identification number, health data or other data that is not necessary to resolve the appeal; refer to the remaining personal data only for the purpose of solving your request and to the minimum extent necessary. 

If we deem it necessary to collect additional information to analyze your request, we may associate your request data with other data in our possession, such as your cash register data, your loyalty card history, etc. 

You can read more detailed information about the rules for processing the personal data of customers who submit an application in the Privacy Policy for Customers Submitting an Application HERE.

If you want to apply for a job in the Company, you can choose a suitable vacant position and submit your application on the Company's website: https://talendipank.ee/maxima. 

Please follow the requirements for the protection of your personal data and do not send us any redundant information. 

Please note that in order to evaluate your application, we may contact your former employers (including recommenders) and ask them to provide information about your qualifications, professional skills and characteristics. We have the right to request this information from your current employer only after receiving your consent. 

If, after considering your application, we choose another candidate who better meets our requirements, we may ask for your separate consent to store and use the personal data related to your application for the purpose of other staff selection processes and contacting you within them. 

If we receive your consent, we will store the said personal data for two months from the date of your consent. 

After giving your consent, you have the right to withdraw it at any time without affecting the lawfulness of the data processing based on the consent prior to the withdrawal of your consent. If you exercise this right, we will immediately take the necessary measures to destroy your personal data. 

More information about our privacy policy for applying for a job is provided with each job advertisement on the Company's website: https://talendipank.ee/maxima 

When you visit our website, the Company processes anonymous data such as IP address, MAC address, dates of visit, duration of visits, visited websites, devices and applications used to browse the website, etc., in order to collect statistics on website traffic and improve services and user experience. 

In addition, our website uses cookies. Cookies are small text files (a few kB in size) that your web browser sends to your computer, tablet or other smart device when you visit our website. The purpose of cookies is to ensure the efficient and secure operation of the website and to analyze your habits in order to ensure convenient and efficient operation of our website and its compliance with your needs and expectations. 

More information about the cookies used on our website can be found in our Cookie Policy.

The Company processes data provided by Visitors when they use the Company's services or website. 

Data can be generated when a person uses services, for example, calls by phone, sends an SMS, e-mail or visits the website.

We do not store your personal data longer than is necessary to fulfill the purposes defined in this Privacy Policy. 

We keep the letters sent to us via inquiries or electronic means for 24 months in the active mailbox and for up to 5 years in the inactive mailbox. 

Personal data processed for reasons related to staff selection and employment in the Company are stored until the end of the selection process, unless the candidate gives separate consent to further storage of their data. 

We will process the recording of the job interview and your data for as long as it is necessary to make a staff selection decision and to review it, to respond to you and to implement the decision made, but not for more than one month. If you submit a legal claim, we will process the data until the claim is resolved and/or until the expiration date. 

Personal data processed for direct marketing purposes will be stored for 7 years after receiving consent (if your separate consent has been obtained) or until the date of execution or termination of the contract. When the above-mentioned term expires, we will destroy your personal data in such a way that their further processing becomes impossible. 

Longer storage of your personal data is permitted only in the following cases: 

• if there are reasonable suspicions regarding illegal activities under investigation; 
• if your data is necessary for the proper resolution of a dispute or complaint; 
• if we have received complaints about the Visitor or have noticed violations by the respective Visitor; 
• to make backup copies and for other purposes related to the operation and maintenance of information systems or similar activities; 
• if there are other reasons, conditions or cases specified by law.

The Company will not transfer your personal data to third parties without your consent, except in the cases described below. 

We may transfer your data for processing to third parties who help us provide and manage services and who provide services related to the management of customer inquiries. These persons may include database software suppliers, database management service providers, data centre providers, web hosting and cloud services providers, direct marketing service providers, market research or business analytics service providers. In all cases, we only transmit to the data processor the data necessary to perform a specific task or provide a specific service. 

Data processors among our cooperation partners can only process your personal data in accordance with our instructions. In addition, they must ensure the security of your data in accordance with applicable legislation and written agreements with us.   

Data may also be provided to competent public or law enforcement authorities, such as police and supervisory authorities, but only at their request and only if it is required in accordance with current legislation or in cases and procedures provided by law to ensure the security of our rights, customers, employees and resources, and to prove, exercise or protect claims. 

If we use a website analysis service (e.g. Google Analytics), the purpose of which is to find out how visitors use the information presented on the www.maxima.ee website, we may share your anonymized data with third parties who use this data to investigate the use of the website or mobile application, to the administrators of the website to prepare reports about the website and to provide other services related to the use of the website. More information is provided in our Cookie Policy. 

With the exceptions listed below, we process your personal data in the territory of the European Union. We do not, nor do we intend to, transfer your personal data to third countries.

We hereby inform you that certain data about your visit to our website or data generated during your visit to our website (such as IP address, location, cookies, browser or device settings and information, browsing date, time, duration, other browser and device activity, and for monitoring the website, for statistics, employment, analysis, functionality and related purposes) may be processed, transmitted or made available to companies within the European Economic Area (hereafter referred to as the "EEA") and outside (e.g. Google Analytics, Facebook ads and other similar services, functions or products, such as processors or recipients operating in the United States or other non-EEA countries).

We hereby inform you that the level of personal data may be weaker in non-EEA countries than in EEA countries. We closely monitor the evolving case law and guidelines of the Court of Justice of the European Union and data protection supervisory authorities on the transfer of data outside the EEA and carefully evaluate the conditions under which such data about you is transferred and may be further processed and stored after transfer to the above companies. In order to ensure an appropriate level of data security and to ensure the legal transfer of data, we follow standard terms and conditions approved by the European Commission or follow other data protection conditions.

The Company is constantly implementing and updating appropriate organizational and technical measures to ensure security and help protect personal data from accidental or unlawful destruction, substitution, disclosure and other unlawful processing.

Personal data transmitted by you, including your name, surname, e-mail address and other data contained in the e-mail, may be processed by the Company or the owner of the e-mail, data centre, storage and other IT infrastructure service provider who has signed an agreement for the security of the Company's IT system by enabling business activities with customers, suppliers and other business partners and by ensuring that data is properly protected and preserved in the event of a security breach.

Personal data protection legislation provides many rights that can be used freely, and it is our duty to ensure that you have all the opportunities for this. We provide information on specific rights and their use below; please read the text below carefully. 

a. Right of access to your personal data processed by us 

You have the right to receive confirmation as to whether or not we are processing your personal data. You also have the right to access your personal data processed by us, information about the purpose of data processing, the type of data processed, the type of data recipients and the data processing period. 

As part of this Privacy Policy, we provide a significant portion of this information that we believe will be useful to you.

b. Right to rectification of personal data 

You can also contact us as described in section 6 of this Privacy Policy and ask us to correct or clarify your data.

c. Right to withdraw consent 

In cases where we process your data based on your consent, you have the right to withdraw your consent at any time and data processing based on your consent will be stopped.

d. Right to appeal 

If you find that we are processing your data in a way that violates the requirements of data protection legislation, we ask that you always contact us first. We believe that in cooperation we will be able to solve your questions, satisfy your requirements and, if necessary, correct our mistakes.

If you are not satisfied with the proposed problem solution or if you find that we do not take measures in accordance with your request, you have the right to file a complaint with the supervisory authority, which in Estonia is the Data Protection Inspectorate (more information: www.aki.ee). 

You have the right to object to the processing of your personal data if it is processed on the basis of our legitimate interest. 

If you wish to exercise the right set out in this section, please submit a written request to our Data Protection Officer. 

e. Right to erasure ("right to be forgotten")

In certain circumstances specified in the legislation dealing with data processing (if personal data is processed illegally; the basis for data processing has expired, etc.), you have the right to demand that we delete your personal data. If you wish to exercise this right, please submit a written request to our Data Protection Officer. 

f. Right to restriction of processing

In certain circumstances defined in legislation on data processing (if personal data is processed illegally; if you dispute the accuracy of the data; if you dispute the data processing on the grounds that it is done on the basis of our legitimate interest, etc.), you also have the right to restrict the processing of your personal data. 

If you wish to exercise the right set out in this section, please submit a written request to our Data Protection Officer. 

g. Right to data portability

You have the right to transfer your data owned by us and processed automatically by us to another data processor based on your permission. We will transfer the requested data to the data processor you designate, subject to the necessary technical capacity, in a machine-readable format that we normally use in our systems. 

If you wish to exercise the right to data portability, please submit a written request to our Data Protection Officer.

h. Application review procedure

In case you want to submit data or exercise your other rights, we have to verify your identity in order to protect your and other persons' data from illegal disclosure. For this reason, we may ask you for your name, surname, e-mail address or phone number, which we can use to check the accuracy of the data. During the verification process, we may send you a verification message (SMS or e-mail) asking you to perform an authorization action. If the verification procedure fails (e.g. the data you provided does not match our existing data or the SMS or e-mail authorization operation received fails), you will receive a message that you are not an authorized Visitor and that your request has not been resolved. 

If we receive a request from you to exercise your rights and the above verification procedure is successfully completed, we undertake to inform you of the implementation of measures corresponding to your wishes immediately, but no later than within one month from the receipt of the request and the successful completion of the verification procedure. Taking into account the possible complexity and number of requests, we have the right to extend this period by two months by notifying you by a reasoned letter at the end of one month of the initial period. 

If you submit a request electronically, we will respond to it electronically, except in cases where this is impossible (in the case of a particularly large amount of information) or if you ask us to respond in another way. 

We will not honour requests that cannot be deemed to comply with the legislation and we will notify you in writing. 

For all data processing issues, you can contact us in the following ways: 

By e-mail: info@maxima.ee, klienditugi@maxima.ee 

By calling our free helpline at: 800 2121

Contact details of our Data Protection Officer: 

E-mail address: dpo@maxima.ee

Address for postal correspondence: Aiandi 13/2, 12918, Tallinn, Estonia. 

Addressee: MAXIMA Eesti OÜ, Data Protection Officer. 

 Our details as a data processor: 

 MAXIMA Eesti OÜ 

 Legal entity code 10765896 

 Location address: Aiandi 13/2, 12918, Tallinn, Estonia.

The Company may update this Privacy Policy at any time. The Company informs Visitors about updates by publishing a new version of the Privacy Policy on the website with the dates of the revisions. Visitors understand that by using the website after the Privacy Policy has been updated, they agree to the changes made. 

 If any provision of the Privacy Policy is held to be invalid or unenforceable, this provision shall not affect the legality and validity of the remaining provisions of the Privacy Policy. 

The Privacy Policy applies from 20 October 2020.