PRIVACY POLICY

1. Data processing subjects

1. 1. Sunny Companies processes the personal data of its employees, representatives, and contact persons of clients and, if necessary, users of the Sunny Companies’ means of work (more information is available in section 2 ‘Controller’).
   2. The Sunny Companies also process data on behalf of their clients who are controllers (more information is available under the heading ‘Processor’). Data subjects whose data is processed by the Sunny Companies are also referred to as ‘natural persons’ in this Privacy Notice.

2. Controller

1. 1. If the Sunny Companies determine the purposes, means, and extent of processing of personal data, they are the controller.

3. Processing of personal data

1. 1. We only process the personal data of representatives of clients to perform Our contractual obligations and provide high-quality services to Our clients. The legal basis for processing is Our legitimate interest and/or the performance of a contract concluded with a data subject or the taking of pre-contractual measures as requested by a data subject to ensure the proper provision of Our services or the sale of goods. We only process the personal data of job applicants to assess their competence and suitability. If data is processed for said purpose, the legal basis for processing is legitimate interest or the data subject’s consent, as the case might be.
   2. We generally collect personal data directly from data subjects, which means representatives of clients, natural persons, and employees of corporate customers who buy and use Our products and services as well as job applicants, Our employees, subcontractors, and so on.
   3. The Sunny Companies do not process special categories of personal data, for example, sensitive personal data.
   4. We process the following personal data:
      1. Contact details, including name, address, phone number, IP address, and e-mail address;
      2. Date of birth, age and gender and/or personal identification code, client number;
      3. Employment data, including employer, title, post, and professional preferences;
      4. Financial data, including credit card or PayPal data;
      5. User operations in connection with e-mails sent to the Sunny Companies and information contained therein and accompanied thereby;
      6. Other personal data which Our current or potential clients have made publicly available or available only to Us in third-party social networks such as LinkedIn, Facebook, and others.

.4. Sharing of personal data

1. 1. Within Our group
      1. The Sunny Team OÜ group also includes Our subsidiaries and it is possible that a client uses the services of several of Our group companies and We are interested in providing the best possible user experience and service. Therefore it is possible that We will share personal data among Our group companies to have an overview of Our clients and their associations with other group companies necessary to provide the best possible service.
   2. Outside Our group
      1. We may share certain categories of personal data with Our cooperation and business partners if it is necessary for providing Our services, lawful and in compliance with the applicable personal data protection law. In that case, We may share personal data only in connection with providing products or services to Our clients. The legal basis for such processing of personal data is Our legitimate interest.
      2. We share personal data that is required for payment processing, with our authorized data processor Stripe Inc or Maksekeskus AS.
   3. Authorities
      1. In cases provided by law, the police, the Tax Board, and other authorities may require Us to disclose certain categories of personal data. The Sunny Companies provide the personal data of natural persons to authorities only in compliance with applicable law. In that case, the legal basis for the processing of personal data is the performance of an obligation arising from the law.

5. Rights of data subjects

1. 1. Marketing messages
      1. The Sunny Companies generally do not offer their products and services to new clients by way of mass posting and/or mass messages. However, if at times it is deemed necessary to send messages to a target client group or to current clients, you can always opt-out by:
      2. following the unsubscription instructions in the footer of each message, or
      3. contacting us at the e-mail address info@sunnybusiness.ee.
   2. General rights
      1. Data subjects have the right to request access to, rectification, or erasure of their personal data or restriction of processing and to object to the processing as well as the right to data portability.
         1. The right to rectification means the data subject’s right to the rectification of inaccurate personal data concerning him or her without undue delay.
         2. The right to erasure means the data subject’s right to the erasure of personal data concerning him or her without undue delay, provided certain additional requirements are met.
         3. In certain cases, the data subject has the right to restrict the processing of his or her personal data.
         4. The data subject has the right of access to personal data which We retain concerning him or her and which he or she has provided to Us, and the right to transmit this data to another controller if it is technically feasible and the processing is based on consent or on a contract and carried out by automated means.
         5. The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of his or her personal data which is based on the relevant provisions of law, including profiling based on those provisions.
         6. Unless otherwise provided by law, the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
         7. Where the processing of personal data is based on the data subject’s consent, the data subject has the right to withdraw the consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
      2. Data subjects also have the right to lodge a complaint with a supervisory authority.
      3. Should you choose to exercise those rights, We kindly ask you to contact Us at the address info@sunnybusiness.ee or inform Us by calling +3726841400.

6. Security and retention period of data

1. 1. The secure storage of data is the highest priority for Sunny Companies. We have done everything possible to avoid unauthorized access to and disclosure, loss, or other unlawful processing of data. We protect the confidentiality and integrity of personal data and We ensure access to data in compliance with applicable law. To protect personal data collected and processed by Us, We have taken reasonable and sufficient organizational measures and set technical and physical restrictions. The measures applied to depend on the category of personal data and the possible effects of its disclosure.
   2. The storage and retention of all data retained by the Sunny Companies (including personal data) take place on the territory of the Republic of Estonia either in Our own servers and/or under a contract in servers of verified cooperation partners. We and Our cooperation partners have taken high level technical, physical and organizational measures necessary to ensure security:
      1. Verified physical and system-based access only by persons with relevant authorization;
      2. Making of backup copies;
      3. Keeping of user logs, if necessary;
      4. Use of firewalls to avoid unwanted access;
      5. Constant monitoring by the system administrator for making security updates;
      6. Non-disclosure agreement with all employees using the systems.
   3. The work organization of controllers and processors is set up so that the work computers of employees are only used to carry out the process of providing the service of data processing. Processed data is stored in file servers with the highest level of security, which can only be accessed by those liable for and carrying out the processing.
   4. The Sunny Companies retain personal data only for as long as necessary to achieve the purpose for which the data was collected. The retention period also depends on the need to reply to data subjects’ inquiries, solve problems and comply with requirements for document retention arising from the law. When We no longer need personal data and the law does not require the retention thereof, We erase the data without delay.

7. Sunny Companies as controllers or processors

1. 1. Provision of services
      1. The Sunny Companies provide various services to their clients. Generally, the provision of such services entails the processing of (personal) data obtained from Our clients (for example, accounting and wage data which may also contain personal data or personal data of private persons or employees of companies who buy Our services, which is retained in the economic software used by Us or in databases in file servers). In that case, We only process data for the purposes determined by Our clients and the controller is Us or Our client.
      2. The Sunny Companies are mostly processors of personal data and We process personal data only on behalf of Our client and under the client’s instructions. The relationship between and the rights and obligations of the processor and controller (meaning the Sunny Companies and their clients) are also determined, if necessary, in a personal data processing agreement. If the Sunny Companies are the controller, We strictly comply with the requirements arising from Regulation 2016/679 of the European Parliament and of the Council.
   2. Obligations of Sunny Companies as the processor and the client as the controller
      1. If the controller is Our client, the legal basis for the processing of personal data shall be determined by the client.
      2. The controller is also required to assess and manage the risks involved in the processing of personal data and perform duties related to notifying data subjects. As the processor, the Sunny Companies perform a significant portion of the controller’s duties since Our services are part of personal data processing, the compliance of which with the law must be ensured by the controller. If the Sunny Companies process personal data on behalf of their clients (meaning as the processor), We operate in compliance with applicable provisions of law that govern the operation of processors.
      3. The Sunny Companies and the client who is the controller shall cooperate to ensure the prescribed protection of data subjects. If necessary, We provide the client with the information necessary for compliance with the applicable personal data protection law.

8. Subcontractors and export of personal data

1. 1. We use subcontractors for the processing of personal data but We do not export personal data outside the European Union. For example, our contractual subcontractors are Estonian providers of cloud computing services and other IT services. The Sunny Companies enter into a data processing agreement with each and every subcontractor and verify the compliance with the terms and conditions of the contract in order to protect personal data and perform their obligations toward their clients.
   2. If you would like more information about the possible use of subcontractors in the provision of services to you, We kindly ask you to contact Us as set out under ‘Contact Details’.

9. Amendements to notice

1. 1. For the purpose of increasing security or complying with amendments to the law, Sunny Companies may amend or adapt this Privacy Notice at any time. Should We do so, We shall publish the revised Notice here with a new version date. We may notify you of significant changes in Our Privacy Notice and privacy principles before they take effect by way of e-mail, announcement on Our website, and/or on Our social media sites. Nevertheless, please visit this site from time to time to keep up to date with minor changes in the Privacy Notice.

10. Our contact details

1. 1. We value your feedback, opinions, and suggestions. If you have any problems, comments, or questions, please contact Us at the address info@sunnybusiness.ee. You can also contact Us through regular mail at the address Järvevana tee 9-40, Tallinn 11314, Estonia, or by calling +372 6841 400.