Burger King Baltics Privacy Policy

INTRODUCTION

This is the privacy policy (“Privacy Policy”) of Tallink Fast Food OÜ (“Tallink Fast Food”) and its subsidiaries that presents the ways Tallink Fast Food processes its customers’ and other data subjects’ personal data at its disposal.

Contact details of Tallink Fast Food’s subsidiaries are:

  • Tallink Fast Food Lithuania UAB, registration code 305333905, Jogailos g. 9, LT-01116 Vilnius, Lithuania, info@burgerking.lt
  • Tallink Fast Food Latvia SIA, registration code 40203231882, Eksporta iela 3A, LV-1010 Riga, Latvia, info@burgerking.lv

Personal data processing in the context of this Privacy Policy means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruct; any activity carried out with personal data.

Personal data in the context of this Privacy Policy means any information related to a data subject that can be used to directly or indirectly identify the person, such as name, e-mail or contact address.

Tallink Fast Food processes personal data subject to the principles laid down in this Privacy Policy and in the applicable law.

This Privacy Policy does not concern or protect the processing of anonymous information or information about legal persons.

PERSONAL DATA CONTROLLER

Name of the controller: Tallink Fast Food OÜ

Company registration code: 14775213

Address: Sadama 5, 10111 Tallinn, Estonia

Contacts: telephone +372 640 9810, e-mail info@burgerking.ee

Personal data controller is a legal person which determines the purposes and means of the processing of personal data.

Personal Data Processors

Tallink Fast Food’s data processors are the third parties with whom we may need to share personal data to help us provide services and products to you. Tallink Fast Food’s data processors include:

  • our parent company, subsidiaries or affiliates;
  • our third party partners who process personal data on our behalf to help us run some of our internal business operations;
  • law enforcement bodies in order to comply with any legal obligation.

Data Protection Officer

In order to ensure high level of personal data protection, Tallink Fast Food has designated a Data Protection Officer (“DPO”) with expert knowledge of data protection law and practices. DPO assists Tallink Fast Food in maintaining personal data protection compliance.

The DPO serves as a contact point for data subjects in case of requests and/or questions related to personal data protection and personal data processing. Data subjects may contact the DPO with regard to all issues related to processing of their personal data and to the exercise of their rights.

Tallink Fast Food DPO’s contact details are:

Data Protection Officer

Sadama 5, 10111 Tallinn, Estonia

dpo@tallink.com

PRINCIPLES OF PERSONAL DATA PROCESSING

Transparency

Tallink Fast Food processes personal data in a fair and transparent manner and only when we are allowed to process personal data according to the law.

Purpose limitation

Tallink Fast Food collects personal data for specified, explicit and legitimate purposes. We will not further process personal data in a manner that is incompatible with the initial purposes. When processing Your personal data for a purpose other than the initial purpose, we rely on the legal bases originating from the law (e.g. when receiving requests from courts or law enforcement authorities) or we ask for Your approval for processing Your personal data for a purpose other than for which You originally provided us with Your personal data.

Data minimisation

Tallink Fast Food is doing its best to ensure that personal data processed by Tallink Fast Food is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

Accuracy

Our aim in Tallink Fast Food is to ensure that personal data shall be accurate and kept up to date where necessary. Tallink Fast Food shall take every reasonable step to ensure that inaccurate personal data will be erased or corrected without delay. If the personal data should prove to be false, Tallink Fast Food gives You the possibility to correct and/or delete it. To do so, please write to privacy@burgerkingbaltics.com.

Storage limitation

Tallink Fast Food keeps personal data in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

Integrity and confidentiality

Tallink Fast Food processes personal data in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing. Tallink Fast Food will take all reasonable measures in its power against accidental data loss, destruction or damage. Tallink Fast Food uses technical and organizational measures to enhance security when processing personal data. For raising awareness and knowledge about personal data protection in Tallink Fast Food, privacy trainings are organized for Tallink Fast Food employees who handle personal data. In addition, our employees are bound by obligation of confidentiality and we do everything in our power to keep personal data safe with us. Tallink Fast Food employees may access and use personal data only if they are authorized to do so and only in compliance this Privacy Policy.

Special categories of personal data

Tallink Fast Food normally does not process special categories of personal data (sensitive data such as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, data concerning health). Tallink Fast Food only processes such type of personal data when there exists a legal basis for that, for example if we are obligated or allowed by law to process this kind of sensitive personal data.

Data protection by design and by default

When developing, designing, selecting and using applications, services and products that are based on the processing of personal data or process personal data, Tallink Fast Food takes into account the data subject’s right to personal data protection.

DATA SUBJECT’S RIGHTS

Respecting data subject’s rights is of importance to Tallink Fast Food and therefore handled with special attention. When requested by the data subject, the information about that specific data subject will be provided by Tallink Fast Food. Please note that we need you to prove who you are before we can help you with any request related to personal data.

This means that, when looking through your request and in case of doubt, Tallink Fast Food may ask additional information to be provided by you for data subject’s identification. We do this to be sure about the data subject’s identity and to ascertain that we provide the correct information to the right person.

If the purposes for which Tallink Fast Food processes personal data do not or do no longer require the identification of a data subject, Tallink Fast Food will not be obligated to maintain, acquire or process additional information in order to identify the data subject. Upon data subject’s request and if possible, Tallink Fast Food will inform the data subject accordingly about this kind of processing.

Right of access by the data subject – You have the right to access personal data which is processed by Tallink Fast Food. This enables you to be aware and verify which type of personal data and how Tallink Fast Food processes. You can also turn to Tallink Fast Food and ask for which purposes we process personal data if it remains unclear or you would like to ask additional questions from us. We aim to answer as soon as possible but we try to do this no later than in one month. In more complex requests we might need to extend the answering time by a further two months. In the latter case, we will contact you about the extension of the answering period and explain the reasons. To ask us questions related to data processing, please write to privacy@burgerkingbaltics.com.

Copies – Tallink Fast Food will provide a copy of your personal data of upon your request free of charge. For any further copies requested, Tallink Fast Food may charge a fee based on actual costs if the requests from a data subject are of repetitive character. Tallink Fast Food may refuse to disclose the data in a copy entirely or refuse to provide a copy when this disproportionately affects the rights and freedoms of other data subjects and less strict measures cannot be taken.

Right to rectification – every data subject who notices that his/her personal data is not up-to-date, false or needs to be corrected can turn to Tallink Fast Food and have this data rectified and corrected. You can also have your incomplete personal data completed. Tallink Fast Food will make sure this personal data will be corrected as soon as possible. In order to have this done, you are welcome to contact us by writing to the e-mail address privacy@burgerkingbaltics.com.

Right to erasure (“right to be forgotten”) – this right allows data subjects to have their personal data erased where one of the following grounds applies:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or processed;
  • when the data subject withdraws consent;
  • the data subject objects to the processing and there is no overriding legitimate interest for the processing;
  • the personal data have been unlawfully processed;
  • the personal data have to be erased in order to comply with a legal obligation or because the personal data was processed in relation to the offer of information society services (e.g. apps) to a child.

Right to erasure is not an absolute right and therefore your request to have your personal data erased may not mean that all of your data will be erased after the request. Sometimes we are obligated by law to retain some data and in cases like this we might not be able to satisfy your request to erasure. This can also be the case when we need to retain this data for the exercise or defence of legal claims.

Right to restriction of processing – when exercising this right, data subjects may “block” or suppress the processing of personal data by Tallink Fast Food. As a result of that, Tallink Fast Food may be permitted to only store the existing personal data but not further process it. Tallink Fast Food restricts the processing of personal data upon request until the verification of accuracy or when you contest the accuracy of your personal data. Tallink Fast Food may also be obligated to restrict the processing of personal data, for example, when Tallink Fast Food no longer needs it, but you require the data to establish, exercise or defend a legal claim.

Right to data portability – You may use the right to receive the personal data concerning you, which you have provided Tallink Fast Food, in a structured, commonly used and machine-readable format. In exercising this right, you may use the right to have your personal data transmitted directly from one controller to another, where it is technically feasible.

Right to object – You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on legitimate interest, including profiling. In that case, Tallink Fast Food will no longer process the personal data unless Tallink Fast Food has a legitimate grounds for the processing the personal data.

Where Tallink Fast Food processes personal data for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing at any time and free of charge.

Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes by Tallink Fast Food. In this case, Tallink Fast Food stops processing Your personal data for marketing purposes but might not stop processing it for other lawful purposes.

The right to lodge a complaint with a supervisory authority – every data subject has the right to turn to a data protection supervisory authority with a complaint if the data subject considers that the processing of personal data relating to him or her infringes and is not in accordance with provisions foreseen by the data protection laws and GDPR. The national supervisory authority in Estonia is “Andmekaitse Inspektsioon”, in Latvia “Datu Valsts Inspekcija” and in Lithuania “Valstybinė Duomenų Apsaugos Inspekcija”.

The right to withdraw consent – if the personal data processing is based on consent, the data subject has the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. Tallink Fast Food will stop processing personal data if the sole basis for the processing is consent. If there exist other legal ground(s) for personal data processing (e.g. contract, legitimate interest) the processing may be continued based on this other legal ground.

PURPOSES OF PROCESSING OF PERSONAL DATA

Tallink Fast Food processes the collected personal data in accordance with applicable data protection laws and, among others, for the following purposes:

  • to fulfill your orders and process payments for Tallink Fast Food products and services;
  • to send you communications about your orders, purchases or accounts;
  • to send you advertising communication about products and services of Tallink Fast Food’s or its business partners;
  • to personalize your experience on Tallink Fast Food websites or mobile applications in order to provide you with content that may be of interest to you or make it easier to navigate the Tallink Fast Food’s websites and mobile applications;
  • to conduct data analysis, including consumer research, trend analysis and financial analysis to improve Tallink Fast Food’s products, offering, promotions, the websites and mobile applications and other technologies;
  • legal purposes and legal obligations;
  • receiving and handling client feedback;
  • applying security measures and for solving incidents.

CATEGORIES OF PERSONAL DATA PROCESSED

Tallink Fast Food collects personal data such as first name and surname, delivery address, email address, phone number and date of birth only (i) insofar as these are provided by you on a voluntary basis and (ii) to the extent such a collection is permitted by law or covered by your consent. The same applies to the transmission to Tallink Fast Food of personal data that you enter into any Tallink Fast Food website or mobile application, such as:

  • transaction information, including product purchase, price, method of payment, and payment details;
  • account information, including username and other personal information or login credential to use the Tallink Fast Food websites and mobile applications;
  • other personal data voluntarily revealed to Tallink Fast Food by data subjects (e.g. personal data provided to Tallink Fast Food by customers in customer feedback forms).

LEGAL BASES FOR THE PROCESSING OF PERSONAL DATA

Tallink Fast Food processes personal data on several legal bases which are the following.

Consent

Tallink Fast Food may process personal data on the basis of a consent. For instance, for sending the Tallink Fast Food newsletter, Tallink Fast Food first asks for a consent for subscription and after you have subscribed, your consent serves as a legal basis for sending the newsletter.

In relation to information society services (e.g. using Tallink Fast Food mobile apps) data protection regulations set stricter rules and conditions to child’s consent. Where child is below the age of 13 years or below another age laid down in the applicable law, such processing shall be considered lawful only if that consent is given by the child’s parent or the holder of parental responsibility over the child.

Contract

Tallink Fast Food may process personal data if the processing is necessary for the performance of a contract. For instance, Tallink Fast Food processes personal data for billing purposes when you buy our products in order to fulfil a contract and deliver the goods you have ordered.

Legal obligation

Tallink Fast Food may process personal data if the processing is necessary for compliance with a legal obligation.

Vital interests

Tallink Fast Food may process personal data if the processing is necessary in order to protect the vital interests of the data subject or of another natural person. For example, Tallink Fast Food personnel might need to forward data subject’s health data to hospital in case somebody unexpectedly falls ill within Tallink Fast Food premises to provide the necessary medical care and protect our customers and employees’ health the best possible way.

Legitimate interests

Tallink Fast Food may process personal data if the processing is necessary for the purposes of the legitimate interests. For example, if you have brought products from us, we can send you customer satisfaction surveys to improve the quality of our service.

PROFILING AND MARKETING

Profiling in Tallink Fast Food represents itself of any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a data subject. In Tallink Fast Food, profiling may be carried out, for instance, to analyse or predict aspects concerning customer’s personal preferences, interests, behaviour, location or movements. As a result of profiling, Tallink Fast Food is determined to make offers, for the best services and goods to Tallink Fast Food customers on the basis of a consent, contract or legitimate interest in order to satisfy all the needs of Tallink Fast Food’s customers.

Tallink Fast Food may use different ways of profiling. For making offers, Tallink Fast Food distinguishes receivers of the offers for example on the ground of language, place of residence (to send the offer in an understandable language and to target customers in particular region), age (to make an offer most suitable for certain age group), previous purchases (to send offers about the products customer prefers the most).

Where personal data is processed for the purposes of direct marketing, data subjects may “opt-out” from having his or her personal data used for such purposes and exercise the right to object to processing for direct marketing purposes. For example, if Tallink Fast Food sends you a newsletter with different offers and you no longer wish to receive them in the future, you have always the chance to opt-out from receiving these offers. Customers are welcomed to express their wish to receive these offers again in the future after withdrawal of such offers.

Tallink Fast Food may send advertisements or display them on Tallink Fast Food website to its customers regarding its own services or those of its subsidiaries, or customer satisfaction questionnaires for the purpose of improving service quality, or the offers of other business partners. Customers may refuse to receive such advertisements, questionnaires and offers at any time by informing Tallink Fast Food via links for automated refusals.

THE USE OF „COOKIES“

Cookies are files that collect various technical information about a user’s device, browser, and site usage, such as the pages on which the user has visited and in which order. Tallink Fast Food uses cookies that are purely of technical nature (e.g. for statistics) and cookies that can identify guest users, facilitate and personalize the sign-up and movement of visitors on the site, and measure and analyse user habits. Cookies allow the website to remember information about data subject’s visit, e.g. preferred language and other settings.

When Tallink Fast Food customers are using Tallink Fast Food services, Tallink Fast Food and external service providers and partners may send cookies or similar technology to user’s device to enhance and develop user’s online experience. However, you can also set your browser settings in such a way that it informs you when you receive a cookie or automatically declines to accept it. Therefore, you can decide for yourself whether you wish to accept cookies or not. At the same time, please be aware that some Tallink Fast Food website features or services may not function properly without cookies.

Tallink Fast Food’s website may also use various tracking and analytics tools to gather information, analyze and measure the use of the site or the effectiveness of Tallink Fast Food’s communications or advertising, i.e. how Tallink Fast Food’s communication reaches to customers.

SAFEGUARDS

Tallink Fast Food keeps all personal data revealed to it strictly confidential and protects customers’ and employees’ personal data from illegitimately falling into the hands of third parties by applying effective IT security measures.

Tallink Fast Food uses safeguards which take into account the nature, scope, context and purposes of the processing and the risk to the rights and freedoms of natural persons. These measures include inter alia appropriate IT, technical and organisational data protection measures, pseudonymisation and anonymization. Such measures are put in place to ensure that by default personal data are not made accessible to an indefinite number of persons where there is no will for that and to ensure personal data protection in general. In addition, when using CCTV, Tallink Fast Food displays signs, which are visible and readable to data subjects.

IMPLEMENTING PROVISION

Taking into account possible changes in legislation, case law and developments in the practices of technologies ensuring high level of personal data protection, Tallink Fast Food reserves the right to make changes to this Privacy Policy. Therefore, this Privacy Policy is subject to a periodical review and possible changes where necessary. We will post any Privacy Policy changes on Tallink Fast Food webpage and, if the changes are significant, we will provide a more prominent notice (for example email notification of Privacy Policy changes). We will also keep prior versions of this Privacy Policy in an archive.