The Tartu City Government processes personal data in particular for the performance of public tasks, including the provision of services and the fulfilment of its obligations under the legislation. The tasks of the local government, during which the processing of personal data may also become necessary, arise in particular From § 6 of the Municipal Organization ActLink opens in new tab and other legislative acts.
In the performance of these tasks, personal data, including sensitive and private information, is collected by us. We strive with our internal organization of work to ensure that the private life of persons is hurt as little as possible.
In the following, we provide a concise overview of the general principles of the processing of personal data.
Our website provides a separate overview of how personal data is used in the provision of this service at each public service. The description of the service is accompanied by references to the legal basis legislation as well as specific information on what happens with the data within the framework of the service:
what personal data we collect and use;
in which information systems and environments we keep them;
where we can get your personal data
whether and to whom we provide the data
how long we store the data
which authorities and persons are involved in the processing of the data.
The service-based information complements the general data protection conditions and provides a more detailed explanation of the specific case. If the general information and the description of the particular service differ, the more accurate information provided at the service must be believed.
In the authorities and in the work of the municipal authorities, we disclose personal data only for the purpose of processing the matter and to the persons involved in the proceedings, to the minimum extent necessary to resolve the matter.
If someone wants to access a document that is subject to a restriction of access in accordance with the request for information, we will check whether the requested document can be issued unchanged or must be processed in such a way that the information with a restriction of access does not fall into the possession of third parties. Restricting access depends on the contents of the document.
Despite the restriction of access, we issue a document to an institution or a person with direct legal basis under the law to ask for it (e.g. an investigative body, an extrajudicial body or a court).
We are based on the principle according to which personal data are processed as long as it is necessary for the fulfilment of a specific purpose.
Specifically, the storage periods of the documents shall be established in the list of documents of the authorities and authorities of Tartu City. The documents shall be kept until the end of the retention period prescribed in accordance with the series or until the handover of the public archive. Documents that have exceeded the retention period will be destroyed. General storage periods for documents containing or capable of containing some personal data for example:
- residence notices are kept for 10 years;
- applications and basic documents for personal identification are kept for 10 years;
- social benefit payment documents will be kept for 5 years.
If there is a personal data breach and this poses a likely risk to a person's rights and freedoms, then we will notify the Data Protection Inspectorate of the breach. We will take measures to resolve the breach immediately.
If a breach is likely to result in a high risk to your rights and freedoms, then we will also inform you. The purpose of the notification is to allow you yourself to take the necessary precautions to mitigate the situation.
You have the right to access your personal data that we have collected about you. Your address to this effect will be answered by us within one month at the latest. We will issue the data about you, either on paper or electronically, as requested. In order to access personal data, we must be convinced that it is a person who is entitled to receive the corresponding data. For this purpose, we have the right to request the provision of additional information necessary for identification.
We refuse to comply with the request to access the data only if it may:
- damage the rights and freedoms of another person;
- undermine national security;
- prevent or impair the prevention, detection, processing or enforcement of penalties of an offence.
If the processing of personal data is based on prior consent, you have the right to withdraw the consent at any time.
You have the right to request the rectification of personal data concerning you if they have changed or for any other reason are inadequate, incomplete or incorrect. In addition, you also have the right to request the completion of incomplete personal data due to the purpose of the specific processing.
You have the right to request the restriction or deletion of the processing of your personal data in certain specific cases. In particular, if we do not have a (more) legal basis for the processing of personal data.
Your rights as a data subject are set out in more detail Articles 15 to 22 of EU Regulation 2016/679Link opens in new tab.
You have the right to object at any time to our decisions and actions as a challenge or to go to the administrative court. You also have the right to contact the Data Protection Inspectorate with a complaint.
The keeping of the data of legal persons and other authorities is not concerned by these explanations. They also do not include the processing of personal data on foreign network pages that are referenced on our network page (external links).
For questions concerning the processing of personal data, you can contact the data protection specialist at [email protected].