1. processing of personal data

Personal data

Personal data is any information relating to a specific or identifiable natural person that reveals the physical, mental, physiological, economic, cultural or social characteristics, attitudes and relationships of that person.
Processing of personal data means any operation that is performed on personal data, including collection, recording, organisation, modification, storage, transmission and erasure.

NB! The following information does not apply to:

  • processing of data of legal entities and organisations, as well as processing of data of a natural person, if the processing is carried out within the scope of his/her official duties;
  • Processing of personal data on websites linked to the website of the JSC ‘Narva Museum’ but not operated by the museum (external links).

2 Grounds for processing personal data

The Narva Museum processes personal data either on the basis of consent or on the basis of law. Legal grounds must exist for the processing of personal data in accordance with the Regulation on Personal Data Protection:

1) an individual discloses his/her personal data or gives consent.

  • Consent is linked to a specific purpose,
  • Data collected for one purpose cannot be used for another purpose without new consent,
  • consent must be demonstrated by the user of the personal data,
  • consent can be withdrawn

2) by law, without consent

  • Either explicitly stated in law or necessary to fulfil a statutory purpose,
  • for the performance of a contract, including an employment contract (except for sensitive personal data),
  • for journalistic purposes in the public interest, including blogs and online commentary,
  • for academic, artistic or literary expression,
  • recording in a public place,
  • debt data for legitimate interests,
  • for the protection of life, health, property, rights and freedoms, including surveillance cameras,
  • scientific, statistical.

The Personal Data Act and the legal basis requirement do not apply if you use personal data for private purposes.

3 Processing of personal data by the Narva Museum JSC

3.1 Visiting the website of the JSC Narva Museum www.narvamuuseum.ee.

When visiting the website, the data collected and stored about the visitor is limited to the Internet address (IP address) of the computer or computer network used, the name and address of the Internet provider of the computer or computer network used, the time of the visit (time, date, year).

IP addresses are not linked to any personal information. Data is collected on what part of the website is visited and for how long. The data collected will be used to gather visitor statistics in order to develop the website and improve its user-friendliness.

3.2 Requests for clarification, notices, requests for information and other correspondence.

In the course of its activities, the Narva Museum JSC also processes personal data, including confidential and private information. Such data may become known to the institution as a result of correspondence, applications or enquiries. The protection and lawful processing of personal data in the museum is ensured through the application of organisational and IT security measures.

Personal data is processed for the purposes of responding to enquiries and processing applications or requests. If this requires contacting a third party, personal data is disclosed to the extent strictly necessary. Correspondence with private individuals will normally be subject to access restrictions.

Correspondence with private individuals will be kept in the museum for five years. Documents exceeding this period will be destroyed.

3.3 Applying for a job at the Narva Museum AS

When selecting a candidate for a job, Narva Museum JSC will base its selection on published information about the person and open sources. The candidate has the right to know what information the museum has collected about him/her. The candidate also has the right to familiarise himself/herself with the collected data, give explanations and raise objections.

Only employees involved in the hiring process have access to the documents submitted at the time of hire. These documents and data will not be passed on to third parties. The Museum assumes that persons identified by the candidate as his/her references may be contacted without asking permission.

Candidates' documents are restricted information to which third parties (including competent authorities) may have access only in cases provided for by law.

3.4 Complaints or objections

When making a complaint or objection, you should be aware that in some cases your personal data - in particular your name and the fact that you have made a complaint or objection, and in some cases its content - may be disclosed to third parties or your name and the fact that you have made a complaint or objection may be disclosed in our document register. Details of correspondence will be published there in accordance with the Public Information Act (name of the sender and recipient of the letter and type of letter: ‘Complaint’ or ‘Objection’). If you so wish, your name and surname will not be entered on the register of documents, only your initials or the indication ‘Private Individual’.

A general access restriction applies to correspondence with a private person: if someone wants access to your correspondence and requests information, we will assess whether disclosure of part or all of your complaint or grievance (and your response) would cause substantial harm to your privacy, or whether your complaint or grievance and response contain other restricted information. The grounds for restricting access are set out in section 35 of the Public Information Act. Your personal contact details such as your email address, telephone number or home address will not be disclosed (unless you represent a legal person or body).

The personal data contained in your complaint will be used to deal with it. If it is necessary to make enquiries to other individuals or bodies in this regard, no more of your personal data will be disclosed to them than is necessary to prepare a response.

We will also use your correspondence to assess the quality of our establishment and compile statistics (this may also be done by the processor). Such statistics and summaries will be published without naming names.

If you have made a complaint to us or the processors or a complaint to which another body is authorised to respond, your communication will be forwarded to that body. You will be informed accordingly.

4. the right to access your data. The right to request the correction or erasure of inaccurate data

Everyone has the right to access personal data collected about him or her. A request for access will be refused if it could:

  • adversely affect the rights and freedoms of another person;
  • prejudice the rights of a person or infringe personal data;
  • prevent or hinder the commission of a criminal offence or criminal offences;
  • jeopardise the protection of the confidentiality of a child's pedigree.

Everyone has the right to request the correction of inaccurate personal data. This is done by submitting a request signed in person or digitally.

If the museum does not have a legitimate reason for using personal data, the individual has the right to request that the personal data be discontinued or deleted. To do so, a request must be submitted in writing or digitally signed.

The individual has the right to file a complaint or objection against the decisions and actions of the museum and to appeal to the administrative court.

5.  Data Protection Officer

If you have any questions regarding the processing of your personal data by the museum, please contact our data protection officer. The Museum's Data Protection Officer can be contacted at: kantselei@narvamuuseum.ee.