Personal data processing

Personal data means any information based on which a natural person can be directly or indirectly identified.

The information on the processing of personal data applies to the personal data of natural persons. Therefore, the information provided in the Privacy Notice does not apply to the data of companies or other legal entities or institutions. However, the information provided in the Privacy Notice applies to the personal data of all natural persons engaged in professional and occupational activities (e.g. company employees). For example, if you interact with Elering as a person related to our client, we will also register and use data relating to you (personal data) at Elering. You may be related to our client, for example, as a member of the management board, authorised signatory, employee, or other related third party.

The following is a list of the data we collect and use:

• electricity and natural gas consumption and production data in accordance with the law, including operational statistics on renewable energy;
• personal data shared with a supplier, aggregator and other energy service provide opened in the Elering Customer Portal on the basis of the consent service;
• contact details for landowners affected by the building protection zone whose immovables are crossed by power lines/gas pipelines owned by Elering or the protection zone in order to fulfil the landowners’ notification obligation arising from the law, including the provision of safety information;
• data related to the processing and disbursement of applications for toleration fee for utility networks;
• personal data related to the entry into agreements on the right of use of land;
• personal data arising from communication with landowners when carrying out work in the building protection zone (power line, power cable or gas pipeline, substation, etc.);
• data related to the processing of applications for renewable energy support and payment of support;
• personal data related to the issuance of guarantees of origin;
• personal data necessary for the use of and generated by Elering’s online environments;
• surveillance equipment (e.g. security camera recordings) for immovables owned by Elering, including the administrative building;
• visitor registration data to Elering’s administrative building;
• contact details of the representatives of the contractual partners to be provided in the performance of contracts related to the obligations of the system operator and the transmission system operator;
• contact details of recipients of the newsletter and press releases;
• personal data included in messages sent to customer service (general telephone and e-mail).

We use the data for the purpose for which we have collected the data and to the extent necessary to fulfil that purpose. Once the purpose is fulfilled, personal data is deleted or anonymised.

• Compliance with a legal obligation

Elering, as the system operator for both electricity and gas, maintains and manages the electricity market data exchange platform and the gas market data exchange platform in accordance with the law. As such, Elering processes personal data in both the electricity market and the gas market. In particular, this data includes the person’s name, personal identification code, metering point address, metering point code, but also consumption and production data. The purpose of processing the described personal data is the obligation imposed on Elering as a system operator to ensure the efficient functioning of both the electricity and gas markets and to promote competition in the energy market as an independent party. You can see information about the processing of relevant data, i.e. energy consumption data of your metering points and data on contracts entered into with energy service providers and grant third parties the rights to see your data and represent you as well as monitor who has access to your data and who has used the data in Elering’s customer portal.

In addition, to perform a task carried out in the public interest, Elering has created additional e-environments or web solutions that simplify data exchange and ensure faster communication with Elering. Such environments include, for example, the renewable energy information system GREEN, the transmission system connection portal EGLE, and the biomethane information system for producers and sellers. In addition, it is convenient for landowners to submit an application for toleration fees for utility networks to Elering through the portal for network service, landowners and contractors. In these online environments, Elering processes personal data to perform the tasks set out in the Electricity Market Act, the Energy Sector Organisation Act and the Law of Property Act Implementation Act and for the purposes and to the extent provided for by law.

In addition, Elering has other obligations arising from the law, which mainly arise from being the owner of the electricity and gas transmission system. To perform its obligations arising from the law, Elering collects and uses personal data only to the extent necessary to comply with this purpose. For example, in accordance with the law, Elering collects data on landowners whose property has power lines or gas pipelines owned by Elering or whose property is affected by a building protection zone. Elering uses the data to contact the landowner to agree on maintenance or construction work in the protection zone. Elering obtains contact details of the respective landowner by making inquiries to the land register, commercial register, and population register.

Within the framework of the obligation arising from the law, Elering also processes personal data when making payments of toleration fees for utility networks in accordance with the application submitted by the owner of the immovable. The processing of personal data for the payment of toleration fees consists of verifying the data provided in the application and making the payment.

If you visit Elering’s administrative building in Tallinn, we register the personal data of all visitors in accordance with the Government of the Republic Regulation “Procedure for the protection of national defence objects”.

• Performance of a contract

Elering also processes your personal data if you enter into a contract with Elering. Such cases mostly involve deforestation agreements entered into with landowners, agreements establishing personal right of use, or other agreements governing the use of an immovable. In such a case, Elering uses personal data to draw up the respective contracts and, following the entry into the contract, to perform the obligations assumed under the contract or to exercise the rights arising from the contract.

If you apply for a job at Elering, Elering processes the CV and motivation letter submitted by the applicant as well as their contact details for the purpose of recruiting new employees and preparing to enter into an employment contract with a suitable candidate. Elering retains the aforementioned data for one year pursuant to the Equal Treatment Act.

• Consent-based data processing

Consent-based data processing means that Elering does not process your data in accordance with law or contract, instead you have given your consent to the processing of your data. Elering carries out such processing of personal data in its customer portal. We have established terms of use for data processing based on consent in the customer portal, which give you an overview of the terms and conditions under which your data can be shared with various energy service providers based on consent. You are notified of the terms of use when you first log in to the customer portal, and you can review them at any time. Based on consent, we can share your consumption and production data in the customer portal with an energy supplier, aggregator or other energy service provider. Consent is voluntary and you can withdraw it at any time. You can find the respective instructions in the customer portal.

In addition, based on your consent, you can subscribe to Elering’s newsletter or press list and withdraw this consent at any time by clicking on the link at the bottom of the subscribed e-mail.

• Legitimate interest

Use of tracking devices

Ensuring the security of electricity and gas supply throughout Estonia is a task of vital importance. Therefore, Elering’s buildings and facilities (e.g. substations) are subject to strict requirements for ensuring security and safety. In order to comply with the requirements and ensure the safety of the electricity and gas system, Elering has a legitimate interest in using surveillance equipment in the form of security cameras and access systems to ensure the physical security of the electricity and gas system and also, if necessary, to check compliance with the requirements related to maintenance and construction activities related to the facilities. Signs inform you that video surveillance is in use on the premises.

Providing customer support service

Based on legitimate interest, Elering also processes your data when you contact us via the general telephone number (715 1222) or general e-mail address ([email protected]). When you call a public telephone, your call is recorded to ensure better service. We want to address your concerns and questions as promptly and efficiently as possible, and recording calls allows us to replay the call in order to resolve your complaint based on the most accurate information possible. The file with the call recording related to the resolution of your request is deleted after 60 days, the information on your written request is made anonymous 60 days after you have received a response and deleted 90 days after anonymisation.

Conducting research

In certain cases, Elering has a legitimate interest in learning of the opinions of Elering’s target groups on issues related to energy and Elering in order to make better management decisions, provide higher quality service, and provide related parties with more understandable information on topics related to energy and Elering’s activities. To fulfil this purpose and based on legitimate interest, Elering may conduct sociological research. When conducting research, the right of individuals to not participate in research and their request to leave the target group are taken into account.

Sending newsletters and press releases

Elering has a legitimate interest in providing information about Elering’s activities directly to the members of its target group (market participants, subscribers and other partners) so that they have relevant information from a primary source that helps them to better organise their work, including providing operational information to the press. The information that Elering provides is industry-specific and the personal data processed is mostly professional contact details of individuals (e.g. contact details of the ministry, electricity/gas undertakings, journalists). Each data subject has the option to opt out of receiving newsletters/press releases at any time.

Distributing informative information on the gas and electricity market to market participants

Elering has a legitimate interest in sending invitations and materials from the electricity and gas market advisory board to market participants. Advisory boards are needed to provide information and feedback on market developments affecting market participants. Only the minimum data necessary for the advisory board to identify individuals and send information is processed.

Processing of personal data of representatives of contractual partners and contact persons for contracts

If you are a representative of Elering’s contractual partner (for example, a member of the management board or under a power of attorney) or a contact person for a contract, Elering has a legitimate interest in processing your personal data to ensure the performance of the contract and, if necessary, to exercise its rights and obligations (including, if necessary, to submit legal claims). The period for storing data depends on the term and type of contract, and in certain cases, the storage period is determined by law (for example, the Accounting Act).

Conducting safety training and knowledge tests

Elering has a legitimate interest in ensuring safety at all of its facilities. Elering also has the respective obligation under section 4 of the Equipment Safety Act, according to which the safety of human life and health, property and the environment must be ensured upon using equipment and upon performing equipment work. To ensure safety, all measures required for preventing, identifying, countering and eliminating a threat as well as for mitigating adverse consequences in the event of an accident must be taken. As one of the safety measures, Elering implements a knowledge test of persons present at the site to ensure compliance with the necessary safety requirements and awareness of being in the hazard zone. The results of the knowledge test are stored for four years, and Elering uses the Moodle environment as a service partner to carry out the knowledge test.

Ensuring the cybersecurity of Elering’s data and information systems

Elering has a legitimate interest to prevent cyber incidents, identify incidents and, if incidents occur, respond to them immediately, including determining the scope of the incident, limiting the spread of the incident, and informing the persons affected by the incident. According to the purpose, Elering may, if necessary, process the data of persons using Elering’s public information systems.

Background check

On the basis of legitimate interest, Elering may, in certain cases, conduct background checks of its partners (e.g. representatives of contractors, subcontractors at sites) in order to carry out a risk analysis. In such cases, Elering may request data, for example, from the Criminal Records Register, the Payment Default Register, the Tax and Customs Board, Official Announcements, the Commercial Register, Riigi Teataja, and other public sources. The legal basis for the processing of personal data is Elering’s legitimate interest in ensuring the security of national defence objects. Based on the definition of an object under the Government of the Republic Regulation “Procedure for the Protection of National Defence Objects” and the results of the risk analysis conducted, Elering has the right to deny a partner’s representative access to the site.

Elering ensures the confidentiality of personal data within the framework of applicable law and implements appropriate technical and organisational measures to protect personal data against unauthorised access, unlawful processing or disclosure, accidental loss, alteration, or destruction.

Like many online environments, Elering also uses cookies on its websites. Cookies are small text files that are downloaded to the user’s computer via the e-environment server. More information about how and which cookies Elering uses can be found on the page: https://elering.ee/en/cookies.

In some cases, Elering may use its contractual partners to process personal data who perform personal data processing operations to achieve the main obligation specified in their contract. Such cases include maintenance and construction work on power lines and gas pipelines where Elering’s contractual partner organises communication with the owner of the immovable to carry out the work and obtain the necessary agreements. Elering also uses contractual partners to provide services that Elering cannot provide itself (e.g. IT development services, postal services, services to look for staff, call centre services, security services). Elering’s contractual partners are obligated to comply with all the rules established for the processing of personal data, which Elering also complies with.

Elering does not use or store personal data for longer than necessary to perform its legal duties, to perform an agreement between the parties, or to establish legal claims. The storage period may be based on contracts, Elering’s legitimate interest, or applicable law (e.g. laws related to accounting, data storage periods associated with the system operator’s obligations, or statutory limitation periods).

Right of access to your data

You can always access the personal data collected and used about you, its sources and the purposes for which it is used. You can also obtain information about how long Elering stores data and to whom and to what extent it discloses it. Right of access to your personal data may be restricted by legislation, the rights of other persons to ensure their privacy, or other justified needs (e.g. Elering’s know-how, business secrets, internal assessments and materials).

Right to rectification of your data

If your data is incorrect, incomplete or irrelevant, you have the right to request the correction or deletion of your data, taking into account the restrictions arising from applicable legislation and the rights related to data processing.

Right to object

The right to object to the processing of personal data concerning you, including when Elering bases its processing on its legitimate interest.

Right to restriction of processing of data concerning you

The right to restrict the processing of your personal data based on applicable law, for example while Elering assesses whether the individual has the right to have their data erased, except in cases where it is necessary to process data for compliance with a legal obligation or for the performance of a task carried out in the public interest.

Right to be forgotten

If personal data is processed based on your consent and you have withdrawn your consent, you have the right to request the deletion of your personal data. This right does not apply if the personal data that you request to be erased is also processed on another legal basis, such as for the purpose of performing a contract, complying with a legal obligation or performing a task carried out in the public interest.

Right to data portability

If Elering uses data based on your consent or based on an agreement and the data processing is automated, you have the right to receive a copy of the data in an electronic, machine-readable format.

If you have any questions regarding your rights related to the processing of your personal data or if you have any questions about how we collect and use personal data, please contact Elering’s data protection specialist using the following contact details: e-mail address: [email protected], phone +372 715 2271, address: Kadaka tee 42, 12915, Tallinn.

If you are not satisfied with how we process your personal data and your contact with our data protection specialist did not yield a satisfactory result, you can submit a complaint to us electronically to [email protected] or by mail to Kadaka tee 42, 12915, Tallinn.

You can also file a complaint with the supervisory authority, which in Estonia is the Data Protection Inspectorate, e-mail: [email protected], postal address: Väike-Ameerika 19, 10129 Tallinn, phone 6 274 135, website: www.aki.ee). The Data Protection Inspectorate is a state institution that can be contacted for consultation or assistance on issues related to personal data protection.