Processing of personal data

Privacy Notice of Elering AS

I. INTRODUCTION

Elering AS (hereinafter Elering) is an electricity and gas system operator and transmission system operator (TSO). In its activities, Elering may collect, use and store (i.e. processes) your data to comply with its duties and requirements arising from legislation, perform the agreements and contracts concluded with you, to use your personal data based on your consent or to provide better services. The protection of personal data is essential for Elering and we want you to be aware of what kind of data about you we may process, what kind of purposes we use it for, and what are your options and rights. We have included the respective information in this privacy notice (hereinafter the Privacy Notice).

We comply with the legislation of the Republic of Estonia and the European Union when processing your personal data as provided in this Privacy Notice.

For the sake of clarity, please note that the Privacy Notice only applies to the processing of personal data during the activities of Elering and does not reflect the processing of personal data by other companies (including companies engaged in electricity or gas services or activities).
 

II. WHAT CONSTITUTES PERSONAL DATA AND WHAT TYPES OF PERSONAL DATA DO WE PROCESS

Personal data means any information based on which a natural person is directly identified or indirectly identifiable. Information on the processing of personal data applies to the personal data of natural persons. The information submitted in the Privacy Notice therefore does not apply to the data of companies or other legal persons or institutions. However, the information provided in the Privacy Notice applies to the personal data of all natural persons engaged in professional activities (e.g. the employees of a company). For example, if you communicate with Elering as a person related to our client, we also register and use the data concerning you (personal data). You could be related to our client as, for example, a member of the management board, signatory, an employee, or any other related third party.

The following is a list of the data that we collect and use:

• data on consumption and production of electricity and natural gas as required by law, including operational statistics on renewable energy;
• personal data shared with a energy seller, aggregator and other energy related services on Elering’s Customer Portal under the consent service;
• contact details concerning landowners through whose registered realties power lines or gas pipelines belonging to Elering pass, to comply with the legal obligations to inform landowners, including to provide safety information;
• data concerning the proceedings and payments in relation to applications for tolerance payments for utility networks;
• personal data relating to the conclusion of agreements for the right to use land;
• personal data generated in communications with landowners when conducting works within the protected zone of a structure (power line, power cable or gas pipeline, substation, etc);
• data concerning the proceedings and payments in relation to applications for renewable energy subsidies;
• personal data related to the issue of guarantees of energy origin;
• personal data required for using the online environments of Elering and the personal data generated there;
• surveillance equipment on the properties belonging to Elering, including the headquarters (e.g. security camera recordings);
• registration data of guests visiting the headquarters of Elering;
• contact details of the representatives of contractual partners communicated upon the performance of contracts related to the obligations of the system operator and TSO;
• contact details of newsletter and press release recipients;
• personal data related to notices sent to the customer service (general telephone number and mailbox).
   

III.    ON WHAT GROUNDS AND FOR WHAT PURPOSES DO WE PROCESS PERSONAL DATA

We use data for the purposes for which we collected the data and, in the scope, necessary for fulfilling that purpose. Personal data are deleted or anonymised when the purpose is attained.

Performance of an obligation under law

Elering, being a system operator for both electricity and gas, maintains and administers an electricity market data exchange platform and a gas market data exchange platform based on law. Therefore, Elering processes the personal data on the electricity market as well as on the gas market. Such data constitutes above all the person’s name, personal identification code, metering point address, metering point code as well as consumption and production data. The objective of processing the aforesaid personal data is the obligation imposed on Elering as a system operator of ensuring the efficient functioning of the electricity and gas markets and encouraging competition on the energy market as an independent party. Information concerning the processing of the respective data (viewing the energy consumption and production data of metering points, viewing the data on contracts of energy service providers, granting third parties the right to view one’s data and represent oneself and viewing who has the access to the data and who has used the data) can be accessed in the Elering customer portal.

Furthermore, Elering has also created online environments or web solutions for the performance of public tasks that allow to simplify the exchange of the data and to ensure faster communication with Elering. For example, such environments are the renewable energy information system GREEN, the EGLE portal which allows one to join the transmission network and the biomethane information system for producers and sellers. In addition, it is convenient for landowners to submit requests for utility network tolerance payments through the network service - portal for network service, landowners and contractors.
In these online environments, Elering processes personal data to perform the tasks specified in the Electricity Market Act, the Energy Sector Organisation Act and the Law of Property Act Implementation Act for the purposes and within the scope set out therein.

In addition, other obligations have been imposed on Elering by law that are mainly related to being the owner of the electricity and gas transmission network. To comply with the obligations arising from law, Elering only collects and uses personal data within the scope required for meeting the objectives. For example, Elering collects the data of landowners on whose properties the power lines or gas pipelines of Elering are situated or whose immovable property is affected by the protection zone of the structure. The data is used by Elering to contact the landowner to agree on performing maintenance or construction work in the protection zone. Elering receives the respective contact details of the landowner by making enquiries to the Land Register, Commercial Register and the Population Register.

Elering also conducts the processing of personal data within the framework of obligations arising from legislation when making tolerance payments according to the application of the owner of the property. Personal data processing when making tolerance payments includes inspection of the data submitted in the request and making the payment.

If you visit the Elering headquarters in Tallinn, we register the personal data of all visitors according to the Government of the Republic Regulation “Procedure for Protection of National Defence Objects”.
 

For the performance of contracts

Elering also processes your personal data if you enter a contract with Elering. Deforestation agreements, contracts for the establishment of personal rights of use, or other contracts regulating the use of a property of landowners. Elering uses the personal data to prepare the respective contracts and after entry into the contract to perform the obligations undertaken with the contracts or exercise the rights under the contracts.

If you apply for a job in Elering, Elering processes the data in the CV and motivation letter submitted by the applicant and the applicant’s contact details to recruit new employees and prepare the conclusion of an employment contract with the suitable applicant. Elering retains applicants’ data for one (1) year according to the Equal Treatment Act.
 

Consent-based data processing

Consent-based data processing means that Elering does not process your data based on law or a contract, but you have granted consent for processing your data. Such personal data processing is conducted by Elering in its customer portal. We have created terms of use regarding the data processing done based on consent on the customer portal, which give an overview of the conditions on which all clients can share their data with various energy service providers based on consent. The terms of services will become known to you when you log in the customer portal for the first time, and you can make acquaintance with them at any time. It is possible to share consumption and production data with energy sellers, aggregators or other energy related service providers on the customer portal based on consent. Consent is voluntary and you can withdraw it at any time. You will find the relevant instructions on the customer portal. 
In addition, you can subscribe for the Elering newsletter or join the press list on the basis of consent and you can also withdraw this consent any time by clicking the link at the end of the e-mail message.
 

Legitimate interest

Use of surveillance equipment
Ensuring the security of supply of electricity and gas in Estonia is a vital task. Therefore, strict requirements have been imposed on the buildings and facilities of Elering (e.g. substations) for ensuring security and safety. To comply with requirements and ensure the safety of the electricity and gas systems, Elering has a legitimate interest to use surveillance equipment such as security cameras and access systems to ensure the physical security of the electricity and gas system and, if necessary, verify the compliance of the maintenance and construction activities related to facilities. There are signs installed that inform that video surveillance is used on the territory.
 

Provision of customer support services
Elering also processes your data based on legitimate interest when you contact us on our general telephone number (715 1222) or general e-mail address (info@elering.ee). When you call the general telephone number, your call will be recorded to ensure better service. We want to deal with our customers concerns and questions as quickly and efficiently as possible, and call recording allows us to listen to the call again to ensure that addressed concern is resolved on the basis of the most accurate information possible. The call recording file will be deleted after 60 days, the information of a written message will be anonymised 60 days after a response is sent to you and deleted 90 days after anonymisation.

Conducting surveys
In certain cases, it is in Elering’s legitimate interest to find out the opinions of Elering’s target groups on issues concerning energy and Elering, to make better management decisions, provide a higher quality of service and provide related parties with more understandable information on issues related to energy and Elering’s activities. To achieve this goal and based on a legitimate interest, Elering may carry out sociological surveys. Surveys are conducted considering people’s right not to participate and their wish to leave the target group.

Newsletters and press releases
It is in Elering’s legitimate interest to send information about Elering’s activities directly to the members of its target group (market participants, transmission network clients and other partners), so that they receive the relevant information from the primary source, which helps them to organise their work better, including communicate operational information to the press. The information that Elering communicates is sector specific and the personal data processed are mostly the professional contact details of individuals (e.g. contact details of ministries, electricity companies/gas companies, journalists). Every data subject has the option to unsubscribe from the newsletter/press releases at any time.

Giving informative information on the gas and electricity markets to market participants
It is in Elering’s legitimate interest to send invitations and materials of the Electricity and Gas Market Advisory Board to market participants. The advisory boards are needed to provide information on market developments concerning market participants and to obtain feedback. Only the minimum data necessary for the advisory board to identify persons and send information are processed.

Processing of personal data of the representatives of contractual partners and contracts contact persons 
If you are the representative of a contractual partner of Elering (e.g. member of the management board or on the basis of a power of attorney) or named as the contact person in a contract, it is in Elering’s legitimate interest to also process your personal data to ensure the performance of the contract, exercise its rights and perform its obligations (e.g. for filing legal claims, if necessary). The deadline for data retention depends on the term and type of the contract and in certain cases, the retention deadline arises from the law (e.g. Accounting Act).

Safety trainings and exams
It is in Elering’s legitimate interest to ensure safety at all its sites. The respective obligation is assigned to Elering also by § 4 of the Equipment Safety Act, pursuant to which the safety of human life and health, property and the environment must be ensured. To ensure safety, all measures required for preventing, identifying, countering, and eliminating a threat as well as for mitigating adverse consequences in the event of an accident must be taken. One of the measures taken by Elering to ensure safety is examination of the knowledge of the persons at the sites, so that compliance with and awareness of the necessary safety requirements in the danger zone is ensured. The results of the examinations are retained for four (4) years and Elering uses the Moodle environment as a service partner when carrying out examinations.

Ensuring the cyber security of Elering’s data and information systems
It is in Elering’s legitimate interest to prevent cyber incidents, identify incidents and in the case of the occurrence of incidents, respond to them immediately, including ascertain the scale of the incident, restrict the spread of the incident and inform the persons affected by the incident. For this purpose, Elering may, if necessary, process the data of the persons using Elering’s public information systems.
 

IV. HOW DO WE PROTECT YOUR DATA?

Elering ensures the confidentiality of personal data within the framework of applicable legislation and implements relevant technical and organisational measures for protecting personal data from unauthorised access, unlawful processing or disclosure, accidental loss, alterations, or destruction.

V. HOW DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGY

Similarly to many online environments, Elering also uses cookies on its websites. Cookies are small text files that are downloaded into the user’s computer via e-environment server. You can find further information on how and which cookies Elering uses on the website: Cookies | Elering

VI. ARE THERE ANY OTHER PERSONS BESIDES ELERING WHO MAY PROCESS YOUR PERSONAL DATA?

In some instances, Elering may use its contractual partners for personal data processing, who carry out personal data processing activities to comply with their principal obligations specified in the contracts. Such cases include the maintenance and construction of power lines and gas pipelines where a contractual partner of Elering organises the communication with the owner of the realty for the performance of the work and reaching the required agreements. Elering also uses contractual partners to provide the services that Elering cannot provide itself (e.g. IT development services, postal services, personnel recruitment services, call centre services, security services). The contractual partners of Elering are obliged to comply with all the rules established for personal data processing which Elering also complies with.

VII. FOR HOW LONG DO WE RETAIN PERSONAL DATA?

Elering does not use or retain personal data any longer than necessary for the performance of its tasks under law, the performance of the agreements between the parties or the preparation of legal claims. The retention period may be based on contracts, Elering’s legitimate interest or applicable law (e.g. accounting acts, the data retention periods related to the obligations of a system operator or the expiry deadlines set forth by law).

VIII. RIGHTS RELATED TO PERSONAL DATA

The right to access data
You will always be able to examine your personal data that has been collected and is being used as well as its sources and objectives for the use thereof. You are also able to receive information as to how long Elering stores the data and to whom and to what extent the data is disclosed. The right to access your personal data may be limited by legislation, the rights of other persons for ensuring their privacy or other justified needs (e.g. the know-how, business secrets, internal evaluations and other materials of Elering).

The right to rectify personal data
If your data is incorrect, incomplete or irrelevant, you are able to request that your data be rectified or deleted, taking into consideration the limitations arising from applicable legislation and the rights related to data processing.

The right to object
You have the right to object to the processing of your personal data, including in cases in which Elering relies on its legitimate interests when processing data.

The right to limit data processing relating to you
You have the right to limit the processing of your personal data on the basis of applicable law, for example when Elering assesses whether a person has the right to the deletion of their data, unless the data must be processed for the performance of a legal obligation or for the performance of a task in public interest.

The right to be forgotten
If personal data is processed on the basis of your consent and you have withdrawn your consent, you have the right to request the deletion of your personal data. This right does not apply if the personal data the deletion of which is requested is also processed on another legal basis, e.g. on the basis of a contract, for the performance of a legal obligation or for the performance of a task in public interest.

Right to data portability
If Elering uses data with your consent or on the basis of an agreement and the data processing is automated, you have the right to receive a copy of the submitted data in an electronic machine-readable format.

IX. CONTACT DETAILS

If you have any questions concerning your rights in relation to the processing of your personal data or if you have any questions about how we collect and use your personal data, please contact the Data Protection Officer of Elering by e-mail at andmekaitse@elering.ee, telephone at +372 715 2271, or the address: Kadaka tee 42, 12915 Tallinn.

If you are not satisfied with how we process your personal data and your inquiry to our Data Protection Officer did not result in a satisfactory outcome, you can file a complaint by e-mail to info@elering.ee or by post to Kadaka tee 42, 12915 Tallinn.

You can also file a complaint with the supervisory authority, which in Estonia is the Data Protection Inspectorate; e-mail: info@aki.ee; postal address: Tatari 39, 10134 Tallinn; telephone +372 627 4135 website: www.aki.ee. The Data Protection Inspectorate is a government authority that can be contacted for consultation or assistance on personal data protection matters.