Privacy Policy

Effective from 7 July 2026

1. General Provisions

We value the privacy of our customers, employees and visitors. We have therefore established this Privacy Policy to explain how we collect, use, disclose, transfer and retain personal data. The purpose of this Privacy Policy is to establish requirements for processing personal data that help minimise potential risks and prevent the misuse of personal data.

The data controller responsible for processing personal data on the website www.bestor.eu is AS Bestor Grupp (hereinafter also referred to as the “Data Controller” or the “Company”), registration number 10433846, located at Valdeku 168, Tallinn 11217, Estonia, email: bestor@bestor.ee.

When processing personal data, we comply with applicable Estonian legislation, including the European Union General Data Protection Regulation (hereinafter referred to as the “GDPR”).

Personal data means any information that can be used to identify a natural person directly or indirectly. This includes, in particular, a person’s name, personal identification code, email address, location data, online identifiers and other identifying information. A person’s appearance or voice may also constitute personal data.

Information relating to a legal entity does not constitute personal data. However, personal data relating to individuals associated with a company falls within the scope of the GDPR.

2. Purposes of Personal Data Processing

We process your personal data to develop, plan and analyse our business activities, provide services, carry out marketing activities, create personalised content and handle opinions and feedback received from you.

3. Processing, Collection and Retention of Personal Data

The way we process personal data depends on how we interact with you. The information collected may vary according to the nature and purpose of our communication, as different interactions require personal data for different purposes.

Categories of personal data we may collect and process, depending on the activity or circumstances:

Identification data: the customer’s first and last name, personal identification code or date of birth; the first and last name and job title of a legal entity’s representative.
Contact information: email address, telephone number, delivery address and residential or business address.
Financial information: credit card details, bank account information, purchase and service records, payment information and outstanding claims.
Other information provided by you: feedback, comments and any other information you have shared with us.
Recruitment-related personal data: a job applicant’s first and last name, contact details, education, work experience and other information submitted during the recruitment process.
Information collected through electronic communication channels: in addition to information provided directly by you, we may collect information about the computer, mobile phone or other device you use, including information used to remember your user credentials or location data for providing relevant offers.

4. Legal Bases for Processing Personal Data

We process your personal data only for specified purposes, each supported by an appropriate legal basis. We have identified four legal bases for our personal data processing activities:

Performance of a contract: processing is necessary to fulfil a contract concluded with you or to take steps at your request before entering into a contract.
Compliance with a legal obligation: processing is necessary for AS Bestor Grupp to fulfil its statutory obligations, including accounting and tax requirements or obligations arising from decisions made in the exercise of public authority.
Legitimate interests: processing is necessary for our legitimate interests, provided these interests are not overridden by your interests or fundamental rights and freedoms. This includes preventing fraud or misuse of services through surveillance systems, preparing and pursuing legal claims in the event of a contractual breach, ensuring employee safety and meeting information security requirements. You have the right to request an explanation of processing carried out on this basis and to object if you believe that such processing disproportionately infringes your rights.
Consent: processing is based on your separate consent, given for a specific purpose and scope, for receiving direct marketing communications and newsletters. You may withdraw your consent at any time by contacting bestor@bestor.ee or following the instructions provided when consent was obtained. If you withdraw your consent, we will cease processing your data for the purposes covered by that consent. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Purposes, Categories of Personal Data and Legal Bases

Purpose of processing	Personal data processed	Legal basis
Pre-contractual activities (contract preparation and negotiations)	Identification data, contact information, legal entity information	Performance of a contract (GDPR Art. 6(1)(b)); legitimate interests (GDPR Art. 6(1)(f))
General marketing activities	Identification data, contact information	Legitimate interests (GDPR Art. 6(1)(f))
Maintaining and developing customer relationships (customer service, communication)	Identification data, contact information, legal entity information	Legitimate interests (GDPR Art. 6(1)(f))
Maintaining and developing business relationships (contracts, orders, fulfilment)	Identification data, contact information, legal entity information	Performance of a contract (GDPR Art. 6(1)(b)); legitimate interests (GDPR Art. 6(1)(f))
Primary accounting documents	Identification data, legal entity information	Legal obligation (GDPR Art. 6(1)(c)); legitimate interests (GDPR Art. 6(1)(f))
Billing and payments (invoices, payment deadlines, payments)	Identification data, contact information, legal entity information	Performance of a contract (GDPR Art. 6(1)(b)); legitimate interests (GDPR Art. 6(1)(f))
Service development (improving existing services)	Identification data, contact information, legal entity information, other information	Legitimate interests (GDPR Art. 6(1)(f))
Administration of service provision (notifications, complaint handling)	Identification data, contact information, legal entity information	Performance of a contract (GDPR Art. 6(1)(b)); legitimate interests (GDPR Art. 6(1)(f))
Customer management (information segmentation)	Identification data, contact information, legal entity information, purchase information	Legitimate interests (GDPR Art. 6(1)(f))
Notifications to the Estonian Data Protection Inspectorate (in the event of a detected breach)	Identification data, contact information, legal entity information	Legal obligation (GDPR Art. 6(1)(c)); legitimate interests (GDPR Art. 6(1)(f))
Direct marketing (offers, newsletters)	Identification data, contact information, legal entity information	Legitimate interests (GDPR Art. 6(1)(f)); consent (GDPR Art. 6(1)(a))
Requests for information from public authorities	Identification data, contact information	Legal obligation (GDPR Art. 6(1)(c))
Internal data exchange within AS Bestor Grupp	Identification data, contact information, legal entity information	Legitimate interests (GDPR Art. 6(1)(f))
General service statistics	Identification data, contact information, purchase information	Legitimate interests (GDPR Art. 6(1)(f))
Recruitment	Identification data, contact information, education, work experience and other information submitted by the applicant	Legitimate interests (GDPR Art. 6(1)(f))
Information security and cookies	Information required for information security, access permissions (modification, viewing, registration or deletion) and user groups. Managing website traffic to ensure functionality and prevent cyber incidents	Legitimate interests (GDPR Art. 6(1)(f)); Cybersecurity Act, § 7(1), clauses 1 and 3
Video surveillance	Ensuring the safety and protection of property, employees, business partners and visiting customers	Legitimate interests (GDPR Art. 6(1)(f))

In addition to the above, we have the right to collect information available in public registers.

5. Personal Data Retention Periods

Personal data retention periods are determined by applicable laws or regulations. In exceptional cases, the retention period is established by AS Bestor Grupp. Personal data is deleted once the applicable retention period has expired.

Personal data retention periods:

Pre-contractual activities (contract preparation, negotiations): three years after the expiry of the limitation period for potential claims.
General marketing activities: until the individual withdraws their consent.
Maintaining and developing customer relationships (customer service, communication): up to five years.
Maintaining and developing business relationships (contracts, orders, fulfilment): at least seven years after the end of the applicable validity period.
Primary accounting documents: at least seven years after the end of the financial year in which the transaction took place.
Billing and payments (invoices, payment deadlines, payments): at least seven years after the end of the financial year in which the transaction took place.
Service development (improving existing services): at least seven years after the end of the applicable validity period.
Customer management (information segmentation): throughout the duration of the contract and for three years after the expiry of the limitation period for potential contractual claims.
Notifications to the Estonian Data Protection Inspectorate (following identification of a breach): at least one year after the notification has been answered and the response sent.
Direct marketing (offers, newsletters): until the individual withdraws their consent.
Requests for information from public authorities: at least one year after the request has been answered and the response sent.
Internal data exchange within AS Bestor Grupp: up to five years.
General service statistics: throughout the duration of the contract and for three years after the expiry of the limitation period for potential contractual claims.
Recruitment: in accordance with the applicant’s consent, but for no longer than one year for the resolution of potential disputes.
Information security and cookies: 12 months from the date of the website visit.
Video surveillance: recordings are retained for up to 90 days, after which the video surveillance system automatically overwrites the data. Recordings provided to public authorities are retained for as long as necessary.

6. Third Parties Processing Personal Data

We have the right to share your personal data with third parties, including authorised data processors, accountants, transport and courier companies, and payment transfer service providers. A data processor is the controller of personal data.

We may disclose personal data in accordance with the limits and obligations established by applicable legislation when responding to requests for information from public authorities.

Your personal data is neither stored nor transferred outside the European Economic Area (EEA).

For further information about the retention periods applicable to your personal data, please contact us at bestor@bestor.ee.

7. Your Rights Regarding the Processing of Personal Data

You have the following rights concerning the processing of your personal data:

To access and review your personal data.
To obtain information about how your personal data is processed.
To supplement or correct inaccurate personal data.
To withdraw your consent to personal data processing at any time, where processing is based on consent.
To restrict the processing of your personal data.
To request the deletion of your data where processing is based on consent.
To object to processing based on our legitimate interests.
To lodge a complaint with the Estonian Data Protection Inspectorate to protect your rights.

If you wish to exercise any of these rights, please contact us at bestor@bestor.ee.

Requests for the deletion of personal data must be submitted in writing and digitally signed. The request must clearly describe the action requested, including the type of data concerned, the relevant deadline and the applicable period.

The request must include the applicant’s first and last name, personal identification code and contact details.

AS Bestor Grupp reserves the right to refuse a request if the processing of personal data is carried out on a legal basis.

8. Personal Data of Job Applicants

When you apply for a position with us, we process your personal data primarily in connection with the position for which you have applied.

If we consider your suitability for other positions, we may, with your agreement, also assess your suitability for those roles.

During the recruitment process, we assess the personal data required in relation to the specific position for which you have applied. This primarily includes information demonstrating your qualifications, competence and suitability for the role.

These principles apply both to information collected through job applications and to questions asked during job interviews.

9. Ensuring the Security of Personal Data

We have implemented the necessary legal, organisational, physical and technical security measures to protect personal data.

Examples of the measures we use include:

Physical security measures: paper documents containing personal data are stored in locked rooms and cabinets accessible only to authorised employees for the performance of their duties. Rooms used for data processing and IT systems are adequately protected against fire, overheating, water damage, voltage fluctuations and power outages.
Technical security measures: all work computers are protected by password-secured screen savers. Our IT systems are configured to prevent further login attempts and lock user accounts after a specified number of unsuccessful login attempts. Systems exposed to increased risks, such as laptops and smartphones, are adequately protected through encryption or other appropriate measures.
Organisational security measures: roles and user profiles have been assigned to all IT system users, and access rights are revoked when employees leave the Company. We also ensure that areas used for processing personal data cannot be accessed without authorisation from publicly accessible premises.
External service providers: where we use external service providers to process your personal data, we enter into agreements governing data processing and protection. These agreements require service providers to:
1. Implement appropriate measures to safeguard the confidentiality and security of personal data.
2. Process personal data in accordance with applicable legislation.

You also play an important role in protecting your personal data. Do not disclose your usernames, passwords or other identifying information to third parties, and do not allow others to use your identification devices or credentials, such as your ID card or Mobile-ID.

Please be aware that we may not be able to ensure the security of your personal data if you do not take appropriate precautions to protect it.

10. Use of Surveillance Cameras

We use surveillance cameras within our premises and on our property to protect people and assets.

Our use of surveillance cameras is based on the legitimate interest of addressing specific, clearly defined security concerns. Data collected through video surveillance is used solely for the purposes for which it was collected, and surveillance is carried out around the clock.

The cameras are positioned to monitor the interiors of buildings, entrances and the areas immediately surrounding the buildings.

We provide visible notices, such as signs or stickers, in areas where video surveillance is in operation. Notices informing visitors about video surveillance are also displayed at the Company’s external entrances.

All footage captured by surveillance cameras is stored on a server. Access to and processing of the recordings is strictly restricted to authorised individuals when a relevant incident occurs.

As a general rule, we do not disclose video surveillance recordings to third parties. However, disclosure to the police or another competent public authority may be necessary for the investigation of a criminal offence.

In such cases, the relevant authority must submit a written request before the