PRIVACY POLICY FOR ONLINE COURSES OF IT TALENT

 
This Privacy Policy (hereinafter referred to as the “Policy”) describes the procedures implemented by IT Talent OÜ, a legal entity incorporated under the laws of the Republic of Estonia, registry code 12735787 (hereinafter referred to as the “IT Talent”) on processing of personal data of Data subjects using or interested in the educational online services of IT Talent (hereinafter referred to as the “Services”) available via the website with the URL https://ittalent.ee/ (hereinafter referred to as the “Website”) or otherwise. 
 
This Policy shall apply in connection with the Terms of Use of IT Talent (hereinafter referred to as the “Terms”), as well as the Basics of IT Talent Study Organization and Basics of IT Talent Training Quality Assurance. In case of any contradictions between the Policy and the Terms or Basics of IT Talent Study Organization or Basics of IT Talent Training Quality Assurance, the Policy shall prevail. 
 
The terms and definitions provided by the Terms shall apply to this Policy unless their application does not contradict the provisions of the Policy. 
 
The Policy is enacted in accordance with the Personal Data Protection Act of the Republic of Estonia and the General Data Protection Regulation No. 2016/679 (GDPR) adopted by the European Parliament and the Council on 27 April 2016. In case of any contradictions between this Policy and the GDPR or the Personal Data Protection Act, the GDPR or the Personal Data Protection Act shall prevail. In case of any contradictions between the GDPR and the Personal Data Protection Act, the GDPR shall prevail. 
 
All the terms and definitions provided by the GDPR shall apply to this Policy unless their application does not contradict the terms or definitions of the Policy. 
 
If IT Talent processes personal data of a data subject who is not a resident of the European Union, and the processing of personal data of such data subject is governed by the laws and regulations of other jurisdictions, including, but not limited to California Consumer Privacy Act (CCPA) and Children’s Online Privacy Protection Act and Rule enacted by the Federal Trade Commission (COPPA), such laws and regulations shall apply to the extent that their application does not violate the GDPR and laws and regulations of the Republic of Estonia. 
 
The following terms and definitions shall apply to the Policy:
 
Controller” means IT Talent. 
 
Data subject” means a natural person who is either: 
 
(a) a Customer of IT Talent as defined in the Terms or
(b) a natural person who is the representative or employee of the Customer that is a legal entity or
(c) a natural person who uses the Services at the request of the Customer that is a legal entity
(d) a natural person who visits the Website or otherwise expresses the interest in the Services of IT Talent
 
Processor” means a natural person or a legal entity that is either: 
 
(a) engaged in the provision of the Services and processes personal data of Data subjects for the purpose of providing the Services (including Trainers of IT Talent) or
(b) engaged in the processing of personal data of Data subjects under the contract concluded with IT Talent or IT Talent’s Subsidiary or
(c) IT Talent’s Subsidiary 
 
Services” means Services offered by IT Talent under the Terms. 
 
Subsidiary” means a subsidiary of IT Talent as defined in the Terms. 
 
Third party” means a natural person or a legal entity that is either: 
 
(a) provides IT Talent with personal data of the Data subject on the lawful basis provided by Article 6 GDPR or
(b) receives personal data of the Data subject from IT Talent for purposes not related to the processing of personal data under this Policy
 
Usage data” means personal data about the Data subject’s activities on the Internet collected automatically either through the use of the Services or from the Services’ infrastructure itself. The Usage data is anonymous and cannot be attributed to the particular person. 


IT Talent processes personal data of Data subjects under this Policy in accordance with the following principles: 
 
(1) The processing of personal data is performed only in accordance with this Policy and the applicable legislation
 
(2) The processing of personal data is performed only for achieving the purposes specified in the Policy
 
(3) IT Talent processes only personal data that is correct and up-to-date and retained only for such time as may be necessary for achieving the purposes of processing provided by the Policy. 


SECTION 1. LAWFULNESS OF PERSONAL DATA PROCESSING
 
1.1. By visiting or/and exploring the Website, the Data subject provides IT Talent with the consent to the processing of personal data of the Data subject provided in paras.2.1.8-2.1.9 of the Policy. 
 
1.2. By registering for the Course in accordance with Section 5 of the Terms, the Data subject provides IT Talent with the consent to the processing of personal data of the Data subject provided in paras.2.1.1-2.1.7 of the Policy. 
 
1.3. If the Customer is a legal entity which concluded the contract with IT Talent on the provision of the Services for Data subjects who are natural persons, IT Talent has the right to process personal data of such a Customer and the representatives and employees of such a Customer provided in paras.2.1.1-2.1.7 of the Policy under Article 6 paragraph 1 point (a) GDPR. However, IT Talent will not process personal data of Data subjects using the Services of IT Talent at the request of such a Customer unless the Customer provides IT Talent with written consent of all such Data subjects to the processing of their personal data under this Policy. 
 
1.4. Even if the Customer who is a natural person does not provide explicit consent to the processing of his or her personal data, but uses the Services of IT Talent or requests IT talent to provide the Services, IT Talent has the right to process personal data of such a Customer provided in paras.2.1.1-2.1.7 of the Policy for the purposes related to the provision of the Services under the Terms (Article 6 paragraph 1 point (b) GDPR). 
 
1.5. If a Data subject provides IT Talent with personal data prescribed by para.8.2 of the Policy, the Data subject provides IT Talent with the consent to the processing of such personal data for the purposes provided in para.8.3 of the Policy. 
 
1.6. If a Data subject makes publicly available personal data provided in para.8.4 of the Policy, the Data subject provides IT Talent with the consent to the processing of such personal data for the purposes prescribed by para.8.4 of the Policy. 
 
1.7. If a Data subject refuses to give consent to the processing of personal data, and there are no other legal grounds of processing provided by Article 6 GDPR, IT Talent has the right to refuse provision of the Services or restrict access of the Data subject to the Website if provision of the Services or provision of access to the Website are impossible without processing of such personal data. 


SECTION 2. PERSONAL DATA PROCESSED
 
2.1. Under this Policy, IT Talent has the right to process the following personal data of Data subjects: 
 
2.1.1. First and last name of the Data subject.
 
2.1.2. Personal identification code of the Data subject (if the Data subject is a citizen or resident of the Republic of Estonia), or ID/passport number or Tax ID number of the Data subject (if the Data subject is not a citizen or resident of the Republic of Estonia). 
 
2.1.3. Email address of the Data subject and/or the contact details of the Data subject in a social network or messenger (e.g., Telegram, Skype etc.).
 
2.1.4. Phone number of the Data subject. 
 
2.1.5. Address of residence of the Data subject. 
 
2.1.6. Name and address of the person paying the Fee for the Services under the Terms. 
 
2.1.7. Information about the profession or qualification, the level of education, the work experience, and professional interests of the Data subject.
 
2.1.8. Cookies and technically similar data defined in Section 7 of this Policy.
 
2.1.9. Usage data, including, but not limited to Internet Protocol address of the Data subject’s computer or telephone (e.g., IP address), browser type, browser version, the pages of the Website that the Data subject visits, the time and date of the visit of the Website, the time spent by the Data subject on the pages of the Website, unique device identifiers, and other diagnostic data. 
 
2.1.10. Personal data lawfully provided to IT Talent by Third parties. 
 
2.1.11. Other personal data provided by the Data subject voluntarily, including the feedback of the Customer on the Trainer provided in accordance with Section 4 of the Terms and the Basics of IT Talent Training Quality Assurance. 
 
2.2. Personal data not provided in para.2.1 of the Policy may be processed only under the prior consent of the Data subject or under other grounds of processing provided by Article 6 paragraph 1 points (c)-(f) GDPR. 
 
2.3. IT Talent does not and will not process any special categories of personal data provided by Article 9 GDPR (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs etc.). If IT Talent finds out that IT Talent or IT Talent’s Processor has processed any personal data provided by Article 9 GDPR, IT Talent will immediately delete such personal data and will take reasonable measures preventing the processing of such personal data in future. 





SECTION 3. PURPOSES OF PERSONAL DATA PROCESSING
 
3.1. IT Talent has the right to process personal data of Data subjects provided in paras.2.1.1-2.1.7 of the Policy for the following purposes:  
 
3.1.1. Provision of the Services under the Terms. 
 
3.1.2. Resolving disputes with the Customers in accordance with Section 12 of the Terms. 
 
3.1.3. Collecting and assessing the feedback of the Customers on the Trainers provided in accordance with Section 4 of the Terms and the Basics of IT Talent Training Quality Assurance. 
 
3.2. IT Talent has the right to process personal data of Data subjects provided in paras.2.1.8-2.1.9 of the Policy for the following purposes: 
 
3.2.1. Statistical and analytical purposes. 
 
3.2.2. Improving the Data subject’s experience related to the use of the Website. 
 
3.2.3. Improving the work of the Website. 
 
3.2.4. Changing the functionality of the Website to attract more Customers of the Services. 
 
3.2.5. Providing the Customer with all the functionality of the Website necessary for the provision of the Services. 
 
3.2.6. Providing technical support of the Website. 
 
3.2.7. Analyzing the interaction of Data subjects with the Website for amending the contents and the structure of the Website and other Internet resources used by IT Talent for providing the Services. 
 
3.2.8. Analyzing the interaction of Data subjects with the Website for creating and launching marketing and ad campaigns on the Internet. 
 
3.3. IT Talent has the right to process personal data of Data subjects provided in para.2.1 of the Policy for marketing and advertising purposes, which includes direct advertising (such as email newsletters, bulk emailing) and creation of context advertisements. 
 
3.4. Depending on the nature of personal data, IT Talent has the right to process personal data of Data subjects provided in para.2.1.11 of the Policy for the purposes provided in paras.3.1-3.3 of the Policy. 
 
3.5. Depending on the nature of personal data, IT Talent has the right to process personal data of Data subjects provided in para.2.1.10 of the Policy for the purposes provided in para.6.1 of the Policy. 


SECTION 4. DATA SUBJECTS AND PRIVACY OF CHILDREN
 
4.1. The Services of IT Talent are not aimed at natural persons who are under 16 (sixteen) years of age. IT Talent does not provide Services to Customers who are under 16 (sixteen) years of age and does not knowingly process personal data of Data subjects who are under 16 (sixteen) years of age. IT Talent takes all the reasonable technical and organization measures to prevent processing of personal data of Data subjects who are under 16 (sixteen) years of age. 
 
4.2. If IT Talent has doubts regarding the age of the Customer, IT Talent has the right to request the Customer to verify the Customer’s age. If the Customer refuses to verify the Customer’s age or if IT Talent finds out that the Customer is less than 16 (sixteen) years of age, IT Talent immediately terminates the Terms with the Customer, deletes all the personal data associated with such Customer in accordance with this Policy, and restricts access of the Customer to the Services. 
 
4.3. If the Customer is a legal entity, all the natural persons for whom the Customer requests the provision of the Services under the Terms shall be at least 16 (sixteen) years of age. By accepting the Terms, such Customer warrants IT Talent that all the natural persons using the Services under the Terms are at least 16 (sixteen) years of age. If IT Talent has doubts regarding the age of natural persons for whom the Customer requests the provision of the Services, IT Talent has the right to request the Customer to verify the age of natural persons using the Services. If the Customer refuses to verify the age of natural persons using the Services, IT Talent has the right to immediately terminate the Terms with the Customer, delete all the personal data of natural persons for which the Customer requests the provision of the Services, and restrict access of the Customer and all the natural persons to the Services. If IT Talent finds out that some of the natural persons for which the Customer requests the provision of the Services are less than 16 (sixteen) years of age, IT Talent will immediately delete all the personal data associated with such natural persons and restrict access of such natural persons to the Services. 
 
4.4. If a Data subject who is not a Customer and who is under 16 (sixteen) years of age provides IT Talent with any personal data prescribed by paras.2.1.1-2.1.7 or para.2.1.11 of the Policy, IT Talent will immediately delete such personal data and take reasonable measures preventing the processing of such personal data in future.  
 
4.5. If a Third party provides IT Talent with personal data in accordance with para.2.1.10 of the Policy, and IT Talent figures out that such personal data belongs to a Data subject who is under 16 (sixteen) years of age, IT Talent will immediately delete such personal data and take reasonable measures preventing the processing of such personal data in future. IT Talent also has the right to terminate the contract with such a Third party under which the Third party provided IT Talent with personal data. 
 
4.6. If the Website or other technical tools used by IT Talent process personal data provided in paras.2.1.8-2.1.9 of the Policy, and IT Talent figures out that the processed personal data belongs to a Data subject who is under 16 (sixteen) years of age, IT Talent will make all the reasonable steps to extract and delete such personal data. 
 
4.7. If a person who is a holder of parental responsibility over the Data subject that is under 16 (sixteen) years of age contacts IT Talent and presents evidence that IT Talent unknowingly processes personal data of such a Data subject, IT Talent will immediately delete such personal data and take reasonable measures preventing the processing of such personal data in future. If such holder of parental responsibility notifies IT Talent that IT Talent unknowingly processes personal data provided in paras.2.1.8-2.1.9 of the Policy, IT Talent will make all the reasonable steps to extract and delete such personal data and to prevent the processing of such personal data in future. 


SECTION 5. CONTROLLER AND PROCESSOR
 
5.1. Under this Policy, IT Talent is the Controller as defined by Article 4 paragraph 7 GDPR. The Controller determines the purposes and means of the processing of personal data of Data subjects and engages Processors in the processing of personal data under this Policy. 
 
5.2. The Controller processes personal data of Data subjects directly by itself or through engaged Processors. The Processors process personal data of Data subjects on behalf of the Controller as defined in Article 4 paragraph 8 GDPR. All the Processors act under the contracts concluded with the Controller or Controller’s Subsidiary under the direct authorization of the Controller. The Controller observes the compliance of the Processors with the GDPR and other applicable personal data legislation. 
 
5.3. Under this Policy, the Controller has the right to engage the following categories of Processors in the processing of personal data of Data subjects: 
 
5.3.1. Trainers teaching the Courses of IT Talent under the Terms. Such Trainers may only process personal data that directly relates to the teaching of the Courses under the Terms, including personal data provided by para.2.1.11 of the Policy. 
 
5.3.2. Subsidiaries of IT Talent. The Subsidiaries may directly process personal data of Data subjects under the Policy. Under the direct authorization of IT Talent, the Subsidiaries may also conclude contracts with other Processors on the processing of personal data on behalf of the Controller. If the Services are provided through the Subsidiary, IT Talent remains the Controller under this Policy. 
 
5.3.3. Processors that provide technical support to the Website and other Internet resources used by IT Talent for the provision of the Services. 
 
5.3.4. Processors that provide IT Talent with web and other technical solutions aimed at the provision of the Services and/or increasing the quality of the Services. 
 
5.3.5. Processors that assist IT Talent in processing personal data provided by paras.2.1.8-2.1.9 of the Policy. 
 
5.3.6. Processors that assist IT Talent in analyzing and using personal data provided by paras.2.1.8-2.1.9 of the Policy for advertising and marketing purposes (such as Google Analytics, Meta for Business etc.). 
 
5.3.7. Processors that assist IT Talent in resolving disputes with Data subjects. 
 
5.3.8. Processors that ensure the security of the Website and other Internet resources used by IT Talent for the provision of the Services and processing of personal data of Data subjects. 


SECTION 6. THIRD PARTIES AND BUSINESS USE OF PERSONAL DATA
 
6.1. IT Talent may receive personal data personal data provided by para.2.1.10 of the Policy from Third parties for achieving the purposes provided in paras.3.2.1-3.2.8 and para.3.3 of the Policy. Such Third parties do not participate in the processing of personal data under the Policy. The following categories of Third parties may provide IT Talent with personal data of Data subjects for the purposes prescribed by this paragraph of the Policy: 
 
6.1.1. Natural persons and legal entities conducting collection and/or analysis of Usage data described in para.2.1.9 of the Policy. 
 
6.1.2. Business partners, contractors, and subcontractors of IT Talent assisting IT Talent in the provision of the Services under the Terms or participating in other business projects of IT Talent indirectly related or unrelated to the provision of the Services. 
 
6.2. IT Talent refuses to receive personal data from a Third party if such personal data was illegally obtained by such a Third party. If IT Talent finds out that the Third party illegally obtained personal data of a Data subject, IT Talent will immediately delete such personal data and take reasonable measures preventing the processing of such personal data in future. IT Talent also has the right to terminate the contract with such a Third party under which the Third party provided IT Talent with illegally obtained personal data. 
 
6.3. IT Talent may provide personal data of Data subjects to the following categories of Third parties: 
 
6.3.1. Business partners, contractors, and subcontractors of IT Talent assisting IT Talent in providing the Services under the Terms or performing other business projects of IT Talent indirectly related or unrelated to the provision of the Services. Such business partners, contractors, and subcontractors may use personal data of Data subjects exclusively for the following purposes: 
 
(a) Analysis of personal data for the purpose of improving the Services and other services offered by IT Talent or Subsidiaries of IT Talent. 
 
(b) Organizing the provision of the Services or performance of other business projects of IT Talent. 
 
(c) Improving the design or functionality of the Website.
 
(d) Assisting IT Talent with launching and administering marketing and ad campaigns. 
 
(e) Promoting the Services of IT Talent among the current or potential Customers. 
 
6.3.2. Potential or current investors of IT Talent interested in investing in the business activities of IT Talent. Such Third parties may receive personal data of Data subjects exclusively for the purpose of evaluating the business activities of IT Talent to make the decision on investing in the business of IT Talent. The disclosure of Data subjects’ personal data to such Third parties is strictly limited to the purpose of personal data disclosure and performed under the non-disclosure agreement signed with the potential or current investor of IT Talent. Generally, IT Talent does not disclose to such Third parties the personal data provided in paras.2.1.1-2.1.7 of the Policy. 
 
6.3.3. Competent courts, supervising authorities, or other governmental or municipal authorities of the Republic of Estonia or other jurisdictions. The disclosure of Data subjects’ personal data to such Third parties is performed only under the legal request of such a Third party that cannot be overridden or if the disclosure is performed under the grounds provided by Article 6 paragraph 1   points (c)-(f) GDPR. 
 
6.4. IT Talent may disclose personal data of Data subjects to other categories of Third parties not listed in para.6.3 of the Policy if the disclosure is performed under the legal grounds provided by GDPR or applicable laws of the Republic of Estonia or other jurisdictions. 
 
6.5. IT Talent does not and will not sell any personal data of Data subjects to any Third parties or to any other natural persons or legal entities. IT Talent has never sold any personal data of Data subjects within the preceding 12 (twelve) calendar months. 
 
6.6. The Website of IT Talent may include URL links of the websites and other Internet resources of Third parties and other natural and legal persons. IT Talent does not control or govern neither the contents of such websites or Internet resources, nor the rules of personal data processing applicable to such websites or Internet resources. It is fully the Data subject’s responsibility to carefully use the websites and the Internet resources the URLs to which are provided on the Website. IT Talent does not post URLs of websites or other Internet resources that violate applicable laws. 


SECTION 7. COOKIES AND SIMILAR TECHNOLOGIES
 
7.1. Cookies or cookie files are small text files located in browser directories that may include an anonymous unique identifier. Generally, there are two types of cookies – a session cookie and a persistent cookie. A session cookie is used to make it easier for a person to navigate a website and expires when a person closes the browser. A persistent cookie remains on a hard drive of a person’s device for an extended period of time. Cookies cannot be used to run programs or deliver viruses to a person’s computer. Cookies are uniquely assigned to a person’s device and can only be read by a web server in the domain that issued the cookie to a person’s device. To learn more about cookies please follow the link: https://en.wikipedia.org/wiki/HTTP_cookie
 
7.2. IT Talent may use both session cookies and persistent cookies to help Data subjects navigate through the Website and the Services and efficiently perform the functions of the Website. Particularly, the following kinds of cookies may be used by IT Talent in accordance with this Policy: 
 
7.2.1. Session Cookies. IT Talent may use Session Cookies to operate the Services provided via the Website.
 
7.2.2. Preference Cookies. IT Talent may use Preference Cookies to remember preferences and various settings of the Data subject using the Website.
 
7.2.3. Security Cookies. IT Talent may use Security Cookies for making safe the use of the Website.
 
7.3. By use of cookies, IT Talent may automatically collect information about the online activity of the Data subject on the Website. Such information may include: 
 
7.3.1. The information about the web-pages of the Website visited by the Data subject. 
 
7.3.2. The URL links clicked by the Data subject on the Website. 
 
7.3.3. The searches made by the Data subject via the Website. 
 
7.4. The Data subject has the right to accept or decline cookies by using the browser settings. However, if the Data subject declines cookies, the Data subject may not be able to use the full range of functions provided by the Website of IT Talent. 
 
7.5. IT Talent may also use other technologies for processing personal data provided in para.7.3 of the Policy, including the following: 
 
7.5.1. Web beacons. Web beacons (also known as clear gifs, pixel tags, or web bugs) are tiny graphics with a unique identifier, similar in functions to cookies, and used to track online movements of website users. Unlike cookies, which are stored on a user’s device, web beacons are embedded invisibly on the web pages of the website or in an email, and the size of such web beacons is about the size of the period at the end of the sentence. 
 
7.5.2. Tracking URLs. A tracking URL is a standard link that has parameters attached to it for the purpose of tracking and analytics. A tracking URL has unique identifier that allows to identify the source of the website’s traffic (e.g., the location from which the Internet users visit the website, or the search engine used by the visitors for clicking the URL of the website). 
 
7.6. IT Talent may also use web beacons and tracking URLs prescribed by para.7.5 of the Policy in marketing emails of IT Talent (including marketing bulk emailing) and in online advertisements of IT Talent posted on third-party websites. 


SECTION 8. IT TALENT AND SOCIAL NETWORKS
 
8.1. In order to promote information about IT Talent, its Services, and the Website, IT Talent may create the accounts in social networks and messengers, including Facebook, Instagram, WhatsApp, and Telegram. 
8.2. In order to interact with IT Talent, Data subjects may follow the accounts of IT Talent in social networks and the channels of IT Talent in messengers. Data subjects may like posts and comments of IT Talent and leave comments, reviews, or reactions under the posts and messages of IT Talent in social networks and messengers. Data subjects may also send messages to accounts of IT Talent in social networks and messengers, including messages that contain feedback on the work performance of the Trainers teaching the Courses of IT Talent. 
8.3. The data prescribed by para.8.2 of the Policy is considered as personal data of Data subjects provided in para.2.1.11 of the Policy. Such personal data of Data subjects, depending on the nature of the processed data, may be used by IT Talent for the purposes provided by para.3.1, paras.3.2.1-3.2.3, paras.3.2.7-3.2.8, and para.3.3 of the Policy. 
8.4. In addition to the personal data provided in para.8.2 of the Policy IT Talent may also analyze the profile information of the Data subject published by the Data subject on his or her account in a social network or messenger, subject that such analysis does not violate applicable terms and policies of social networks and messengers. The analysis is performed only in manual mode without the use of any automated decision-making. Such analysis may be performed for achieving the purposes provided in paras.3.2.7-3.2.8 and para.3.3 of the Policy. 
 
SECTION 9. RIGHTS OF DATA SUBJECT
9.1. Each Data subject has the following rights: 
9.1.1. Right of access: the Data subject is entitled to receive from IT Talent the information about personal data that is processed by IT Talent, the purposes of personal data processing, the categories of personal data recipients, the period of personal data storage, and the information about the transfer of personal data to other jurisdictions.
9.1.2. Right to lodge a complaint with a supervisory authority: the Data subject is entitled to file a complaint against IT Talent with a supervising authority of Data subject’s habitual residence or place of work, or with a supervising authority located in a place of possible infringement, or with a supervising authority of IT Talent’s residence which supervises the compliance of IT Talent with personal data legislation.
9.1.3. Right to rectification: the Data subject is entitled to rectification of inaccurate data about the Data subject.
9.1.4. Right to erasure: the Data subject is entitled to erasure the personal data about the Data subject.
9.1.5. Right to restriction of processing: the Data subject is entitled to restrict processing of personal data under the grounds provided for in Article 18 GDPR.
9.1.6. Right to data portability: the Data subject is entitled to receive personal data about the Data subject in a structured, commonly used, and machine-readable format and transmit such data to another controller.
9.1.7. Right to object: the Data subject is entitled to object to personal data processing on the grounds relating to a particular situation (for example, if IT Talent processes personal data for marketing purposes).
9.1.8. Right not to be subject to a decision based solely on automated processing, including profiling.
9.1.9. Right to file a request or complaint with IT Talent acting as the Controller. Such right also includes the right of the Data subject to use judicial remedies against IT Talent in a country of IT Talent’s or Data subject’s residence under Article 79 GDPR and the right to use judicial remedies against the supervisory authority in a country where the supervisory authority is established (Article 78 GDPR).
9.1.10. Right to withdraw Data subject’s consent to personal data processing. 
9.1.11. Right to prohibit sale or resale of Data subject’s personal data.
9.2. If the Data subject is intending to use one of the rights provided for in para.9.1 of the Policy, the Data subject shall send a mail or an email to IT Talent by using contact details of IT Talent provided for in Section 14 of the Policy. If the Data subject desires to lodge a complaint with a supervisory authority against IT Talent or use judicial remedies against IT Talent or the supervisory authority, the Data subject shall follow the procedures provided by Articles 77-79 GDPR and by the legislation of the country in which the Data subject is planning to lodge a complaint or use judicial remedies. 
9.3. If the Data subject requests IT Talent to erasure Data subject’s personal data, objects to processing of Data subject’s personal data, exercises the right to data portability, or withdraws the consent to personal data processing, IT Talent has the right to refuse provision of the Services or/and terminate the Terms if provision of the Services is impossible without processing of Data subject’s personal data. In this case, IT Talent also has the right to restrict access of the Data subject to the Website if provision of access to the Website or particular parts of the Website is impossible without processing of Data subject’s personal data under the Policy. 
 
SECTION 10. SECURITY OF PERSONAL DATA
10.1. IT Talent takes all the reasonable measures to protect Data subject’s personal data from unauthorized access by third parties, as well as against loss, misuse, alteration, or destruction of personal data, including the following:
10.1.1. The Data subject’s session on the Website goes through the secure SSL connection during the Website browsing.
10.1.2. Only authorized personnel of IT Talent have access to the personal data of Data subjects, and these employees and contractors are required to treat this information as confidential. 
10.1.3. The Data subject’s personal data is stored on the servers of IT Talent protected by authentication. 
10.2. The existing security measures will be reviewed from time to time in accordance with new legislation and technical innovations.
 
SECTION 11. STORAGE OF PERSONAL DATA
11.1. IT Talent stores personal data of Data subjects only for the period that is necessary for achieving the purposes of processing provided by Section 3 of this Policy. 
11.2. IT Talent stores personal data of the Customers provided in paras.2.1.1-2.1.7 and para.2.1.11 of the Policy for the period of use of the Services by the Customers. If the Customer stops using the Services of IT Talent, IT Talent has the right to store personal data of such Customer for the period not exceeding 5 (five) years after the Customer stops using the Services. The provided five-year term does not apply if the Customer starts using the Services again before the expiration of the five-year term. 
11.3. The rule of para.11.2 of the Policy applies to natural persons for whom the Customer, being a legal entity, requires the provision of the Services under the Terms. 
11.4. IT Talent stores personal data of Data subjects provided in para.2.1.10 of the Policy for the period necessary for achieving the purposes of processing provided by Section 3 of the Policy. 
11.5. IT Talent stores personal data of Data subjects provided in paras.2.1.8-2.1.9 of the Policy for the period necessary for achieving the purposes of processing provided by para.3.2 and para.3.3 of the Policy. 
11.6. IT Talent will periodically review the stored personal data provided in para.11.4 and para.11.5 of the Policy. Based on the nature of personal data and the purposes of processing, IT Talent will periodically delete out-of-date personal data that is not necessary for achieving the purposes of processing provided by Section 3 of the Policy. 
11.7. IT Talent does not store any personal data provided in Section 8 of this Policy. 
11.8. IT Talent will continue storing the personal data of a Data subject if deletion of such personal data is restricted or prohibited by the Money Laundering and Terrorist Financing Prevention Act of the Republic of Estonia or by other applicable laws and regulations. 
 
SECTION 12. INTERNATIONAL TRANSFER OF PERSONAL DATA
12.1. IT Talent stores personal data of Data subjects only on the servers located in the Republic of Estonia or/and other countries of EEA (European Economic Area which includes the countries of the European Union plus Iceland, Liechtenstein, and Norway). 
12.2. If IT Talent takes the organizational decision to store personal data of Data subjects outside EEA, IT Talent will first choose servers located in the countries in respect of which the European Commission made the decision that such countries provide an adequate level of data protection (Article 45 GDPR). Particularly, IT Talent may choose such jurisdictions as Switzerland, the United Kingdom, Andorra, Israel, New Zealand. To see the full list of jurisdictions outside EEA that provide adequate level of data protection please visit the following web-page of the European Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
12.3. If it is not possible for IT Talent to store personal data of Data subjects on the servers located in EEA or jurisdictions provided in para.12.2 of the Policy, IT Talent will transfer personal data of Data subject to other jurisdictions subject to appropriate safeguards provided in Article 46 GDPR. 
12.4. If for some reasons it is not possible for IT Talent to transfer personal data in accordance with para.12.1-12.3 of the Policy, IT Talent will transfer Data subject’s personal data only subject to the provisions of Article 49 GDPR which provide derogations for specific situations. 
Particularly, if a Data subject is a Customer or a natural person for which the Customer, being a legal entity, requires the provision of the Services under the Terms, resides outside EEA, and it is necessary to transfer the personal data of the Customer outside EEA for the performance of the Terms and provision of the Services, IT Talent will perform such a transfer without prior written consent of the Customer (Article 49 paragraph 1 point (b) and point (c) GDPR). The same rule will apply if the Trainer of IT Talent teaching the Courses resides outside EEA, and it is necessary to transfer personal data of the Customer or the natural person using the Services of IT Talent to such a Trainer for the purpose of the provision of the Services or/and reviewing the feedback of the Customer or the natural person about the Trainer. 
IT Talent may also transfer the personal data of the Data subject outside the jurisdictions provided by paras.12.1-12.2 of the Policy if there are legal grounds for transfer provided by Article 49 paragraph 1 points (d)-(g) GDPR. 
12.5. If IT Talent needs to transfer the personal data of the Data subject outside the jurisdictions provided in paras.12.1-12.2 of the Policy, and the only legal ground for such a transfer is the Data subject’s consent to transfer (Article 49 paragraph 1 point (a) GDPR), IT Talent will only perform the transfer after receiving the consent of the Data subject to the proposed transfer of personal data. Such consent may only be obtained from the Data subject after IT Talent informs the Data subject about the possible risks of such a transfer caused by the absence of an adequacy decision provided by para.12.2 of the Policy and appropriate safeguards provided by para.12.3 of the Policy. If the Data subject does not provide the consent to the transfer of personal data, IT Talent may refuse provision of the Services to such a Data subject or restrict access of the Data subject to the Website if provision of the Services or provision of access to the Website are impossible without the Data subject’s consent to the international transfer of personal data. 
 
SECTION 13. CHANGES TO THE PRIVACY POLICY
13.1. IT Talent shall periodically review this Policy for the compliance with applicable data protection laws and will provide the Policy with amendments as IT Talents deems necessary. The amendments will be posted on the Website in the form of the updated Policy and will be in effect since the date of publication. The publication of the updated version of the Policy amounts to notification of Data subjects about the changes. Data subjects shall periodically review the Website for the amendments in the Policy. 
13.2. IT Talent will take reasonable measures to notify the current Customers of IT Talent about the changes in the Policy. In doing so, IT Talent may send emails or SMS to the Customers using the Services or to natural persons for whom the Customer, being a legal entity, requests provision of the Services. 
 
SECTION 14. CONTACTING IT TALENT
IT Talent OÜ
A legal entity incorporated under the laws of the Republic of Estonia
Registry code: 12735787
Address: Harju maakond, Tallinn, Kesklinna linnaosa, Veerenni tn 36a/2-4, 10138 Estonia
 
This Privacy Policy (hereinafter referred to as the “Policy”) describes the procedures implemented by IT Talent OÜ, a legal entity incorporated under the laws of the Republic of Estonia, registry code 12735787 (hereinafter referred to as the “IT Talent”) on processing of personal data of Data subjects using or interested in the educational online services of IT Talent (hereinafter referred to as the “Services”) available via the website with the URL https://ittalent.ee/ (hereinafter referred to as the “Website”) or otherwise. 
 
This Policy shall apply in connection with the Terms of Use of IT Talent (hereinafter referred to as the “Terms”), as well as the Basics of IT Talent Study Organization and Basics of IT Talent Training Quality Assurance. In case of any contradictions between the Policy and the Terms or Basics of IT Talent Study Organization or Basics of IT Talent Training Quality Assurance, the Policy shall prevail. 
 
The terms and definitions provided by the Terms shall apply to this Policy unless their application does not contradict the provisions of the Policy. 
 
The Policy is enacted in accordance with the Personal Data Protection Act of the Republic of Estonia and the General Data Protection Regulation No. 2016/679 (GDPR) adopted by the European Parliament and the Council on 27 April 2016. In case of any contradictions between this Policy and the GDPR or the Personal Data Protection Act, the GDPR or the Personal Data Protection Act shall prevail. In case of any contradictions between the GDPR and the Personal Data Protection Act, the GDPR shall prevail. 
 
All the terms and definitions provided by the GDPR shall apply to this Policy unless their application does not contradict the terms or definitions of the Policy. 
 
If IT Talent processes personal data of a data subject who is not a resident of the European Union, and the processing of personal data of such data subject is governed by the laws and regulations of other jurisdictions, including, but not limited to California Consumer Privacy Act (CCPA) and Children’s Online Privacy Protection Act and Rule enacted by the Federal Trade Commission (COPPA), such laws and regulations shall apply to the extent that their application does not violate the GDPR and laws and regulations of the Republic of Estonia. 
 
The following terms and definitions shall apply to the Policy:
 
Controller” means IT Talent. 
 
Data subject” means a natural person who is either: 
 
(a) a Customer of IT Talent as defined in the Terms or
(b) a natural person who is the representative or employee of the Customer that is a legal entity or
(c) a natural person who uses the Services at the request of the Customer that is a legal entity
(d) a natural person who visits the Website or otherwise expresses the interest in the Services of IT Talent
 
Processor” means a natural person or a legal entity that is either: 
 
(a) engaged in the provision of the Services and processes personal data of Data subjects for the purpose of providing the Services (including Trainers of IT Talent) or
(b) engaged in the processing of personal data of Data subjects under the contract concluded with IT Talent or IT Talent’s Subsidiary or
(c) IT Talent’s Subsidiary 
 
Services” means Services offered by IT Talent under the Terms. 
 
Subsidiary” means a subsidiary of IT Talent as defined in the Terms. 
 
Third party” means a natural person or a legal entity that is either: 
 
(a) provides IT Talent with personal data of the Data subject on the lawful basis provided by Article 6 GDPR or
(b) receives personal data of the Data subject from IT Talent for purposes not related to the processing of personal data under this Policy
 
Usage data” means personal data about the Data subject’s activities on the Internet collected automatically either through the use of the Services or from the Services’ infrastructure itself. The Usage data is anonymous and cannot be attributed to the particular person. 


IT Talent processes personal data of Data subjects under this Policy in accordance with the following principles: 
 
(1) The processing of personal data is performed only in accordance with this Policy and the applicable legislation
 
(2) The processing of personal data is performed only for achieving the purposes specified in the Policy
 
(3) IT Talent processes only personal data that is correct and up-to-date and retained only for such time as may be necessary for achieving the purposes of processing provided by the Policy. 


SECTION 1. LAWFULNESS OF PERSONAL DATA PROCESSING
 
1.1. By visiting or/and exploring the Website, the Data subject provides IT Talent with the consent to the processing of personal data of the Data subject provided in paras.2.1.8-2.1.9 of the Policy. 
 
1.2. By registering for the Course in accordance with Section 5 of the Terms, the Data subject provides IT Talent with the consent to the processing of personal data of the Data subject provided in paras.2.1.1-2.1.7 of the Policy. 
 
1.3. If the Customer is a legal entity which concluded the contract with IT Talent on the provision of the Services for Data subjects who are natural persons, IT Talent has the right to process personal data of such a Customer and the representatives and employees of such a Customer provided in paras.2.1.1-2.1.7 of the Policy under Article 6 paragraph 1 point (a) GDPR. However, IT Talent will not process personal data of Data subjects using the Services of IT Talent at the request of such a Customer unless the Customer provides IT Talent with written consent of all such Data subjects to the processing of their personal data under this Policy. 
 
1.4. Even if the Customer who is a natural person does not provide explicit consent to the processing of his or her personal data, but uses the Services of IT Talent or requests IT talent to provide the Services, IT Talent has the right to process personal data of such a Customer provided in paras.2.1.1-2.1.7 of the Policy for the purposes related to the provision of the Services under the Terms (Article 6 paragraph 1 point (b) GDPR). 
 
1.5. If a Data subject provides IT Talent with personal data prescribed by para.8.2 of the Policy, the Data subject provides IT Talent with the consent to the processing of such personal data for the purposes provided in para.8.3 of the Policy. 
 
1.6. If a Data subject makes publicly available personal data provided in para.8.4 of the Policy, the Data subject provides IT Talent with the consent to the processing of such personal data for the purposes prescribed by para.8.4 of the Policy. 
 
1.7. If a Data subject refuses to give consent to the processing of personal data, and there are no other legal grounds of processing provided by Article 6 GDPR, IT Talent has the right to refuse provision of the Services or restrict access of the Data subject to the Website if provision of the Services or provision of access to the Website are impossible without processing of such personal data. 


SECTION 2. PERSONAL DATA PROCESSED
 
2.1. Under this Policy, IT Talent has the right to process the following personal data of Data subjects: 
 
2.1.1. First and last name of the Data subject.
 
2.1.2. Personal identification code of the Data subject (if the Data subject is a citizen or resident of the Republic of Estonia), or ID/passport number or Tax ID number of the Data subject (if the Data subject is not a citizen or resident of the Republic of Estonia). 
 
2.1.3. Email address of the Data subject and/or the contact details of the Data subject in a social network or messenger (e.g., Telegram, Skype etc.).
 
2.1.4. Phone number of the Data subject. 
 
2.1.5. Address of residence of the Data subject. 
 
2.1.6. Name and address of the person paying the Fee for the Services under the Terms. 
 
2.1.7. Information about the profession or qualification, the level of education, the work experience, and professional interests of the Data subject.
 
2.1.8. Cookies and technically similar data defined in Section 7 of this Policy.
 
2.1.9. Usage data, including, but not limited to Internet Protocol address of the Data subject’s computer or telephone (e.g., IP address), browser type, browser version, the pages of the Website that the Data subject visits, the time and date of the visit of the Website, the time spent by the Data subject on the pages of the Website, unique device identifiers, and other diagnostic data. 
 
2.1.10. Personal data lawfully provided to IT Talent by Third parties. 
 
2.1.11. Other personal data provided by the Data subject voluntarily, including the feedback of the Customer on the Trainer provided in accordance with Section 4 of the Terms and the Basics of IT Talent Training Quality Assurance. 
 
2.2. Personal data not provided in para.2.1 of the Policy may be processed only under the prior consent of the Data subject or under other grounds of processing provided by Article 6 paragraph 1 points (c)-(f) GDPR. 
 
2.3. IT Talent does not and will not process any special categories of personal data provided by Article 9 GDPR (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs etc.). If IT Talent finds out that IT Talent or IT Talent’s Processor has processed any personal data provided by Article 9 GDPR, IT Talent will immediately delete such personal data and will take reasonable measures preventing the processing of such personal data in future. 





SECTION 3. PURPOSES OF PERSONAL DATA PROCESSING
 
3.1. IT Talent has the right to process personal data of Data subjects provided in paras.2.1.1-2.1.7 of the Policy for the following purposes:  
 
3.1.1. Provision of the Services under the Terms. 
 
3.1.2. Resolving disputes with the Customers in accordance with Section 12 of the Terms. 
 
3.1.3. Collecting and assessing the feedback of the Customers on the Trainers provided in accordance with Section 4 of the Terms and the Basics of IT Talent Training Quality Assurance. 
 
3.2. IT Talent has the right to process personal data of Data subjects provided in paras.2.1.8-2.1.9 of the Policy for the following purposes: 
 
3.2.1. Statistical and analytical purposes. 
 
3.2.2. Improving the Data subject’s experience related to the use of the Website. 
 
3.2.3. Improving the work of the Website. 
 
3.2.4. Changing the functionality of the Website to attract more Customers of the Services. 
 
3.2.5. Providing the Customer with all the functionality of the Website necessary for the provision of the Services. 
 
3.2.6. Providing technical support of the Website. 
 
3.2.7. Analyzing the interaction of Data subjects with the Website for amending the contents and the structure of the Website and other Internet resources used by IT Talent for providing the Services. 
 
3.2.8. Analyzing the interaction of Data subjects with the Website for creating and launching marketing and ad campaigns on the Internet. 
 
3.3. IT Talent has the right to process personal data of Data subjects provided in para.2.1 of the Policy for marketing and advertising purposes, which includes direct advertising (such as email newsletters, bulk emailing) and creation of context advertisements. 
 
3.4. Depending on the nature of personal data, IT Talent has the right to process personal data of Data subjects provided in para.2.1.11 of the Policy for the purposes provided in paras.3.1-3.3 of the Policy. 
 
3.5. Depending on the nature of personal data, IT Talent has the right to process personal data of Data subjects provided in para.2.1.10 of the Policy for the purposes provided in para.6.1 of the Policy. 


SECTION 4. DATA SUBJECTS AND PRIVACY OF CHILDREN
 
4.1. The Services of IT Talent are not aimed at natural persons who are under 16 (sixteen) years of age. IT Talent does not provide Services to Customers who are under 16 (sixteen) years of age and does not knowingly process personal data of Data subjects who are under 16 (sixteen) years of age. IT Talent takes all the reasonable technical and organization measures to prevent processing of personal data of Data subjects who are under 16 (sixteen) years of age. 
 
4.2. If IT Talent has doubts regarding the age of the Customer, IT Talent has the right to request the Customer to verify the Customer’s age. If the Customer refuses to verify the Customer’s age or if IT Talent finds out that the Customer is less than 16 (sixteen) years of age, IT Talent immediately terminates the Terms with the Customer, deletes all the personal data associated with such Customer in accordance with this Policy, and restricts access of the Customer to the Services. 
 
4.3. If the Customer is a legal entity, all the natural persons for whom the Customer requests the provision of the Services under the Terms shall be at least 16 (sixteen) years of age. By accepting the Terms, such Customer warrants IT Talent that all the natural persons using the Services under the Terms are at least 16 (sixteen) years of age. If IT Talent has doubts regarding the age of natural persons for whom the Customer requests the provision of the Services, IT Talent has the right to request the Customer to verify the age of natural persons using the Services. If the Customer refuses to verify the age of natural persons using the Services, IT Talent has the right to immediately terminate the Terms with the Customer, delete all the personal data of natural persons for which the Customer requests the provision of the Services, and restrict access of the Customer and all the natural persons to the Services. If IT Talent finds out that some of the natural persons for which the Customer requests the provision of the Services are less than 16 (sixteen) years of age, IT Talent will immediately delete all the personal data associated with such natural persons and restrict access of such natural persons to the Services. 
 
4.4. If a Data subject who is not a Customer and who is under 16 (sixteen) years of age provides IT Talent with any personal data prescribed by paras.2.1.1-2.1.7 or para.2.1.11 of the Policy, IT Talent will immediately delete such personal data and take reasonable measures preventing the processing of such personal data in future.  
 
4.5. If a Third party provides IT Talent with personal data in accordance with para.2.1.10 of the Policy, and IT Talent figures out that such personal data belongs to a Data subject who is under 16 (sixteen) years of age, IT Talent will immediately delete such personal data and take reasonable measures preventing the processing of such personal data in future. IT Talent also has the right to terminate the contract with such a Third party under which the Third party provided IT Talent with personal data. 
 
4.6. If the Website or other technical tools used by IT Talent process personal data provided in paras.2.1.8-2.1.9 of the Policy, and IT Talent figures out that the processed personal data belongs to a Data subject who is under 16 (sixteen) years of age, IT Talent will make all the reasonable steps to extract and delete such personal data. 
 
4.7. If a person who is a holder of parental responsibility over the Data subject that is under 16 (sixteen) years of age contacts IT Talent and presents evidence that IT Talent unknowingly processes personal data of such a Data subject, IT Talent will immediately delete such personal data and take reasonable measures preventing the processing of such personal data in future. If such holder of parental responsibility notifies IT Talent that IT Talent unknowingly processes personal data provided in paras.2.1.8-2.1.9 of the Policy, IT Talent will make all the reasonable steps to extract and delete such personal data and to prevent the processing of such personal data in future. 


SECTION 5. CONTROLLER AND PROCESSOR
 
5.1. Under this Policy, IT Talent is the Controller as defined by Article 4 paragraph 7 GDPR. The Controller determines the purposes and means of the processing of personal data of Data subjects and engages Processors in the processing of personal data under this Policy. 
 
5.2. The Controller processes personal data of Data subjects directly by itself or through engaged Processors. The Processors process personal data of Data subjects on behalf of the Controller as defined in Article 4 paragraph 8 GDPR. All the Processors act under the contracts concluded with the Controller or Controller’s Subsidiary under the direct authorization of the Controller. The Controller observes the compliance of the Processors with the GDPR and other applicable personal data legislation. 
 
5.3. Under this Policy, the Controller has the right to engage the following categories of Processors in the processing of personal data of Data subjects: 
 
5.3.1. Trainers teaching the Courses of IT Talent under the Terms. Such Trainers may only process personal data that directly relates to the teaching of the Courses under the Terms, including personal data provided by para.2.1.11 of the Policy. 
 
5.3.2. Subsidiaries of IT Talent. The Subsidiaries may directly process personal data of Data subjects under the Policy. Under the direct authorization of IT Talent, the Subsidiaries may also conclude contracts with other Processors on the processing of personal data on behalf of the Controller. If the Services are provided through the Subsidiary, IT Talent remains the Controller under this Policy. 
 
5.3.3. Processors that provide technical support to the Website and other Internet resources used by IT Talent for the provision of the Services. 
 
5.3.4. Processors that provide IT Talent with web and other technical solutions aimed at the provision of the Services and/or increasing the quality of the Services. 
 
5.3.5. Processors that assist IT Talent in processing personal data provided by paras.2.1.8-2.1.9 of the Policy. 
 
5.3.6. Processors that assist IT Talent in analyzing and using personal data provided by paras.2.1.8-2.1.9 of the Policy for advertising and marketing purposes (such as Google Analytics, Meta for Business etc.). 
 
5.3.7. Processors that assist IT Talent in resolving disputes with Data subjects. 
 
5.3.8. Processors that ensure the security of the Website and other Internet resources used by IT Talent for the provision of the Services and processing of personal data of Data subjects. 


SECTION 6. THIRD PARTIES AND BUSINESS USE OF PERSONAL DATA
 
6.1. IT Talent may receive personal data personal data provided by para.2.1.10 of the Policy from Third parties for achieving the purposes provided in paras.3.2.1-3.2.8 and para.3.3 of the Policy. Such Third parties do not participate in the processing of personal data under the Policy. The following categories of Third parties may provide IT Talent with personal data of Data subjects for the purposes prescribed by this paragraph of the Policy: 
 
6.1.1. Natural persons and legal entities conducting collection and/or analysis of Usage data described in para.2.1.9 of the Policy. 
 
6.1.2. Business partners, contractors, and subcontractors of IT Talent assisting IT Talent in the provision of the Services under the Terms or participating in other business projects of IT Talent indirectly related or unrelated to the provision of the Services. 
 
6.2. IT Talent refuses to receive personal data from a Third party if such personal data was illegally obtained by such a Third party. If IT Talent finds out that the Third party illegally obtained personal data of a Data subject, IT Talent will immediately delete such personal data and take reasonable measures preventing the processing of such personal data in future. IT Talent also has the right to terminate the contract with such a Third party under which the Third party provided IT Talent with illegally obtained personal data. 
 
6.3. IT Talent may provide personal data of Data subjects to the following categories of Third parties: 
 
6.3.1. Business partners, contractors, and subcontractors of IT Talent assisting IT Talent in providing the Services under the Terms or performing other business projects of IT Talent indirectly related or unrelated to the provision of the Services. Such business partners, contractors, and subcontractors may use personal data of Data subjects exclusively for the following purposes: 
 
(a) Analysis of personal data for the purpose of improving the Services and other services offered by IT Talent or Subsidiaries of IT Talent. 
 
(b) Organizing the provision of the Services or performance of other business projects of IT Talent. 
 
(c) Improving the design or functionality of the Website.
 
(d) Assisting IT Talent with launching and administering marketing and ad campaigns. 
 
(e) Promoting the Services of IT Talent among the current or potential Customers. 
 
6.3.2. Potential or current investors of IT Talent interested in investing in the business activities of IT Talent. Such Third parties may receive personal data of Data subjects exclusively for the purpose of evaluating the business activities of IT Talent to make the decision on investing in the business of IT Talent. The disclosure of Data subjects’ personal data to such Third parties is strictly limited to the purpose of personal data disclosure and performed under the non-disclosure agreement signed with the potential or current investor of IT Talent. Generally, IT Talent does not disclose to such Third parties the personal data provided in paras.2.1.1-2.1.7 of the Policy. 
 
6.3.3. Competent courts, supervising authorities, or other governmental or municipal authorities of the Republic of Estonia or other jurisdictions. The disclosure of Data subjects’ personal data to such Third parties is performed only under the legal request of such a Third party that cannot be overridden or if the disclosure is performed under the grounds provided by Article 6 paragraph 1   points (c)-(f) GDPR. 
 
6.4. IT Talent may disclose personal data of Data subjects to other categories of Third parties not listed in para.6.3 of the Policy if the disclosure is performed under the legal grounds provided by GDPR or applicable laws of the Republic of Estonia or other jurisdictions. 
 
6.5. IT Talent does not and will not sell any personal data of Data subjects to any Third parties or to any other natural persons or legal entities. IT Talent has never sold any personal data of Data subjects within the preceding 12 (twelve) calendar months. 
 
6.6. The Website of IT Talent may include URL links of the websites and other Internet resources of Third parties and other natural and legal persons. IT Talent does not control or govern neither the contents of such websites or Internet resources, nor the rules of personal data processing applicable to such websites or Internet resources. It is fully the Data subject’s responsibility to carefully use the websites and the Internet resources the URLs to which are provided on the Website. IT Talent does not post URLs of websites or other Internet resources that violate applicable laws. 


SECTION 7. COOKIES AND SIMILAR TECHNOLOGIES
 
7.1. Cookies or cookie files are small text files located in browser directories that may include an anonymous unique identifier. Generally, there are two types of cookies – a session cookie and a persistent cookie. A session cookie is used to make it easier for a person to navigate a website and expires when a person closes the browser. A persistent cookie remains on a hard drive of a person’s device for an extended period of time. Cookies cannot be used to run programs or deliver viruses to a person’s computer. Cookies are uniquely assigned to a person’s device and can only be read by a web server in the domain that issued the cookie to a person’s device. To learn more about cookies please follow the link: https://en.wikipedia.org/wiki/HTTP_cookie
 
7.2. IT Talent may use both session cookies and persistent cookies to help Data subjects navigate through the Website and the Services and efficiently perform the functions of the Website. Particularly, the following kinds of cookies may be used by IT Talent in accordance with this Policy: 
 
7.2.1. Session Cookies. IT Talent may use Session Cookies to operate the Services provided via the Website.
 
7.2.2. Preference Cookies. IT Talent may use Preference Cookies to remember preferences and various settings of the Data subject using the Website.
 
7.2.3. Security Cookies. IT Talent may use Security Cookies for making safe the use of the Website.
 
7.3. By use of cookies, IT Talent may automatically collect information about the online activity of the Data subject on the Website. Such information may include: 
 
7.3.1. The information about the web-pages of the Website visited by the Data subject. 
 
7.3.2. The URL links clicked by the Data subject on the Website. 
 
7.3.3. The searches made by the Data subject via the Website. 
 
7.4. The Data subject has the right to accept or decline cookies by using the browser settings. However, if the Data subject declines cookies, the Data subject may not be able to use the full range of functions provided by the Website of IT Talent. 
 
7.5. IT Talent may also use other technologies for processing personal data provided in para.7.3 of the Policy, including the following: 
 
7.5.1. Web beacons. Web beacons (also known as clear gifs, pixel tags, or web bugs) are tiny graphics with a unique identifier, similar in functions to cookies, and used to track online movements of website users. Unlike cookies, which are stored on a user’s device, web beacons are embedded invisibly on the web pages of the website or in an email, and the size of such web beacons is about the size of the period at the end of the sentence. 
 
7.5.2. Tracking URLs. A tracking URL is a standard link that has parameters attached to it for the purpose of tracking and analytics. A tracking URL has unique identifier that allows to identify the source of the website’s traffic (e.g., the location from which the Internet users visit the website, or the search engine used by the visitors for clicking the URL of the website). 
 
7.6. IT Talent may also use web beacons and tracking URLs prescribed by para.7.5 of the Policy in marketing emails of IT Talent (including marketing bulk emailing) and in online advertisements of IT Talent posted on third-party websites. 


SECTION 8. IT TALENT AND SOCIAL NETWORKS
 
8.1. In order to promote information about IT Talent, its Services, and the Website, IT Talent may create the accounts in social networks and messengers, including Facebook, Instagram, WhatsApp, and Telegram. 
8.2. In order to interact with IT Talent, Data subjects may follow the accounts of IT Talent in social networks and the channels of IT Talent in messengers. Data subjects may like posts and comments of IT Talent and leave comments, reviews, or reactions under the posts and messages of IT Talent in social networks and messengers. Data subjects may also send messages to accounts of IT Talent in social networks and messengers, including messages that contain feedback on the work performance of the Trainers teaching the Courses of IT Talent. 
8.3. The data prescribed by para.8.2 of the Policy is considered as personal data of Data subjects provided in para.2.1.11 of the Policy. Such personal data of Data subjects, depending on the nature of the processed data, may be used by IT Talent for the purposes provided by para.3.1, paras.3.2.1-3.2.3, paras.3.2.7-3.2.8, and para.3.3 of the Policy. 
8.4. In addition to the personal data provided in para.8.2 of the Policy IT Talent may also analyze the profile information of the Data subject published by the Data subject on his or her account in a social network or messenger, subject that such analysis does not violate applicable terms and policies of social networks and messengers. The analysis is performed only in manual mode without the use of any automated decision-making. Such analysis may be performed for achieving the purposes provided in paras.3.2.7-3.2.8 and para.3.3 of the Policy. 
 
SECTION 9. RIGHTS OF DATA SUBJECT
9.1. Each Data subject has the following rights: 
9.1.1. Right of access: the Data subject is entitled to receive from IT Talent the information about personal data that is processed by IT Talent, the purposes of personal data processing, the categories of personal data recipients, the period of personal data storage, and the information about the transfer of personal data to other jurisdictions.
9.1.2. Right to lodge a complaint with a supervisory authority: the Data subject is entitled to file a complaint against IT Talent with a supervising authority of Data subject’s habitual residence or place of work, or with a supervising authority located in a place of possible infringement, or with a supervising authority of IT Talent’s residence which supervises the compliance of IT Talent with personal data legislation.
9.1.3. Right to rectification: the Data subject is entitled to rectification of inaccurate data about the Data subject.
9.1.4. Right to erasure: the Data subject is entitled to erasure the personal data about the Data subject.
9.1.5. Right to restriction of processing: the Data subject is entitled to restrict processing of personal data under the grounds provided for in Article 18 GDPR.
9.1.6. Right to data portability: the Data subject is entitled to receive personal data about the Data subject in a structured, commonly used, and machine-readable format and transmit such data to another controller.
9.1.7. Right to object: the Data subject is entitled to object to personal data processing on the grounds relating to a particular situation (for example, if IT Talent processes personal data for marketing purposes).
9.1.8. Right not to be subject to a decision based solely on automated processing, including profiling.
9.1.9. Right to file a request or complaint with IT Talent acting as the Controller. Such right also includes the right of the Data subject to use judicial remedies against IT Talent in a country of IT Talent’s or Data subject’s residence under Article 79 GDPR and the right to use judicial remedies against the supervisory authority in a country where the supervisory authority is established (Article 78 GDPR).
9.1.10. Right to withdraw Data subject’s consent to personal data processing. 
9.1.11. Right to prohibit sale or resale of Data subject’s personal data.
9.2. If the Data subject is intending to use one of the rights provided for in para.9.1 of the Policy, the Data subject shall send a mail or an email to IT Talent by using contact details of IT Talent provided for in Section 14 of the Policy. If the Data subject desires to lodge a complaint with a supervisory authority against IT Talent or use judicial remedies against IT Talent or the supervisory authority, the Data subject shall follow the procedures provided by Articles 77-79 GDPR and by the legislation of the country in which the Data subject is planning to lodge a complaint or use judicial remedies. 
9.3. If the Data subject requests IT Talent to erasure Data subject’s personal data, objects to processing of Data subject’s personal data, exercises the right to data portability, or withdraws the consent to personal data processing, IT Talent has the right to refuse provision of the Services or/and terminate the Terms if provision of the Services is impossible without processing of Data subject’s personal data. In this case, IT Talent also has the right to restrict access of the Data subject to the Website if provision of access to the Website or particular parts of the Website is impossible without processing of Data subject’s personal data under the Policy. 
 
SECTION 10. SECURITY OF PERSONAL DATA
10.1. IT Talent takes all the reasonable measures to protect Data subject’s personal data from unauthorized access by third parties, as well as against loss, misuse, alteration, or destruction of personal data, including the following:
10.1.1. The Data subject’s session on the Website goes through the secure SSL connection during the Website browsing.
10.1.2. Only authorized personnel of IT Talent have access to the personal data of Data subjects, and these employees and contractors are required to treat this information as confidential. 
10.1.3. The Data subject’s personal data is stored on the servers of IT Talent protected by authentication. 
10.2. The existing security measures will be reviewed from time to time in accordance with new legislation and technical innovations.
 
SECTION 11. STORAGE OF PERSONAL DATA
11.1. IT Talent stores personal data of Data subjects only for the period that is necessary for achieving the purposes of processing provided by Section 3 of this Policy. 
11.2. IT Talent stores personal data of the Customers provided in paras.2.1.1-2.1.7 and para.2.1.11 of the Policy for the period of use of the Services by the Customers. If the Customer stops using the Services of IT Talent, IT Talent has the right to store personal data of such Customer for the period not exceeding 5 (five) years after the Customer stops using the Services. The provided five-year term does not apply if the Customer starts using the Services again before the expiration of the five-year term. 
11.3. The rule of para.11.2 of the Policy applies to natural persons for whom the Customer, being a legal entity, requires the provision of the Services under the Terms. 
11.4. IT Talent stores personal data of Data subjects provided in para.2.1.10 of the Policy for the period necessary for achieving the purposes of processing provided by Section 3 of the Policy. 
11.5. IT Talent stores personal data of Data subjects provided in paras.2.1.8-2.1.9 of the Policy for the period necessary for achieving the purposes of processing provided by para.3.2 and para.3.3 of the Policy. 
11.6. IT Talent will periodically review the stored personal data provided in para.11.4 and para.11.5 of the Policy. Based on the nature of personal data and the purposes of processing, IT Talent will periodically delete out-of-date personal data that is not necessary for achieving the purposes of processing provided by Section 3 of the Policy. 
11.7. IT Talent does not store any personal data provided in Section 8 of this Policy. 
11.8. IT Talent will continue storing the personal data of a Data subject if deletion of such personal data is restricted or prohibited by the Money Laundering and Terrorist Financing Prevention Act of the Republic of Estonia or by other applicable laws and regulations. 
 
SECTION 12. INTERNATIONAL TRANSFER OF PERSONAL DATA
12.1. IT Talent stores personal data of Data subjects only on the servers located in the Republic of Estonia or/and other countries of EEA (European Economic Area which includes the countries of the European Union plus Iceland, Liechtenstein, and Norway). 
12.2. If IT Talent takes the organizational decision to store personal data of Data subjects outside EEA, IT Talent will first choose servers located in the countries in respect of which the European Commission made the decision that such countries provide an adequate level of data protection (Article 45 GDPR). Particularly, IT Talent may choose such jurisdictions as Switzerland, the United Kingdom, Andorra, Israel, New Zealand. To see the full list of jurisdictions outside EEA that provide adequate level of data protection please visit the following web-page of the European Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
12.3. If it is not possible for IT Talent to store personal data of Data subjects on the servers located in EEA or jurisdictions provided in para.12.2 of the Policy, IT Talent will transfer personal data of Data subject to other jurisdictions subject to appropriate safeguards provided in Article 46 GDPR. 
12.4. If for some reasons it is not possible for IT Talent to transfer personal data in accordance with para.12.1-12.3 of the Policy, IT Talent will transfer Data subject’s personal data only subject to the provisions of Article 49 GDPR which provide derogations for specific situations. 
Particularly, if a Data subject is a Customer or a natural person for which the Customer, being a legal entity, requires the provision of the Services under the Terms, resides outside EEA, and it is necessary to transfer the personal data of the Customer outside EEA for the performance of the Terms and provision of the Services, IT Talent will perform such a transfer without prior written consent of the Customer (Article 49 paragraph 1 point (b) and point (c) GDPR). The same rule will apply if the Trainer of IT Talent teaching the Courses resides outside EEA, and it is necessary to transfer personal data of the Customer or the natural person using the Services of IT Talent to such a Trainer for the purpose of the provision of the Services or/and reviewing the feedback of the Customer or the natural person about the Trainer. 
IT Talent may also transfer the personal data of the Data subject outside the jurisdictions provided by paras.12.1-12.2 of the Policy if there are legal grounds for transfer provided by Article 49 paragraph 1 points (d)-(g) GDPR. 
12.5. If IT Talent needs to transfer the personal data of the Data subject outside the jurisdictions provided in paras.12.1-12.2 of the Policy, and the only legal ground for such a transfer is the Data subject’s consent to transfer (Article 49 paragraph 1 point (a) GDPR), IT Talent will only perform the transfer after receiving the consent of the Data subject to the proposed transfer of personal data. Such consent may only be obtained from the Data subject after IT Talent informs the Data subject about the possible risks of such a transfer caused by the absence of an adequacy decision provided by para.12.2 of the Policy and appropriate safeguards provided by para.12.3 of the Policy. If the Data subject does not provide the consent to the transfer of personal data, IT Talent may refuse provision of the Services to such a Data subject or restrict access of the Data subject to the Website if provision of the Services or provision of access to the Website are impossible without the Data subject’s consent to the international transfer of personal data. 
 
SECTION 13. CHANGES TO THE PRIVACY POLICY
13.1. IT Talent shall periodically review this Policy for the compliance with applicable data protection laws and will provide the Policy with amendments as IT Talents deems necessary. The amendments will be posted on the Website in the form of the updated Policy and will be in effect since the date of publication. The publication of the updated version of the Policy amounts to notification of Data subjects about the changes. Data subjects shall periodically review the Website for the amendments in the Policy. 
13.2. IT Talent will take reasonable measures to notify the current Customers of IT Talent about the changes in the Policy. In doing so, IT Talent may send emails or SMS to the Customers using the Services or to natural persons for whom the Customer, being a legal entity, requests provision of the Services. 
 
SECTION 14. CONTACTING IT TALENT
IT Talent OÜ
A legal entity incorporated under the laws of the Republic of Estonia
Registry code: 12735787
Address: Harju maakond, Tallinn, Kesklinna linnaosa, Veerenni tn 36a/2-4, 10138 Estonia

This Privacy Policy (hereinafter referred to as the “
Policy”) describes the procedures implemented by IT Talent OÜ, a legal entity incorporated under the laws of the Republic of Estonia, registry code 12735787 (hereinafter referred to as the “IT Talent”) on processing of personal data of Data subjects using or interested in the educational online services of IT Talent (hereinafter referred to as the “Services”) available via the website with the URL https://ittalent.ee/ (hereinafter referred to as the “Website”) or otherwise. 
This Policy shall apply in connection with the Terms of Use of IT Talent (hereinafter referred to as the “Terms”), as well as the Basics of IT Talent Study Organization and Basics of IT Talent Training Quality Assurance. In case of any contradictions between the Policy and the Terms or Basics of IT Talent Study Organization or Basics of IT Talent Training Quality Assurance, the Policy shall prevail. 
The terms and definitions provided by the Terms shall apply to this Policy unless their application does not contradict the provisions of the Policy. 
The Policy is enacted in accordance with the Personal Data Protection Act of the Republic of Estonia and the General Data Protection Regulation No. 2016/679 (GDPR) adopted by the European Parliament and the Council on 27 April 2016. In case of any contradictions between this Policy and the GDPR or the Personal Data Protection Act, the GDPR or the Personal Data Protection Act shall prevail. In case of any contradictions between the GDPR and the Personal Data Protection Act, the GDPR shall prevail. 
All the terms and definitions provided by the GDPR shall apply to this Policy unless their application does not contradict the terms or definitions of the Policy. 
If IT Talent processes personal data of a data subject who is not a resident of the European Union, and the processing of personal data of such data subject is governed by the laws and regulations of other jurisdictions, including, but not limited to California Consumer Privacy Act (CCPA) and Children’s Online Privacy Protection Act and Rule enacted by the Federal Trade Commission (COPPA), such laws and regulations shall apply to the extent that their application does not violate the GDPR and laws and regulations of the Republic of Estonia. 
The following terms and definitions shall apply to the Policy:
Controller” means IT Talent. 
Data subject” means a natural person who is either: 
(a) a Customer of IT Talent as defined in the Terms or
(b) a natural person who is the representative or employee of the Customer that is a legal entity or
(c) a natural person who uses the Services at the request of the Customer that is a legal entity
(d) a natural person who visits the Website or otherwise expresses the interest in the Services of IT Talent
Processor” means a natural person or a legal entity that is either: 
(a) engaged in the provision of the Services and processes personal data of Data subjects for the purpose of providing the Services (including Trainers of IT Talent) or
(b) engaged in the processing of personal data of Data subjects under the contract concluded with IT Talent or IT Talent’s Subsidiary or
(c) IT Talent’s Subsidiary 
Services” means Services offered by IT Talent under the Terms. 
Subsidiary” means a subsidiary of IT Talent as defined in the Terms. 
Third party” means a natural person or a legal entity that is either: 
(a) provides IT Talent with personal data of the Data subject on the lawful basis provided by Article 6 GDPR or
(b) receives personal data of the Data subject from IT Talent for purposes not related to the processing of personal data under this Policy
 
Usage data” means personal data about the Data subject’s activities on the Internet collected automatically either through the use of the Services or from the Services’ infrastructure itself. The Usage data is anonymous and cannot be attributed to the particular person. 

IT Talent processes personal data of Data subjects under this Policy in accordance with the following principles: 
(1) The processing of personal data is performed only in accordance with this Policy and the applicable legislation
(2) The processing of personal data is performed only for achieving the purposes specified in the Policy
(3) IT Talent processes only personal data that is correct and up-to-date and retained only for such time as may be necessary for achieving the purposes of processing provided by the Policy. 

SECTION 1. LAWFULNESS OF PERSONAL DATA PROCESSING
1.1. By visiting or/and exploring the Website, the Data subject provides IT Talent with the consent to the processing of personal data of the Data subject provided in paras.2.1.8-2.1.9 of the Policy. 
1.2. By registering for the Course in accordance with Section 5 of the Terms, the Data subject provides IT Talent with the consent to the processing of personal data of the Data subject provided in paras.2.1.1-2.1.7 of the Policy. 
1.3. If the Customer is a legal entity which concluded the contract with IT Talent on the provision of the Services for Data subjects who are natural persons, IT Talent has the right to process personal data of such a Customer and the representatives and employees of such a Customer provided in paras.2.1.1-2.1.7 of the Policy under Article 6 paragraph 1 point (a) GDPR. However, IT Talent will not process personal data of Data subjects using the Services of IT Talent at the request of such a Customer unless the Customer provides IT Talent with written consent of all such Data subjects to the processing of their personal data under this Policy. 
 
1.4. Even if the Customer who is a natural person does not provide explicit consent to the processing of his or her personal data, but uses the Services of IT Talent or requests IT talent to provide the Services, IT Talent has the right to process personal data of such a Customer provided in paras.2.1.1-2.1.7 of the Policy for the purposes related to the provision of the Services under the Terms (Article 6 paragraph 1 point (b) GDPR). 
1.5. If a Data subject provides IT Talent with personal data prescribed by para.8.2 of the Policy, the Data subject provides IT Talent with the consent to the processing of such personal data for the purposes provided in para.8.3 of the Policy. 
1.6. If a Data subject makes publicly available personal data provided in para.8.4 of the Policy, the Data subject provides IT Talent with the consent to the processing of such personal data for the purposes prescribed by para.8.4 of the Policy. 
1.7. If a Data subject refuses to give consent to the processing of personal data, and there are no other legal grounds of processing provided by Article 6 GDPR, IT Talent has the right to refuse provision of the Services or restrict access of the Data subject to the Website if provision of the Services or provision of access to the Website are impossible without processing of such personal data. 

 SECTION 2. PERSONAL DATA PROCESSED
2.1. Under this Policy, IT Talent has the right to process the following personal data of Data subjects: 
2.1.1. First and last name of the Data subject.
2.1.2. Personal identification code of the Data subject (if the Data subject is a citizen or resident of the Republic of Estonia), or ID/passport number or Tax ID number of the Data subject (if the Data subject is not a citizen or resident of the Republic of Estonia). 
2.1.3. Email address of the Data subject and/or the contact details of the Data subject in a social network or messenger (e.g., Telegram, Skype etc.).
2.1.4. Phone number of the Data subject. 
2.1.5. Address of residence of the Data subject. 
2.1.6. Name and address of the person paying the Fee for the Services under the Terms. 
2.1.7. Information about the profession or qualification, the level of education, the work experience, and professional interests of the Data subject.
2.1.8. Cookies and technically similar data defined in Section 7 of this Policy.
2.1.9. Usage data, including, but not limited to Internet Protocol address of the Data subject’s computer or telephone (e.g., IP address), browser type, browser version, the pages of the Website that the Data subject visits, the time and date of the visit of the Website, the time spent by the Data subject on the pages of the Website, unique device identifiers, and other diagnostic data. 
2.1.10. Personal data lawfully provided to IT Talent by Third parties. 
2.1.11. Other personal data provided by the Data subject voluntarily, including the feedback of the Customer on the Trainer provided in accordance with Section 4 of the Terms and the Basics of IT Talent Training Quality Assurance. 
2.2. Personal data not provided in para.2.1 of the Policy may be processed only under the prior consent of the Data subject or under other grounds of processing provided by Article 6 paragraph 1 points (c)-(f) GDPR. 
2.3. IT Talent does not and will not process any special categories of personal data provided by Article 9 GDPR (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs etc.). If IT Talent finds out that IT Talent or IT Talent’s Processor has processed any personal data provided by Article 9 GDPR, IT Talent will immediately delete such personal data and will take reasonable measures preventing the processing of such personal data in future. 





SECTION 3. PURPOSES OF PERSONAL DATA PROCESSING
3.1. IT Talent has the right to process personal data of Data subjects provided in paras.2.1.1-2.1.7 of the Policy for the following purposes:  
3.1.1. Provision of the Services under the Terms. 
3.1.2. Resolving disputes with the Customers in accordance with Section 12 of the Terms. 
3.1.3. Collecting and assessing the feedback of the Customers on the Trainers provided in accordance with Section 4 of the Terms and the Basics of IT Talent Training Quality Assurance. 
3.2. IT Talent has the right to process personal data of Data subjects provided in paras.2.1.8-2.1.9 of the Policy for the following purposes: 
3.2.1. Statistical and analytical purposes. 
3.2.2. Improving the Data subject’s experience related to the use of the Website. 
3.2.3. Improving the work of the Website. 
3.2.4. Changing the functionality of the Website to attract more Customers of the Services. 
3.2.5. Providing the Customer with all the functionality of the Website necessary for the provision of the Services. 
3.2.6. Providing technical support of the Website. 
3.2.7. Analyzing the interaction of Data subjects with the Website for amending the contents and the structure of the Website and other Internet resources used by IT Talent for providing the Services. 
3.2.8. Analyzing the interaction of Data subjects with the Website for creating and launching marketing and ad campaigns on the Internet. 
3.3. IT Talent has the right to process personal data of Data subjects provided in para.2.1 of the Policy for marketing and advertising purposes, which includes direct advertising (such as email newsletters, bulk emailing) and creation of context advertisements. 
3.4. Depending on the nature of personal data, IT Talent has the right to process personal data of Data subjects provided in para.2.1.11 of the Policy for the purposes provided in paras.3.1-3.3 of the Policy. 
3.5. Depending on the nature of personal data, IT Talent has the right to process personal data of Data subjects provided in para.2.1.10 of the Policy for the purposes provided in para.6.1 of the Policy. 

 SECTION 4. DATA SUBJECTS AND PRIVACY OF CHILDREN
4.1. The Services of IT Talent are not aimed at natural persons who are under 16 (sixteen) years of age. IT Talent does not provide Services to Customers who are under 16 (sixteen) years of age and does not knowingly process personal data of Data subjects who are under 16 (sixteen) years of age. IT Talent takes all the reasonable technical and organization measures to prevent processing of personal data of Data subjects who are under 16 (sixteen) years of age. 
4.2. If IT Talent has doubts regarding the age of the Customer, IT Talent has the right to request the Customer to verify the Customer’s age. If the Customer refuses to verify the Customer’s age or if IT Talent finds out that the Customer is less than 16 (sixteen) years of age, IT Talent immediately terminates the Terms with the Customer, deletes all the personal data associated with such Customer in accordance with this Policy, and restricts access of the Customer to the Services. 
4.3. If the Customer is a legal entity, all the natural persons for whom the Customer requests the provision of the Services under the Terms shall be at least 16 (sixteen) years of age. By accepting the Terms, such Customer warrants IT Talent that all the natural persons using the Services under the Terms are at least 16 (sixteen) years of age. If IT Talent has doubts regarding the age of natural persons for whom the Customer requests the provision of the Services, IT Talent has the right to request the Customer to verify the age of natural persons using the Services. If the Customer refuses to verify the age of natural persons using the Services, IT Talent has the right to immediately terminate the Terms with the Customer, delete all the personal data of natural persons for which the Customer requests the provision of the Services, and restrict access of the Customer and all the natural persons to the Services. If IT Talent finds out that some of the natural persons for which the Customer requests the provision of the Services are less than 16 (sixteen) years of age, IT Talent will immediately delete all the personal data associated with such natural persons and restrict access of such natural persons to the Services. 
 
4.4. If a Data subject who is not a Customer and who is under 16 (sixteen) years of age provides IT Talent with any personal data prescribed by paras.2.1.1-2.1.7 or para.2.1.11 of the Policy, IT Talent will immediately delete such personal data and take reasonable measures preventing the processing of such personal data in future.  
 
4.5. If a Third party provides IT Talent with personal data in accordance with para.2.1.10 of the Policy, and IT Talent figures out that such personal data belongs to a Data subject who is under 16 (sixteen) years of age, IT Talent will immediately delete such personal data and take reasonable measures preventing the processing of such personal data in future. IT Talent also has the right to terminate the contract with such a Third party under which the Third party provided IT Talent with personal data. 
 
4.6. If the Website or other technical tools used by IT Talent process personal data provided in paras.2.1.8-2.1.9 of the Policy, and IT Talent figures out that the processed personal data belongs to a Data subject who is under 16 (sixteen) years of age, IT Talent will make all the reasonable steps to extract and delete such personal data. 
 
4.7. If a person who is a holder of parental responsibility over the Data subject that is under 16 (sixteen) years of age contacts IT Talent and presents evidence that IT Talent unknowingly processes personal data of such a Data subject, IT Talent will immediately delete such personal data and take reasonable measures preventing the processing of such personal data in future. If such holder of parental responsibility notifies IT Talent that IT Talent unknowingly processes personal data provided in paras.2.1.8-2.1.9 of the Policy, IT Talent will make all the reasonable steps to extract and delete such personal data and to prevent the processing of such personal data in future. 


SECTION 5. CONTROLLER AND PROCESSOR
 
5.1. Under this Policy, IT Talent is the Controller as defined by Article 4 paragraph 7 GDPR. The Controller determines the purposes and means of the processing of personal data of Data subjects and engages Processors in the processing of personal data under this Policy. 
 
5.2. The Controller processes personal data of Data subjects directly by itself or through engaged Processors. The Processors process personal data of Data subjects on behalf of the Controller as defined in Article 4 paragraph 8 GDPR. All the Processors act under the contracts concluded with the Controller or Controller’s Subsidiary under the direct authorization of the Controller. The Controller observes the compliance of the Processors with the GDPR and other applicable personal data legislation. 
 
5.3. Under this Policy, the Controller has the right to engage the following categories of Processors in the processing of personal data of Data subjects: 
 
5.3.1. Trainers teaching the Courses of IT Talent under the Terms. Such Trainers may only process personal data that directly relates to the teaching of the Courses under the Terms, including personal data provided by para.2.1.11 of the Policy. 
 
5.3.2. Subsidiaries of IT Talent. The Subsidiaries may directly process personal data of Data subjects under the Policy. Under the direct authorization of IT Talent, the Subsidiaries may also conclude contracts with other Processors on the processing of personal data on behalf of the Controller. If the Services are provided through the Subsidiary, IT Talent remains the Controller under this Policy. 
 
5.3.3. Processors that provide technical support to the Website and other Internet resources used by IT Talent for the provision of the Services. 
 
5.3.4. Processors that provide IT Talent with web and other technical solutions aimed at the provision of the Services and/or increasing the quality of the Services. 
 
5.3.5. Processors that assist IT Talent in processing personal data provided by paras.2.1.8-2.1.9 of the Policy. 
 
5.3.6. Processors that assist IT Talent in analyzing and using personal data provided by paras.2.1.8-2.1.9 of the Policy for advertising and marketing purposes (such as Google Analytics, Meta for Business etc.). 
 
5.3.7. Processors that assist IT Talent in resolving disputes with Data subjects. 
 
5.3.8. Processors that ensure the security of the Website and other Internet resources used by IT Talent for the provision of the Services and processing of personal data of Data subjects. 


SECTION 6. THIRD PARTIES AND BUSINESS USE OF PERSONAL DATA
 
6.1. IT Talent may receive personal data personal data provided by para.2.1.10 of the Policy from Third parties for achieving the purposes provided in paras.3.2.1-3.2.8 and para.3.3 of the Policy. Such Third parties do not participate in the processing of personal data under the Policy. The following categories of Third parties may provide IT Talent with personal data of Data subjects for the purposes prescribed by this paragraph of the Policy: 
 
6.1.1. Natural persons and legal entities conducting collection and/or analysis of Usage data described in para.2.1.9 of the Policy. 
 
6.1.2. Business partners, contractors, and subcontractors of IT Talent assisting IT Talent in the provision of the Services under the Terms or participating in other business projects of IT Talent indirectly related or unrelated to the provision of the Services. 
 
6.2. IT Talent refuses to receive personal data from a Third party if such personal data was illegally obtained by such a Third party. If IT Talent finds out that the Third party illegally obtained personal data of a Data subject, IT Talent will immediately delete such personal data and take reasonable measures preventing the processing of such personal data in future. IT Talent also has the right to terminate the contract with such a Third party under which the Third party provided IT Talent with illegally obtained personal data. 
 
6.3. IT Talent may provide personal data of Data subjects to the following categories of Third parties: 
 
6.3.1. Business partners, contractors, and subcontractors of IT Talent assisting IT Talent in providing the Services under the Terms or performing other business projects of IT Talent indirectly related or unrelated to the provision of the Services. Such business partners, contractors, and subcontractors may use personal data of Data subjects exclusively for the following purposes: 
 
(a) Analysis of personal data for the purpose of improving the Services and other services offered by IT Talent or Subsidiaries of IT Talent. 
 
(b) Organizing the provision of the Services or performance of other business projects of IT Talent. 
 
(c) Improving the design or functionality of the Website.
 
(d) Assisting IT Talent with launching and administering marketing and ad campaigns. 
 
(e) Promoting the Services of IT Talent among the current or potential Customers. 
 
6.3.2. Potential or current investors of IT Talent interested in investing in the business activities of IT Talent. Such Third parties may receive personal data of Data subjects exclusively for the purpose of evaluating the business activities of IT Talent to make the decision on investing in the business of IT Talent. The disclosure of Data subjects’ personal data to such Third parties is strictly limited to the purpose of personal data disclosure and performed under the non-disclosure agreement signed with the potential or current investor of IT Talent. Generally, IT Talent does not disclose to such Third parties the personal data provided in paras.2.1.1-2.1.7 of the Policy. 
 
6.3.3. Competent courts, supervising authorities, or other governmental or municipal authorities of the Republic of Estonia or other jurisdictions. The disclosure of Data subjects’ personal data to such Third parties is performed only under the legal request of such a Third party that cannot be overridden or if the disclosure is performed under the grounds provided by Article 6 paragraph 1   points (c)-(f) GDPR. 
 
6.4. IT Talent may disclose personal data of Data subjects to other categories of Third parties not listed in para.6.3 of the Policy if the disclosure is performed under the legal grounds provided by GDPR or applicable laws of the Republic of Estonia or other jurisdictions. 
 
6.5. IT Talent does not and will not sell any personal data of Data subjects to any Third parties or to any other natural persons or legal entities. IT Talent has never sold any personal data of Data subjects within the preceding 12 (twelve) calendar months. 
 
6.6. The Website of IT Talent may include URL links of the websites and other Internet resources of Third parties and other natural and legal persons. IT Talent does not control or govern neither the contents of such websites or Internet resources, nor the rules of personal data processing applicable to such websites or Internet resources. It is fully the Data subject’s responsibility to carefully use the websites and the Internet resources the URLs to which are provided on the Website. IT Talent does not post URLs of websites or other Internet resources that violate applicable laws. 


SECTION 7. COOKIES AND SIMILAR TECHNOLOGIES
 
7.1. Cookies or cookie files are small text files located in browser directories that may include an anonymous unique identifier. Generally, there are two types of cookies – a session cookie and a persistent cookie. A session cookie is used to make it easier for a person to navigate a website and expires when a person closes the browser. A persistent cookie remains on a hard drive of a person’s device for an extended period of time. Cookies cannot be used to run programs or deliver viruses to a person’s computer. Cookies are uniquely assigned to a person’s device and can only be read by a web server in the domain that issued the cookie to a person’s device. To learn more about cookies please follow the link: https://en.wikipedia.org/wiki/HTTP_cookie
 
7.2. IT Talent may use both session cookies and persistent cookies to help Data subjects navigate through the Website and the Services and efficiently perform the functions of the Website. Particularly, the following kinds of cookies may be used by IT Talent in accordance with this Policy: 
 
7.2.1. Session Cookies. IT Talent may use Session Cookies to operate the Services provided via the Website.
 
7.2.2. Preference Cookies. IT Talent may use Preference Cookies to remember preferences and various settings of the Data subject using the Website.
 
7.2.3. Security Cookies. IT Talent may use Security Cookies for making safe the use of the Website.
 
7.3. By use of cookies, IT Talent may automatically collect information about the online activity of the Data subject on the Website. Such information may include: 
 
7.3.1. The information about the web-pages of the Website visited by the Data subject. 
 
7.3.2. The URL links clicked by the Data subject on the Website. 
 
7.3.3. The searches made by the Data subject via the Website. 
 
7.4. The Data subject has the right to accept or decline cookies by using the browser settings. However, if the Data subject declines cookies, the Data subject may not be able to use the full range of functions provided by the Website of IT Talent. 
 
7.5. IT Talent may also use other technologies for processing personal data provided in para.7.3 of the Policy, including the following: 
 
7.5.1. Web beacons. Web beacons (also known as clear gifs, pixel tags, or web bugs) are tiny graphics with a unique identifier, similar in functions to cookies, and used to track online movements of website users. Unlike cookies, which are stored on a user’s device, web beacons are embedded invisibly on the web pages of the website or in an email, and the size of such web beacons is about the size of the period at the end of the sentence. 
 
7.5.2. Tracking URLs. A tracking URL is a standard link that has parameters attached to it for the purpose of tracking and analytics. A tracking URL has unique identifier that allows to identify the source of the website’s traffic (e.g., the location from which the Internet users visit the website, or the search engine used by the visitors for clicking the URL of the website). 
 
7.6. IT Talent may also use web beacons and tracking URLs prescribed by para.7.5 of the Policy in marketing emails of IT Talent (including marketing bulk emailing) and in online advertisements of IT Talent posted on third-party websites. 


SECTION 8. IT TALENT AND SOCIAL NETWORKS
 
8.1. In order to promote information about IT Talent, its Services, and the Website, IT Talent may create the accounts in social networks and messengers, including Facebook, Instagram, WhatsApp, and Telegram. 
8.2. In order to interact with IT Talent, Data subjects may follow the accounts of IT Talent in social networks and the channels of IT Talent in messengers. Data subjects may like posts and comments of IT Talent and leave comments, reviews, or reactions under the posts and messages of IT Talent in social networks and messengers. Data subjects may also send messages to accounts of IT Talent in social networks and messengers, including messages that contain feedback on the work performance of the Trainers teaching the Courses of IT Talent. 
8.3. The data prescribed by para.8.2 of the Policy is considered as personal data of Data subjects provided in para.2.1.11 of the Policy. Such personal data of Data subjects, depending on the nature of the processed data, may be used by IT Talent for the purposes provided by para.3.1, paras.3.2.1-3.2.3, paras.3.2.7-3.2.8, and para.3.3 of the Policy. 
8.4. In addition to the personal data provided in para.8.2 of the Policy IT Talent may also analyze the profile information of the Data subject published by the Data subject on his or her account in a social network or messenger, subject that such analysis does not violate applicable terms and policies of social networks and messengers. The analysis is performed only in manual mode without the use of any automated decision-making. Such analysis may be performed for achieving the purposes provided in paras.3.2.7-3.2.8 and para.3.3 of the Policy. 
 
SECTION 9. RIGHTS OF DATA SUBJECT
9.1. Each Data subject has the following rights: 
9.1.1. Right of access: the Data subject is entitled to receive from IT Talent the information about personal data that is processed by IT Talent, the purposes of personal data processing, the categories of personal data recipients, the period of personal data storage, and the information about the transfer of personal data to other jurisdictions.
9.1.2. Right to lodge a complaint with a supervisory authority: the Data subject is entitled to file a complaint against IT Talent with a supervising authority of Data subject’s habitual residence or place of work, or with a supervising authority located in a place of possible infringement, or with a supervising authority of IT Talent’s residence which supervises the compliance of IT Talent with personal data legislation.
9.1.3. Right to rectification: the Data subject is entitled to rectification of inaccurate data about the Data subject.
9.1.4. Right to erasure: the Data subject is entitled to erasure the personal data about the Data subject.
9.1.5. Right to restriction of processing: the Data subject is entitled to restrict processing of personal data under the grounds provided for in Article 18 GDPR.
9.1.6. Right to data portability: the Data subject is entitled to receive personal data about the Data subject in a structured, commonly used, and machine-readable format and transmit such data to another controller.
9.1.7. Right to object: the Data subject is entitled to object to personal data processing on the grounds relating to a particular situation (for example, if IT Talent processes personal data for marketing purposes).
9.1.8. Right not to be subject to a decision based solely on automated processing, including profiling.
9.1.9. Right to file a request or complaint with IT Talent acting as the Controller. Such right also includes the right of the Data subject to use judicial remedies against IT Talent in a country of IT Talent’s or Data subject’s residence under Article 79 GDPR and the right to use judicial remedies against the supervisory authority in a country where the supervisory authority is established (Article 78 GDPR).
9.1.10. Right to withdraw Data subject’s consent to personal data processing. 
9.1.11. Right to prohibit sale or resale of Data subject’s personal data.
9.2. If the Data subject is intending to use one of the rights provided for in para.9.1 of the Policy, the Data subject shall send a mail or an email to IT Talent by using contact details of IT Talent provided for in Section 14 of the Policy. If the Data subject desires to lodge a complaint with a supervisory authority against IT Talent or use judicial remedies against IT Talent or the supervisory authority, the Data subject shall follow the procedures provided by Articles 77-79 GDPR and by the legislation of the country in which the Data subject is planning to lodge a complaint or use judicial remedies. 
9.3. If the Data subject requests IT Talent to erasure Data subject’s personal data, objects to processing of Data subject’s personal data, exercises the right to data portability, or withdraws the consent to personal data processing, IT Talent has the right to refuse provision of the Services or/and terminate the Terms if provision of the Services is impossible without processing of Data subject’s personal data. In this case, IT Talent also has the right to restrict access of the Data subject to the Website if provision of access to the Website or particular parts of the Website is impossible without processing of Data subject’s personal data under the Policy. 
 
SECTION 10. SECURITY OF PERSONAL DATA
10.1. IT Talent takes all the reasonable measures to protect Data subject’s personal data from unauthorized access by third parties, as well as against loss, misuse, alteration, or destruction of personal data, including the following:
10.1.1. The Data subject’s session on the Website goes through the secure SSL connection during the Website browsing.
10.1.2. Only authorized personnel of IT Talent have access to the personal data of Data subjects, and these employees and contractors are required to treat this information as confidential. 
10.1.3. The Data subject’s personal data is stored on the servers of IT Talent protected by authentication. 
10.2. The existing security measures will be reviewed from time to time in accordance with new legislation and technical innovations.
 
SECTION 11. STORAGE OF PERSONAL DATA
11.1. IT Talent stores personal data of Data subjects only for the period that is necessary for achieving the purposes of processing provided by Section 3 of this Policy. 
11.2. IT Talent stores personal data of the Customers provided in paras.2.1.1-2.1.7 and para.2.1.11 of the Policy for the period of use of the Services by the Customers. If the Customer stops using the Services of IT Talent, IT Talent has the right to store personal data of such Customer for the period not exceeding 5 (five) years after the Customer stops using the Services. The provided five-year term does not apply if the Customer starts using the Services again before the expiration of the five-year term. 
11.3. The rule of para.11.2 of the Policy applies to natural persons for whom the Customer, being a legal entity, requires the provision of the Services under the Terms. 
11.4. IT Talent stores personal data of Data subjects provided in para.2.1.10 of the Policy for the period necessary for achieving the purposes of processing provided by Section 3 of the Policy. 
11.5. IT Talent stores personal data of Data subjects provided in paras.2.1.8-2.1.9 of the Policy for the period necessary for achieving the purposes of processing provided by para.3.2 and para.3.3 of the Policy. 
11.6. IT Talent will periodically review the stored personal data provided in para.11.4 and para.11.5 of the Policy. Based on the nature of personal data and the purposes of processing, IT Talent will periodically delete out-of-date personal data that is not necessary for achieving the purposes of processing provided by Section 3 of the Policy. 
11.7. IT Talent does not store any personal data provided in Section 8 of this Policy. 
11.8. IT Talent will continue storing the personal data of a Data subject if deletion of such personal data is restricted or prohibited by the Money Laundering and Terrorist Financing Prevention Act of the Republic of Estonia or by other applicable laws and regulations. 
 
SECTION 12. INTERNATIONAL TRANSFER OF PERSONAL DATA
12.1. IT Talent stores personal data of Data subjects only on the servers located in the Republic of Estonia or/and other countries of EEA (European Economic Area which includes the countries of the European Union plus Iceland, Liechtenstein, and Norway). 
12.2. If IT Talent takes the organizational decision to store personal data of Data subjects outside EEA, IT Talent will first choose servers located in the countries in respect of which the European Commission made the decision that such countries provide an adequate level of data protection (Article 45 GDPR). Particularly, IT Talent may choose such jurisdictions as Switzerland, the United Kingdom, Andorra, Israel, New Zealand. To see the full list of jurisdictions outside EEA that provide adequate level of data protection please visit the following web-page of the European Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
12.3. If it is not possible for IT Talent to store personal data of Data subjects on the servers located in EEA or jurisdictions provided in para.12.2 of the Policy, IT Talent will transfer personal data of Data subject to other jurisdictions subject to appropriate safeguards provided in Article 46 GDPR. 
12.4. If for some reasons it is not possible for IT Talent to transfer personal data in accordance with para.12.1-12.3 of the Policy, IT Talent will transfer Data subject’s personal data only subject to the provisions of Article 49 GDPR which provide derogations for specific situations. 
Particularly, if a Data subject is a Customer or a natural person for which the Customer, being a legal entity, requires the provision of the Services under the Terms, resides outside EEA, and it is necessary to transfer the personal data of the Customer outside EEA for the performance of the Terms and provision of the Services, IT Talent will perform such a transfer without prior written consent of the Customer (Article 49 paragraph 1 point (b) and point (c) GDPR). The same rule will apply if the Trainer of IT Talent teaching the Courses resides outside EEA, and it is necessary to transfer personal data of the Customer or the natural person using the Services of IT Talent to such a Trainer for the purpose of the provision of the Services or/and reviewing the feedback of the Customer or the natural person about the Trainer. 
IT Talent may also transfer the personal data of the Data subject outside the jurisdictions provided by paras.12.1-12.2 of the Policy if there are legal grounds for transfer provided by Article 49 paragraph 1 points (d)-(g) GDPR. 
12.5. If IT Talent needs to transfer the personal data of the Data subject outside the jurisdictions provided in paras.12.1-12.2 of the Policy, and the only legal ground for such a transfer is the Data subject’s consent to transfer (Article 49 paragraph 1 point (a) GDPR), IT Talent will only perform the transfer after receiving the consent of the Data subject to the proposed transfer of personal data. Such consent may only be obtained from the Data subject after IT Talent informs the Data subject about the possible risks of such a transfer caused by the absence of an adequacy decision provided by para.12.2 of the Policy and appropriate safeguards provided by para.12.3 of the Policy. If the Data subject does not provide the consent to the transfer of personal data, IT Talent may refuse provision of the Services to such a Data subject or restrict access of the Data subject to the Website if provision of the Services or provision of access to the Website are impossible without the Data subject’s consent to the international transfer of personal data. 
 
SECTION 13. CHANGES TO THE PRIVACY POLICY
13.1. IT Talent shall periodically review this Policy for the compliance with applicable data protection laws and will provide the Policy with amendments as IT Talents deems necessary. The amendments will be posted on the Website in the form of the updated Policy and will be in effect since the date of publication. The publication of the updated version of the Policy amounts to notification of Data subjects about the changes. Data subjects shall periodically review the Website for the amendments in the Policy. 
13.2. IT Talent will take reasonable measures to notify the current Customers of IT Talent about the changes in the Policy. In doing so, IT Talent may send emails or SMS to the Customers using the Services or to natural persons for whom the Customer, being a legal entity, requests provision of the Services. 
 
SECTION 14. CONTACTING IT TALENT
IT Talent OÜ
A legal entity incorporated under the laws of the Republic of Estonia
Registry code: 12735787
Address: Harju maakond, Tallinn, Kesklinna linnaosa, Veerenni tn 36a/2-4, 10138 Estonia