Data controller means the company/establishment that determines the purposes and means of the processing of personal data. Processor means the person processing personal data on behalf and on the instructions of the controller.
Astro Baltics is the controller of personal data submitted to us, but the processor of data to be entered in the Services of Astro Baltics by a customer and the customer is the owner and controller of the latter data.
The processors of Astro Baltics are partners who provide, for instance, legal assistance services, transportation services, recruitment services, etc., to Astro Baltics.
A processor has the right to perform processing operations only in terms of and to the extent of personal data authorised by the controller.

Personal data means any information relating to an identified or identifiable natural person – customers, partners or visitors of Astro Baltics. Astro Baltics collects personal data for the purpose of software sales operations, preparation of contracts and/or invoices, compliance with the terms and conditions of contracts entered into with customers, identification or contacting of persons to provide the Services to them, retain customers or settling any matters. We only use personal data for the purpose prescribed, i.e. for performance of operations required for the provision of our Services.

Astro Baltics undertakes to protect the personal data and privacy of customers. Astro Baltics applies precautions (incl. technical and organisational measures) corresponding to the risks in order to protect the personal data collected. Access to personal data is only provided to persons who need it for processing personal data to achieve the objectives set out in the Privacy Policy.
The personal data collected by us may include the following:

• your name;
• your personal identification code;
• your telephone number;
• your e-mail address;
• your address;
• your company name and your position;
• details of your current account;
• the text of your inquiry;
• other data required for the provision of the Service.

The categories of personal data to be processed may vary as arising from the contract entered into between Astro Baltics and the customer and additional solutions.
Your personal data are primarily processed for the purpose of providing you with the Service. We draw your attention to the fact that although the transfer of personal data cannot always be considered mandatory, the failure to submit personal data or demanding termination of processing thereof may, in certain cases, obstruct the provision of the Service.

We process personal data of users and customers (incl. representatives of customers) of our Services for the purpose of performing our contractual obligations as well as providing potential customers with the Services and information of higher quality. Astro Baltics as a controller only uses personal data for communication and for the provision of a better product or Service. We only collect the minimum customer data that we need to attain the purposes of processing.

The basis for processing of personal data is entry into and performance of a contract, legitimate interest or consent of a person.
Astro Baltics uses customer data on the basis of the instructions provided by the customer, including under the terms and conditions described in the customer contract and when the customer uses the Service, and in accordance with the valid Personal Data Protection Act.
Astro Baltics does not distribute, transfer, alter or use the personal data entrusted with us in a manner other than those informed upon the collection of data, unless we have a respective agreement with a person or the disclosure of information is required by the legislation of the Republic of Estonia.

We retain your personal data as long as needed for the achievement of the purposes for which they have been collected. The period of retention also depends on the need to reply to inquiries of data subjects, solve problems and comply with the legal requirements for retention of documents.
Personal data related to transactions with the software of Astro Baltics are retained for up to seven (7) years after the end of the financial year in accordance with the obligation to prove transactions arising from the Accounting Act.
The personal data of customers using the Services are retained for up to eleven (11) years after the termination of the customer relationship or employment relationship for the cases where there is a need to protect our rights in a dispute with a data subject or customer or in any other legal claim.

The personal data processed by Astro Baltics may only be transferred without the consent of the person to an authority or person who has a justified need for this or a direct right arising from law (e.g. a court or body conducting pre-trial proceedings).
We may transfer your data for processing to third parties who assist us in providing and managing the Services and who provide services related to the management of inquiries of customers. These parties may include, for instance, transportation companies and business analytics service providers. In any and all cases we only transfer to the processor data required for the purpose of performance of a specific task or provision of a specific service.

Astro Baltics as a processor of customer data treats personal data to be processed within the framework the Services used by customers as confidential and the right to process, issue or transfer the data as a controller is the sole liability of the owner of the data (customer). By an order of a customer, Astro Baltics provides technical support in the field of data processing, but this does not change the relationship of ownership and liability with respect to the data.

Cookie means a small text file, saved by a website in your computer or a smart device, when you visit our website. Astro Baltics uses cookies on its website, which collect data, i.e. the age, sex and location, of visitors of the website. Such data are collected for the purpose of website statistics and analysis of site functionality to make the website more user-friendly.
By staying on our website, you give your consent for the use of cookies (unless you have set your web browser up in a manner that cookies are not accepted). If you do not want to allow the use of cookies on our website, you can block it in the settings of your web browser or use private browsing options.

Cookies allow for identification of data subjects when they revisit the webpages and thereby provide the user with an improved Service and update the contents of the webpages. Session cookies last only for the period your browser is open and are automatically deleted when the browser is closed. Persistent cookies remain stored in your device or browser until they are deleted or until their expiry. Astro Baltics uses both session and persistent cookies, some of which may be third-party cookies.
To opt out cookies, you can configure your browser accordingly. The information required therefor can be found in documents provided by the manufacturer of your browser. In the event of certain cookies, it is possible to disable them only via third-party websites, e.g. Google Analytics. In terms of mobile platforms, you can change the settings in the device itself to check whether you can see interest-based advertising.

Astro Baltics takes security and protection of data very seriously. We do anything in our power to protect the privacy of persons and their data against destruction, misuse and unauthorised access or disclosure.

Astro Baltics has applied the required technical, physical (documents requiring confidentiality are kept in a separate room) and organisational security measures (confidentiality agreements with staff) to protect personal data of customers against loss and unlawful processing. Astro Baltics has established clear and mandatory internal rules for all the persons processing personal data on behalf and on the instructions of Astro Baltics. All the employees of Astro Baltics who have access to personal data are required to adhere to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL and take security measures in their work related to the serving of customers of Astro Baltics.

We strictly control the access of our employees to data that you manage through the Services of Astro Baltics. The management of the Services of Astro Baltics presumes that some employees have access to systems that store and process customer data. For instance, to analyse some inquiries, the user support may need access to the data of your customers. We only access your NOOM account upon a written inquiry and we follow all the rules guaranteeing that each operation (addition, alteration, deletion) with customer data is always logged.

We log the time of access, IP address of the connection and domain of each user to provide a better overview of user access in using the NOOM services. In addition, the operations carried out by users in the Services of Astro Baltics are registered. Astro Baltics uses an encrypted communications channel for data exchange of applications between the customer and the server and the data are stored in the servers of Astro Baltics or the customer.

Right to rectification – the right of a data subject to demand that inaccurate or incomplete personal data concerning them be rectified without undue delay.
Right to erasure – the right of a data subject to demand that the personal data concerning them be deleted without undue delay where certain additional conditions are met.
If there is no legal basis (any longer) for processing or disclosure of personal data or enabling access to the data, the termination of use or erasure of the data or termination of disclosure of the data or enabling access to the data can be demanded. To this end, an application must be submitted in a manner enabling identification.

The application will be rejected if:

• this may damage the rights and freedoms of another person;
• this may obstruct the provision of the Service or failure to provide the Service;
• this may obstruct the work of law enforcement authorities;
• this is technically unnecessary and/or impossible;
• the applicant is not legally connected with the data;
• the applicant cannot be identified.

Right to restrict processing – the right of a data subject to restrict in certain cases temporarily or permanently the processing of all or some of their personal data.
Right of access – the right to be informed of the personal data and to demand access to the personal data concerning you, which we process.

Right to a copy of the data – the right to demand a copy of your personal data in a structured, commonly used and machine-readable format and the right to transmit those data to another controller whenever technically possible.
Right to object – a data subject has the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them, which is based on the relevant provisions of legislation, including profiling based on those provisions.
If the processing of personal data is based on the consent of a data subject, the data subject can withdraw the consent at any time, informing thereof at info@noom.ee, without it affecting the lawfulness of the processing based on the consent before its withdrawal.
If you want to refuse from receiving direct marketing offers about all of the topics or just some of them, you can do that immediately by using the link in the footer of every single marketing e-mail you receive. The change will come into effect immediately.

By using the webpages and/or service environments of Astro Baltics, you confirm that you have read and agreed to this policy and these terms and conditions. We retain the right to amend, modify or remove the terms and conditions of the Privacy Policy, where necessary, notifying thereof by the e-mail address provided to us or by a report on our website.
If you find that Astro Baltics has violated your rights upon processing your personal data, notify Astro Baltics thereof by sending an e-mail at info@noom.ee. Any and all disputes are settled by way of negotiations. You also have the right (e.g. upon failure to reach an agreement) to address the Data Protection Inspectorate or a competent court.