This Privacy Notice explains how BzCall Technology OÜ (“BzCall” or “we“) processes personal data – personal data being any information about an identified or identifiable individual (“you”). BzCall processes your personal data in accordance with the EU General Data Protection Regulation (the “GDPR”) and other applicable personal data protection legislation. The purpose of this Privacy Notice is to provide you with the most important details about the processing of your personal data.
DATA CONTROLLER
BzCall Technology OÜ (registry code: 16277330, address: Viimsi vald, Haabneeme alevik, Heki tee 8-10, 74001, Republic of Estonia) is responsible for the processing of your personal data (the data controller). If you have any questions or concerns regarding the processing of your personal data as explained in this Privacy Notice, you can contact us on the contact details provided at the end of this Privacy Notice.
WHEN THIS PRIVACY NOTICE APPLIES
This Privacy Notice applies to you if you:
I. Visit our website at www.BzCall.com
II. Register to use our procurement auction mediation platform (the “Platform”) and the related services (the “Services”) – either for yourself or as a representative of a legal person
III. Contact us
IV. Represent a legal person we contract with
If you receive an invitation from an existing Platform user to participate in a procurement, then for the purposes of sending you the invitation, we are acting as that Platform user’s data processor as we merely provide the Platform user a technical solution for sending the invitation. The Platform user should be considered as the data controller and is responsible for the legality of sending you the invitation.
DETAILS OF PROCESSING
The personal data we process depends on how you interact with us:
1. If you visit our website
Although currently deactivated, we may in the future process certain data we collect via cookies. In such case, you will find more information about the cookies we use from our Cookie Policy.
2. If you register to use our Platform and Services
We process the following personal data that you provide to us yourself or that we receive, at your choice, from the social network that you use to create your user account. We only collect personal data that is necessary for the provision of the Platform and Services.
| Personal data | Purpose for processing | Legal basis for processing | Retention period |
| Identification data (first and last name) Contact data (phone number, e-mail address, in case of person organizing the procurement – address of delivery) Information about the procurements you (or the legal person you represent) organize or participate in | To provide you (or the legal person you represent) the Platform and Services (including to create a user account, send invoices, inform about any interruptions in or other issues regarding the provision of the Platform and Services) | GDPR Article 6(1)(b): processing is necessary for the performance of a contract to which you are party or to take steps at your request prior to entering into a contract In case you represent a legal person, who uses our Platform and Services – GDPR Article 6(1)(f): processing is necessary for our legitimate interest to conclude and perform the agreement with the legal person you represent | Until you (or the legal person you represent) have a user account on the Platform and 3 years thereafter (in accordance with the limitation period for claims arising from transactions) Accounting data – 7 years after the relevant economic year (as required under accounting and taxation laws) |
| Contact data (e-mail address) Information about the procurements you (or the legal person you represent) have been invited to or participate in | To keep you updated about the procurements you (or the legal person you represent) have been invited to (send invitations) or participate in | GDPR Article 6(1)(f): processing is necessary for our, the person’s organizing the procurement, and your (or the legal person you represent) legitimate interest to invite you to and keep you updated about the procurements | Until you (or the legal person you represent) have a user account on the Platform and 3 years thereafter (in accordance with the limitation period for claims arising from transactions) or until you no longer wish you receive such updates (opt-out) |
| Information about your use of the Platform and Services | To collect statistics and perform analytics to improve and further develop our Platform and Services (including user convenience) | GDPR Article 6(1)(f): processing is necessary for our legitimate business interest to improve and further develop our Platform and Services | Until you (or the legal person you represent) have a user account on the Platform; on an aggregated level where you no longer can be identified – indefinitely |
| Contact data (e-mail address) | To send you marketing messages | GDPR Article 6(1)(f): processing is necessary for our legitimate business interest to market our Platform and Services Electronic Communications Act 1031 (3) (the “existing customer exception”) | Until you opt-out from receiving such marketing messages |
| Profile photo | To enable you to better identify yourself | GDPR Article 6(1)(a): you have provided consent to the processing of your personal data by uploading such profile photo | Until you have a user account on the Platform or until you delete the photo, if earlier |
Please note that if the person organizing the procurement collects and/or processes any further information about persons participating in the procurement (or in case of legal persons – their representatives), whether before or after concluding the procurement agreement, the person organizing the procurement is responsible for such processing as a data controller and their privacy notice applies.
3. If you contact us
If you contact us by phone, e-mail, or social media channels, we process the information provided by you for the purpose of responding to you and/or to take steps requested in your communication.
| Personal data | Purpose for processing | Legal basis for processing | Retention period |
| Identification data provided by you (e.g., name) Contact data provided by you (e.g., phone number, e-mail address) Content of your communication (e.g., request, question) | To respond to and/or take steps requested in your communication | GDPR Article 6(1)(f): processing is necessary for our legitimate interest to respond to and/or take steps requested in your communication In case of requests regarding your personal data – GDPR Article 6(1)(c): processing is necessary for compliance with legal obligations to which we are subject | 2 years as of the communication |
4. If you represent a legal person we contract with
If you represent a legal person we contract with, we will process your personal data, which is usually work-related, including when you communicate with us.
| Personal data | Purpose for processing | Legal basis for processing | Retention period |
| Identification data provided by you or the legal person you are representing (e.g., name, position) Contact data provided by you or the legal person you are representing (e.g., work phone number, work e-mail address) Content of your communication (e.g., request, question) | To conclude and perform the agreement with the legal person you represent | GDPR Article 6(1)(f): processing is necessary for our legitimate interest to perform the agreement with the legal person you represent | Until the agreement with the legal person you represent is valid and 3 years thereafter (in accordance with the limitation period for claims arising from transactions) |
We may also process your personal data if we have a legal obligation to do so (GDPR Article 6(1)(c): processing is necessary for compliance with legal obligations to which we are subject).
If we process your personal data based on our legitimate interest, we have weighed your and our opposing interests to process personal data and have decided that, considering the purpose of processing and the measures that we have taken, our interest in processing is not overridden by your interests or fundamental rights and freedoms which require protection of personal data. You always have the right to object to processing based on legitimate interest on grounds relating to your particular situation by letting us know of your concerns, as well as asking for further information about how we carried out the balancing test.
If we process your personal data based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
You can read more about your rights and find our contact details for exercising those rights at the end of this Privacy Notice.
DATA RECIPIENTS
Inside BzCall
Inside BzCall, only such personnel have access to your personal data who need it to perform their duties.
Other users
When providing our Platform and Services, your personal data may be shared with other users. The extent thereof depends on the rules of the specific procurement you organize or participate in. For example, your name may be shared with all others who also participate in the procurement, or the procurement may be anonymous. In any case, at the end of a successful procurement, the names and contact details of the organizer and winner of the procurement will be shared with the relevant parties. This is done based on our and other users’ legitimate interest to ensure the trustworthiness of the procurement and avoid any fraud.
Other recipients
Sometimes we need to share your personal data with third parties who either process your personal data on behalf of us as data processors or as independent data controllers. We only share personal data with them if and to the extent it is necessary to achieve the purposes described in this Privacy Notice.
Currently we use the following categories of data processors: cloud hosting service providers, advertising and marketing service providers, user research service providers, and web, and software developers. We have concluded data processing agreements with all data processors we use. Nevertheless, we remain responsible for such processing.
We may disclose your personal data to the following third parties that act as independent data controllers regarding your personal data: legal service providers. In case of restructuring in the future, we may share your personal data in the context of the restructuring with any relevant parties. We may also share your personal data with public authorities or other parties if we have a legal obligation to do so.
If you are in debt to us, we may transfer your personal data to a collection service provider, who may, depending on the services provided, act in the capacity of a data processor or data controller.
We share your personal data with third parties only if we have a legal basis for doing so – either our legitimate business or legal interests, statutory obligation, or your consent.
DATA TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA
We do not process any of your personal data outside the European Economic Area.
DATA RETENTION
We retain your personal data for as long as necessary for the purposes for which the data was collected or to protect our interests or as long as required under the applicable law. For more specific retention periods, please see the table above. After the expiry of the retention period, your personal data is deleted, destroyed, or rendered anonymous.
YOUR RIGHTS
Under the GDPR, you are considered a “data subject” and you have various rights which you can exercise by contacting us on the contact details at the end of this Privacy Notice. Most of the rights are not absolute and there might be additional requirements that have to be fulfilled to exercise them.
| Right of access | You can ask us at any time to confirm whether and which personal data we process about you and additional information about the processing. You also have the right to receive a copy of the data. |
| Right to rectification | You can ask us to correct and complete the personal data processed by us if it is inaccurate or incomplete. |
| Right to restriction of processing | You have the right, in certain cases, to request for the processing of your personal data to be restricted, i.e., (i) when the accuracy of the personal data is contested for a period enabling us to verify the accuracy of the personal data; (ii) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead; (iii) we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; (iv) you have objected to processing, pending the verification whether our legitimate grounds override yours. If the processing of personal data is restricted, we may nevertheless store the personal data and process it (i) with your consent; (ii) for the establishment, exercise, or defence of legal claims; (iii) for the protection of the rights of another natural or legal person; or (iv) for reasons of important public interest. |
| Right to erasure | You have the right, in certain cases, to request that we erase your personal data, e.g., (i) when the personal data is no longer necessary in relation to the purposes for which it was processed; (ii) you withdraw your consent and there is no other legal basis for processing; (iii) you object to the processing and there are no overriding legitimate grounds for the processing; (iv) the personal data has been unlawfully processed; (v) or the personal data has to be erased for compliance with our legal obligation. Even then we are not always required to erase the personal data. For example, we are not required to erase your personal data when the processing is necessary for compliance with our legal obligation or for the establishment, exercise, or defence of legal claims. |
| Right to data portability | You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format and the right to transfer this data to another controller if the processing is based on your consent or contract and is processed by automated means. If technically feasible, you have the right to request that we transfer the data directly to another controller. |
| Right to object | You have the right to object to the processing of your personal data if they are processed in our legitimate interest or those of third parties. In such case, we shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defence of legal claims. |
| Right to lodge a complaint | You have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), website: www.aki.ee, address: Tatari 39, 10134 Tallinn, phone: +372 627 4135, email: info@aki.ee. In case your habitual residence, place of work or place of the alleged infringement is not in Estonia but in another EU Member State, you may also lodge a complaint with the supervisory authority there (see: https://edpb.europa.eu/about-edpb/about-edpb/members_en). |
We will solve your request within one month (in case we need more time, we will let you know) and let you know of the actions taken or the grounds for refusal.
CHANGES TO THIS PRIVACY NOTICE
As our Platform and Services and personal data processing practices may change from time to time, this Privacy Notice may change as well. We will notify you of such changes on our website and via e-mail.
CONTACT DETAILS
If you have any questions or concerns regarding the processing of your personal data, you can contact us on the following contact details: admin@bzcall.eu
Last updated: 24.04.2023
