1. General
The principal activity of the Estonian Recovery Organisation (Eesti Taaskasutusorganisatsioon MTÜ) (hereinafter referred to as “ETO”, “we”, “us”, or the “Organisation”) is the organisation of producer responsibility obligations on behalf of packaging companies.
For the purpose of fulfilling these responsibilities, we process personal data relating to representatives of our partners, members, and clients to the extent necessary for managing contractual relationships and complying with legal obligations.
ETO respects every individual’s right to privacy and processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR), applicable legislation in Estonia, and recognised data protection practices.
This Privacy Policy explains what personal data we collect, the purposes for which we use it, and the rights of data subjects.
2. Who Is Responsible for the Processing of Personal Data?
The data controller responsible for the processing of personal data is:
Estonian Recovery Organisation (Eesti Taaskasutusorganisatsioon MTÜ)
Registration Code: 80208542
Address: Mustamäe tee 24, 10621 Tallinn, Estonia
Email: eto@eto.ee
Telephone: +372 640 3240
If you have any questions regarding the processing of personal data or wish to exercise your data protection rights, please contact us using the details above.
3. When Do We Process Personal Data?
ETO may process personal data in the following situations:
- when entering into or performing a contract with the Organisation (including the use of the client application at www.client.eto.ee and the creation of an account in the self-service environment at www.iseteenindus.eto.ee);
- when communicating with representatives of partners, members, and clients;
- when using the website www.eto.ee;
- when submitting enquiries, applications, or feedback;
- when participating in training sessions, seminars, or other events;
- when subscribing to newsletters or other notifications;
- when fulfilling obligations arising from applicable legislation.
4. Categories of Personal Data Processed
Depending on the circumstances, ETO may process the following categories of personal data:
Personal and Contact Information
- first and last name;
- position or job title;
- company or organisation name;
- telephone number;
- email address;
- postal address.
Contractual and Cooperation Data
- information relating to the conclusion and performance of contracts;
- communication history;
- billing and payment information;
- information relating to authorisations and representation rights.
Website Usage Data
- IP address;
- technical information about the device and browser;
- information collected through cookies;
- website usage statistics.
Event and Training-Related Data
- registration information;
- participation-related information;
- feedback and evaluations.
5. Purposes and Legal Bases for Processing Personal Data
ETO processes personal data only to the extent necessary to fulfil the Organisation’s statutory objectives and to organise producer responsibility obligations.
Performance of a Contract
Personal data are used for concluding and performing client and cooperation agreements, reporting activities, and communicating with partners.
Compliance with Legal Obligations
Certain personal data must be processed in order to comply with obligations arising from the Packaging Act and other applicable legislation.
Legitimate Interests
We may process personal data for organising the activities of the Organisation, developing services, managing client relationships, ensuring security, and protecting the Organisation’s rights.
Consent
Where processing is based on consent (for example, sending newsletters), consent may be withdrawn at any time.
Purposes of Processing, Legal Bases and Categories of Personal Data
| Purpose of Processing | Legal Basis | Categories of Personal Data |
|---|---|---|
| Communication with prospective clients, members, and cooperation partners and carrying out pre-contractual activities | GDPR | Name, job title, company name, telephone number, email address, communication data |
| Conclusion, performance and management of client, membership and cooperation agreements | GDPR, Law of Obligations Act, Non-profit Associations Act | Contact details, contract data, communication data, user account information |
| Servicing packaging companies and organising producer responsibility activities | Packaging Act, Waste Act, GDPR and other applicable legislation | Contact details, company representative information, reporting data |
| Fulfilment of reporting and notification obligations related to the Packaging Register and other statutory requirements | Packaging Act, Waste Act and other applicable legislation | Contact details, representation rights information, reporting data |
| Preparation of invoices, payment administration and accounting | Accounting Act, Taxation Act | Contact details, billing information, payment data |
| Responding to enquiries, applications and complaints | GDPR and other applicable legislation | Name, contact details, enquiry content, communication history |
| Organising seminars, training sessions, conferences and information days | GDPR and other applicable legislation | Registration data, contact details, participation information |
| Informing participants about events and sector-related developments | GDPR and other applicable legislation | Name, email address, job title, organisation |
| Distribution of newsletters and professional communications | GDPR, Electronic Communications Act | Email address, name, organisation |
| Conducting satisfaction surveys and collecting feedback | GDPR and other applicable legislation | Contact details, survey responses, feedback |
| Ensuring website functionality, security and usage analytics | GDPR, ePrivacy requirements | IP address, browser information, device information, cookie data |
| Processing enquiries submitted through website contact forms | GDPR and other applicable legislation | Name, email address, telephone number, enquiry content |
| Protection of ETO’s rights and establishment, exercise or defence of legal claims | GDPR, Code of Civil Procedure and other applicable legislation | Communication data, contract data, evidence |
| Documentation and promotion of organisational activities through photographs and video recordings | GDPR and other applicable legislation | Photo, video and event participation data |
Use of Legitimate Interests
Where processing is based on ETO’s legitimate interests, such interests primarily include:
- efficient management of client and cooperation relationships;
- development of the Organisation’s activities;
- improvement of service quality;
- ensuring information security;
- prevention, establishment, exercise, or defence of legal claims.
Before relying on legitimate interests, ETO assesses whether the rights and interests of the data subject outweigh the Organisation’s legitimate interest in processing personal data.
6. Who May We Disclose Personal Data To?
ETO may disclose personal data to:
- IT and web service providers;
- accounting and auditing service providers;
- legal advisers;
- public authorities where required by law;
- other cooperation partners to the extent necessary for the provision of agreed services.
All service providers are required to ensure an adequate level of protection for personal data.
7. International Transfers of Personal Data
As a general rule, personal data are processed within the European Economic Area (EEA).
Where personal data are transferred outside the EEA, ETO applies safeguards recognised by the European Commission or other security measures required by applicable legislation.
8. Data Retention
We retain personal data only for as long as necessary to achieve the purpose of processing or to comply with legal obligations.
Retention periods depend on the type of data and the purpose of processing. For example:
- contract-related data are retained for the duration of the contract and thereafter for the period required by law;
- accounting documents are retained for the period prescribed by applicable legislation;
- marketing consents are retained until consent is withdrawn.
9. Cookies and Web Analytics
ETO’s website uses cookies to ensure the functionality, security, and usability of the online environment. Where appropriate, analytical cookies are also used to understand website usage and improve functionality.
Cookies may collect information regarding:
- the time of website visits;
- the pages visited;
- the device and browser used;
- website usage statistics.
Users may restrict or disable cookies through their browser settings. Please note that disabling certain cookies may affect the proper functioning of some website features.
10. Your Rights
You have the right to:
- obtain information about the processing of your personal data;
- access personal data concerning you;
- request the correction of inaccurate personal data;
- request the deletion of personal data where permitted by law;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive your personal data in a structured format where applicable;
- withdraw previously given consent at any time.
To exercise your rights, please contact ETO.
11. External Websites and Third-Party Services
ETO’s website may contain links to other websites, information systems, or online services operated by independent organisations or service providers. When using such external environments, users leave ETO’s data processing environment and become subject to the terms and privacy policies of the relevant service provider.
ETO is not responsible for the content, security, use of cookies, or personal data processing practices of third-party websites. Nor can ETO influence the extent to which, or the purposes for which, such providers collect or process users’ data.
We recommend reviewing the privacy and data protection policies of any external website or service before using it.
12. Complaints
If you believe that the processing of your personal data violates applicable data protection requirements, you have the right to contact ETO: Estonian Recovery Organisation (ETO); Mustamäe tee 24, 10621 Tallinn, Estonia; Email: eto@eto.ee; Telephone: +372 640 3240
You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): Tatari 39, 10134 Tallinn, Estonia; Email: info@aki.ee; Website: www.aki.ee
13. Amendments to This Privacy Policy
ETO may update this Privacy Policy from time to time. The current version will always be published on the website together with the date of the latest update.
Last updated: 9 June 2026