Privacy Policy

1. Who processes personal data

The controller of personal data is Haabersti Loomakliinik OÜ (registry code 10223511; registered address: Paldiski mnt 201-2, 13517 Tallinn, Estonia; clinic address: Õismäe tee 115A, Tallinn, Estonia), referred to below as the “Clinic” or “we”.

For questions about the processing of personal data or the exercise of your rights, contact us at info@halk.ee.

This privacy policy explains how we process the personal data of the Clinic’s clients, visitors to halk.ee, and people who contact the Clinic or complete forms related to its services.

2. Data we process

Depending on how you contact us and which service you request, we may process:

• the first and last name of the animal’s owner or representative;
• telephone number, email address and, where necessary, postal address;
• personal identification code or other identification details where required to register an animal, issue a pet passport or comply with the law;
• appointment details, correspondence and the content of an enquiry;
• animal details, including name, species, breed, sex, date of birth or age, microchip number, passport details, previous visits, diagnoses, examinations, procedures, prescriptions and other information needed to provide veterinary services;
• information included in consent for surgery and anaesthesia submitted through Google Forms or by other means;
• payment and accounting information;
• technical data generated when the website is used, including IP address, device and browser type, event logs, cookies and website usage data;
• other information voluntarily provided in a message or while a service is being provided.

Please do not include unnecessary personal data in free-text fields if it is not needed for us to answer or arrange an appointment.

3. Purposes and legal bases

We process personal data for the following purposes:

1. Answering enquiries and arranging appointments. The legal basis is taking steps at the client’s request before entering into a contract and performing a contract (Article 6(1)(b) GDPR), as well as our legitimate interest in organising the Clinic’s work and keeping evidence of communications (Article 6(1)(f) GDPR).
2. Providing and documenting veterinary services. The legal bases are performance of a contract, compliance with legal obligations and our legitimate interest in ensuring continuity and quality of care (Article 6(1)(b), (c) and (f) GDPR).
3. Registering microchips and issuing pet passports. The legal bases are performance of a contract and compliance with legal obligations (Article 6(1)(b) and (c) GDPR).
4. Billing and accounting. The legal bases are performance of a contract and the Clinic’s legal obligations (Article 6(1)(b) and (c) GDPR).
5. Protecting rights and resolving disputes. The legal basis is the Clinic’s legitimate interest in establishing, exercising and defending legal claims (Article 6(1)(f) GDPR).
6. Website security and reliability. The legal basis is our legitimate interest in maintaining technical security, preventing misuse and resolving faults (Article 6(1)(f) GDPR).
7. Analytics and optional third-party functions. Where consent is required, the legal basis is the visitor’s consent (Article 6(1)(a) GDPR). Consent may be withdrawn at any time through the cookie settings, without affecting the lawfulness of processing carried out before withdrawal.
8. Direct marketing. We send marketing messages only where an appropriate legal basis exists, including prior consent where it is required. You may opt out at any time.

Providing data for an appointment or service is voluntary. However, without the necessary contact and service-related information, we may be unable to answer, arrange an appointment or provide the requested service.

4. Sources of data

We usually receive data directly from the client through the website, by telephone or email, in the Clinic, or through a form related to a service. We may also receive data from the animal owner’s representative, the animal’s documents and legally established registers where this is necessary to provide the service.

5. Recipients of data

Data is accessible only to Clinic staff and contractors who need it for their duties. Where necessary, data may be processed by the following categories of recipient:

• hosting, website maintenance, backup and information security providers;
• email and cloud service providers;
• Google Ireland Limited and Google-related service providers when Gmail, Google Forms, Google Analytics, Google Tag Manager, Google reCAPTCHA and Google Maps are used;
• Meta Platforms Ireland Limited when the Facebook component is loaded or used;
• providers of veterinary information systems, laboratories, pharmacies and other partners involved in providing the requested service;
• accountants, auditors, legal advisers and insurers;
• public authorities and other persons to whom data must be disclosed under the law or to protect legal rights.

Service providers process data under a contract and only to the extent necessary to provide the relevant service, unless the law provides otherwise.

6. Transfers outside the European Economic Area

Some providers, including Google and Meta, may process data outside the European Economic Area. In such cases, transfers are based on an applicable European Commission adequacy decision or protected by standard contractual clauses and other safeguards permitted by the GDPR. More detailed information about processing locations and safeguards is available in the relevant provider’s privacy documentation.

7. Retention periods

We retain data only for as long as necessary for the relevant purpose or as required by law:

• ordinary website enquiries and related correspondence — up to 3 years after the enquiry is closed;
• technical email sending logs — up to 30 days;
• records of veterinary services provided — at least 3 years from the date of the service, unless the law or the need to protect legal claims requires longer retention;
• data relating to the issue of a pet passport — at least 10 years from the date of issue;
• accounting documents — 7 years from the end of the financial year in which the transaction was recorded;
• data needed to resolve a dispute or defend a claim — until the matter is finally resolved and the applicable limitation period has expired;
• cookies and related identifiers — until the relevant cookie expires or is deleted by the user. Further details are provided in the cookie settings or cookie notice.

If an enquiry leads to the provision of a veterinary service, the necessary information may become part of the Clinic’s records and be retained under the rules applicable to those records. At the end of the retention period, data is deleted or anonymised unless continued retention is required by law.

8. Cookies, analytics and third-party content

The website uses cookies that are necessary for operation and security. It may also use Google Analytics 4 and Google Tag Manager for statistics, Google reCAPTCHA to protect forms, Google Maps to display a map and a Facebook component to show third-party content.

When these functions are loaded, providers may receive technical data such as the IP address, device and browser information, the page visited and actions taken on it. Optional cookies and third-party functions must be used in accordance with the visitor’s choice in the cookie management solution. Cookies can also be deleted or blocked in the browser settings, although this may affect some website functions.

Google Forms is used for the surgery and anaesthesia consent form. Data entered in the form is transmitted to Google and the Clinic and is used to prepare and document the veterinary service.

9. Automated decision-making

We do not make decisions that produce legal or similarly significant effects for a client solely by automated processing, and we do not carry out profiling of this kind.

10. Security

We use organisational and technical measures to protect data from unauthorised access, alteration, disclosure, loss and destruction. Access is granted on a need-to-know basis, and service providers are selected with regard to the nature of the data processed. No method of transmission or storage can guarantee absolute security.

11. Your rights

Where provided by the GDPR, you have the right to:

• receive information and a copy of your personal data;
• have inaccurate data corrected or incomplete data completed;
• request erasure of data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive data you provided in a portable format where the right to data portability applies;
• withdraw consent for the future where processing is based on consent;
• lodge a complaint with a supervisory authority.

To exercise your rights, write to info@halk.ee. We may request additional information necessary to verify your identity. We normally respond within one month. Rights may be restricted in cases provided by law, for example where data must continue to be retained to comply with a legal obligation or defend a legal claim.

A complaint may be lodged with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): Tatari 39, 10134 Tallinn, email info@aki.ee, website https://www.aki.ee/. You also have the right to seek a judicial remedy.

12. Changes to this policy

We may update this privacy policy when our processes, services or legal requirements change. The current version is published on the website halk.ee.