Data Protection and Privacy Policy

This Data Protection and Privacy Policy describes how your Personal Information is collected, used, and shared when you visit andilay.com (hereafter, the “website”) or provide other information to Andilay OÜ for consultancy or employment purposes. Information in this policy has been provided according to Art. 13 of the General Data Protection Regulation (GDPR) of the European Union (EU). We may update this policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons.

Data Protection Officer

Joshua Friedman
dataprotection@andilay.com

1) Analytics

This website automatically collects certain Personal Information about your device for site analytics, including, without limitation:

• Information about your browser, network, and device
• Web pages you visited prior to coming to this website
• Your IP address

This information may also include details about your use of this website, including:

• Clicks
• Internal links
• Pages visited
• Scrolling
• Searches
• Timestamps

Additionally, as you browse the website, we collect information about the individual web pages or products that you view, what websites or search terms referred you to the website, and information about how you interact with the website. We refer to this automatically-collected information as “Device Information”.

We may share Personal Information our website analytics provider, which may change from time-to-time at our sole discretion, to learn about site traffic and activity.

2) Cookies and Similar Technologies

This website uses “cookies”, “server log files”, “web beacons”, “tags”, “pixels”, and similar technologies, which are small data files or pieces of text that download to a device when you access a website or app. Cookies and other similar technologies often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit http://www.allaboutcookies.org.

Functional and required cookies are always used, as they allow our hosting platform to securely serve this website to you. Analytics and performance cookies are used on this website only when you acknowledge our cookie banner. This website uses analytics and performance cookies to view site traffic, activity, and other data.

3) Visitor Data and Personal Information

a) How we use your Personal Information

We use this Personal Information to:

• Communicate with you;
• Screen our communications for potential risk or fraud; and
• When in line with the preferences you have shared with us, provide you with information or advertising relating to our products or services.

We use the Device Information that we collect to help us screen for potential risk and fraud (in particular, your IP address), and more generally to improve and optimize our website (for example, by generating analytics about how users browse and interact with the website, and to assess the success of our marketing and advertising campaigns).

b)  Information sharing generally

We share your Personal Information with third parties to help us use your Personal Information, as described above. An example of the types of information sharing we may utilize from time-to-time includes using Google Analytics to help us understand how our website users use the website. You can read more about how Google uses your Personal Information here: https://www.google.com/intl/en/policies/privacy/. You can also opt-out of Google Analytics here: https://tools.google.com/dlpage/gaoptout.

To make it easier for you to find us and for us to show you the locations of our work, we may use integrated map material from the Google Maps service into our website via an Application Programming Interface (API). In order to display the content in your browser, Google must receive your IP address, otherwise Google could not provide you with this embedded content.

We may also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request for information we receive, or to otherwise protect our rights.

c) Form block submissions

When you submit information to this website via a webform, we collect the data requested in the webform in order to track and respond to your submissions. For example, if you would like to receive any newsletter that may be offered on the website, we require an email address from you as well as information that allows us to verify that you are the owner of the email address provided and that you consent to receiving the newsletter. This information is shared with our hosting platform, so that they can provide website services to us.

d) Use of share buttons

This website may include share buttons that enable you to share pages or other content from this website to third-party services, such as Facebook, Bluesky, LinkedIn, or the like. If you click a share button, these third parties may receive your personal data, including:

• Information about your browser, network, and device
• Details about the web page or content you shared or proposed to share
• Your IP address

e) Use of comments and likes

This website may include commenting functionality on some of its pages that enables you to post a comment. This website collects Personal Information when you post a comment, including:

• Your name (which will be displayed as part of your posted comment)
• Your email address (optional, to let you know if someone replies to your comment)
• Your website URL (optional)

This website may include “likes” functionality on some of its pages that enables you to “like” a page or a post. This website collects Personal Information when you like a page or post. This is done to try and prevent the same person from liking the same post multiple times during the same visit, among other reasons. The Personal Information collected thereby includes:

• Information about your browser, network, and device
• Details about the web page or content you shared or proposed to share
• Your IP address

f) Fonts

This website serves font files from and renders fonts using Google Fonts and Adobe Fonts. To properly display this website to you, these third parties may receive Personal Information about you, including:

• Information about your browser, network, and device
• Details about the web page or content you shared or proposed to share
• Your IP address

 4) Your Data and Information Rights

If you are a European resident, you have the right to access Personal Information we hold about you and to ask that your Personal Information be corrected, updated, or deleted. If you would like to exercise this right, please contact us through the contact information above.

Additionally, if you are a European resident, we note that we are processing your information in order to fulfill contracts we might have with you or otherwise to pursue our legitimate business interests listed above.

Also, please note that your information may be transferred outside of Europe, including to Canada and the United States.

5) Processing Freelance Experts’ Personal Information

a) Purposes of the processing

Andilay OÜ is an international consultancy specialized in project management and consultancy services in the field of international development and humanitarian cooperation. In a broad variety of sectors and themes, our services cover the design, formulation, implementation, monitoring, and evaluation of projects, programs and policies. Andilay processes Personal Information for the purpose of contacting experts (also called “data subjects”), e.g. for information on cooperation opportunities suiting an expert’s professional profile or for requesting updated CVs or resumes. Personal Information is also processed for the purpose of including an expert’s CV in prequalifications and tenders. Once contracted, personal data is processed for the purpose of implementing the service contract.

Based on Art. 6 of the GDPR, it is lawful to process an expert’s Personal Information so long as at least one of the following situations apply:

• The data subject has given consent to the processing of his or her personal data, per Art. 6 (1) a);
• Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, per Art. 6 (1) b); or
• Processing is necessary for the purposes of Andilay’s legitimate interests, per Art. 6 (1) f). The legitimate interests typically pursued by Andilay will be cooperation with experts in the implementation of projects as well as ensuring network and information security.

According to Art. 21 (1) of the GDPR, the data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Article 6 (1) f).

b) Possible recipients of the personal data

Outside Andilay

• Contracting authorities such as EU, NGOs, GIZ, etc.
• Partner firms in case of Andilay being member of a consortium
• Processors according to Art. 28 of the GDPR

Transfer of personal data to a third country or an international organization shall only take place as far as in accordance to Art. 45, 46 or 49 of the GDPR.

c) Period for which the personal data will be stored

Personal Information will be deleted after fulfilment or elimination of the purposes for which it was collected or at the request of the data subject.

d) Experts’ rights

Experts may request access to and the modification or erasure of any Personal Information held by Andilay OÜ. Experts may also request that the processing of their Personal Information be restricted in scope or type. Further, experts have the right to data portability.

To exercise these rights, experts may contact Andilay through the contact information listed above. Experts also have the right to lodge a complaint with the supervisory authority in charge regarding Andilay’s compliance with the GDPR and/or other data protection legal requirements.

6) Processing of Personal Information for In-House Applications

a) Possible recipients of the Personal Information

Your Personal Information will be processed by the person(s) in charge of the recruitment process for the purpose of filling the advertised vacancy.

b) Period for which the Personal Information will be stored

With regard to possible complaints of rejected applicants for violation of provisions of the Estonian Equal Treatment Act of 2008, as amended, (Võrdse kohtlemise seadus), we will keep your data for six (6) months after completion of the application process.

c) Applicant’s rights

Under the provisions of the GDPR, you may request access to and the modification or erasure of any Personal Information held by Andilay OÜ. Experts may also request that the processing of their Personal Information be restricted in scope or type. Further, experts have the right to data portability.

To exercise these rights, experts may contact Andilay through the contact information listed above. Experts also have the right to lodge a complaint with the supervisory authority in charge regarding Andilay’s compliance with the GDPR and/or other data protection legal requirements.

 7) Processing of Personal Information for Unsolicited Applications

a) Possible recipients of the personal data

Your personal data will be processed by the person(s) in charge of recruitment.

b) Period for which the personal data will be stored

Your personal data will be deleted after three (3) years.

c) Applicant’s rights

Under the provisions of the GDPR, you may request access to and the modification or erasure of any Personal Information held by Andilay OÜ. Experts may also request that the processing of their Personal Information be restricted in scope or type. Further, experts have the right to data portability.

To exercise these rights, experts may contact Andilay through the contact information listed above. Experts also have the right to lodge a complaint with the supervisory authority in charge regarding Andilay’s compliance with the GDPR and/or other data protection legal requirements.