Doors 08 – 21

Stores 10 – 21

Grocery store 09-22

Until 31.01 coffees sell only for takeaway

Doors 08 – 21
Stores 10 – 21
Grocery store 09-22
Until 31.01 coffees sell only for takeaway


This notification outlines how Viru Keskus Ltd (registry code 10932986, address Viru Väljak 4, 10111 Tallinn, referred to hereinafter as Viru Keskus, or We) as the chief processor is processing personal data of customers and other persons in connection with activities of shopping and entertainment centre Viru Keskus (hereinafter referred to as Keskus).

Protection of personal data is very important for us and we take it very seriously. We aim at being a trustworthy partner in personal data processing and we act based on all legal acts and guidelines of secure personal data processing valid in the European Union and Republic of Estonia.

Purpose of personal data processing


Based on our legitimate interest and fulfilling tasks of public interest, Keskus operates a CCTV system for public safety, and for protection of persons and property inside and outside Keskus, which may be monitored in real time by the personnel of the outsourced security company. Recorded video material is stored in high security and limited access environment for minimum term pursuant to Law Enforcement Act. Recorded video material connected to specific cases having taken place at Keskus (e.g. loss events, etc.) are stored and processed on case-by-case basis pursuant to our legitimate interest, or that of our contractual partners and/or visitors of Keskus. Maximum storage term for specific cases video material is 3 years since termination of case proceedings.


In certain cases, based on our legitimate interest or consent, we may process personal data for marketing purposes in order to increase Keskus’ popularity and clientele. For example, we may collect and process personal data (generally, name + email address, in some cases also mailing address) of public figures, people of influence, or representatives of media that are publicly or contractually (including via PR agencies) available for us in order to send event invitations, press releases or other media communication. We only use publicly available personal data in case it may be concluded from the way and circumstances of availability that this particular person is willing to receive notifications or invitations from Viru Keskus. If this is not the case, we kindly ask you to notify us. Processed personal data are stored for their useful term until the purpose of processing has been achieved.

We collect personal data also during our social media prize draw campaigns, and our contractual partner distributes the data of the prize draw winner of customer satisfaction survey. We use personal data from these prize draw campaigns only in connection with awarding, and delete them when the purpose has been achieved.

Processing of personal data for business relations

In order to build and manage business relations of Viru Keskus (e.g. for finding business partners) we collect and process personal data of natural persons and the individuals of our business partner companies (e.g. representatives, contact persons, specific employees, etc.). Respective processing of personal data may rely upon contractual relations (in case of an existing or planned contract including the respective individual), upon fulfilling legal obligations, or upon legitimate interest of Viru Keskus.

We store processed personal data for the term necessary for fulfilling the purpose of processing. Personal data may be stored exceeding this term in case of applicable legislation, or in case it is required for establishing, managing or protecting legal rights.

Other instances

In addition to the aforesaid, Viru Keskus may process personal data for additional purposes and on legal grounds of which notices are given while collecting the respective personal data.

Processors of personal data

We use contractual partners for personal data processing who process personal data exclusively for and on behalf of Viru Keskus, and only for established purposes, extent and manner. The board member and employees of Viru Keskus are also authorised to process personal data in the extent required for fulfilling their duties. Furthermore, we are obliged to reveal personal data to third persons when fulfilling our legal duties and protecting our legal interests and claims if necessary.

Rights regarding processing of personal data

In order to exercise rights regarding processing of personal data (see at or for other requests or claims, or for additional information regarding processing of personal data by Viru Keskus, contacting us via e-mail address is recommended.

Rights regarding processing of personal data are limited, and in certain cases other people’s rights, legal interest and/or obligations of Viru Keskus may restrict exercising these rights. Viru Keskus aims at legal, transparent and respectful processing of personal data; hence, we call for immediate addressing of any suspicion of illegal processing of personal data or violation of data subject’s rights.

Ensuring security of personal data

Viru Keskus stores and processes personal data digitally and in physically safe environments in cooperation with its contractual partners. Access to personal data is made available only to our employees and contractual partners who need the data for fulfilling their duties in regards the personal data processing purposes established by Viru Keskus, and who are obliged to adhere to personal data processing legislation and this Notification.

We have prescribed guidelines and regulations for safe processing of personal data by organisational and technical measures. We maintain safety measures of personal data processing pertinent and update, and renew and upgrade these in due course.