Data Protection Policy

The TIVI platform (https://www.valimised.ut.ee) is an online voting platform by which the University of Tartu organizes elections for its employees and students regulated by its legislation. The Data Protection Policy explains, how, and why do we gather and process personal data.

Following parties participate in the technical organization and accommodation of the platform:

  • University of Tartu - controller
  • Smartmatic-Cybernetica Centre of Excellence for Internet Voting OÜ - processor

The data is located in the infrastructure of University of Tartu and in the infrastructure of Smartmatic-Cybernetica Centre of Excellence for Internet Voting OÜ, in the Amazon Web Services environment, in the eu-west-1 (Ireland) and eu-west-2 (London) regions.

What personal data is collected and why?

The platform is used for online voting for binding electoral events. The purpose of the platform is to make it possible to hold elections and find out the voting result in the context of ballot secrecy.

The platform processes personal data on an election basis. In the context of a single election, only the personal data of those and only those users is processed on the basis of

  • Those who have the right to vote in the given election or
  • Those who try to vote in the given election even though they do not have the right to vote.

The platform allows multiple elections to be held at the same time, in which case personal data related to different elections is managed in a logically separate manner.

The platform processes the personal data that is essential for organizing elections with electronic voting.

  • Unique identifiers of all persons with the right to vote to interface with the login service of the University of Tartu;
  • The corresponding name for each unique identifier;
  • Encrypted and digitally signed ballot;
  • Ballots cryptographically indexed in a hash-chain;
  • The fact if the ballot was revoked or sent to tally.

The platform processes personal data that is inevitably collected during voting.

  • For each authenticated user, regardless of their voting rights:

    • the outcome of authentication
    • time of access
    • unique identifier
    • name
    • IP address and
    • identification information provided by the web browser.

  • For each digitally signed and encrypted ballot

    • the time of retrieval

In the context of ballot secrecy, the following is emphasized: although the platform stores information on voters, their voting times, possible re-voting and the voting result, the platform does not permit it as possible to reconcile the identity of a particular voter with his or her plain-text vote preference. The platform fully complies with the requirement to ensure ballot secrecy.

Cookies

The platform does not use tracking cookies. The platform administration interface uses a session cookie, the voting application uses a short-term session cookie at login that is deleted immediately after authentication.

To whom is the data transmitted?

Personal data will only be transferred to third parties in the event of a legal obligation and on the basis of an official formal notice.

Transfer of personal data outside the European Union

The personal data processed will not be transferred outside the European Union or the European Economic Area (EEA) through the platform.

Data security

The platform's technical solution protects your data from unauthorized access, modification, disclosure, removal or infringement.

To ensure data security:

  • We treat all personal data as confidential.
  • We only use encrypted communication using TLS.
  • We use an electronic voting protocol that cryptographically guarantees the secrecy of the vote.
  • We restrict access to personal data to those employees and contractors who need this information to process it and who are subject to contractual confidentiality obligations.
  • The personal data repository is protected by the necessary IT technical and organizational protection measures.

What rights do you have and how can you exercise your rights?

In accordance with applicable data protection law, you have the right to:

  • Request access to your personal information.
  • Request the correction of your personal data.
  • Request the deletion of your personal data.
  • Request a restriction on the processing of your personal data.
  • Request the transfer of your personal data.
  • Request the withdrawal of your consent to the processing of your personal data.
  • Oppose automated decision making (including profiling).

The application to exercise your rights must identify you uniquely. To exercise your rights and submit your request, please contact us as described in the "CONTACT US" section.

How long will the personal data be retained?

Your personal data will be stored for up to 1 year from the moment of inclusion in the voter list.

Changes in the data protection conditions

By using the platform, you have read these terms and conditions. The data protection policy of the platform may change anytime. The updates to the policy are published at https://www.valimised.ut.ee/andmekaitse.html.

Contact us

If you have any concerns or questions related to the data protection conditions, please contact: andmekaitse@ut.ee

Last modified: August 24, 2023