1. General provisions
1.1 This privacy policy sets out the principles for collecting, processing and storing personal data. Personal data is collected, processed and stored by the data controller, Veebindus Oร (hereinafter the controller).
1.2 In this privacy policy, a data subject means a customer or another natural person whose personal data the controller processes.
1.3 In this privacy policy, a customer means anyone who purchases goods from the controller’s online store, Hiirematid.ee.
1.4 The controller processes personal data lawfully, fairly and securely, in accordance with applicable legislation. The controller can demonstrate that its processing of personal data meets the requirements of that legislation.
2. Collecting, processing and storing personal data
2.1 The controller collects, processes and stores personal data electronically, primarily through the online store and email.
2.2 By providing personal data, the data subject authorises the controller to collect, organise, use and manage the data for the purposes set out in this privacy policy. This includes data that the data subject provides to the controller directly or indirectly when purchasing goods or services from the Hiirematid.ee online store.
2.3 The data subject is responsible for ensuring that the information they provide is correct, accurate and complete. Knowingly providing incorrect information is considered a breach of this privacy policy.
2.4 The controller is not liable for damage suffered by the data subject or third parties as a result of the data subject providing incorrect or incomplete information.
3. Processing customers’ personal data
3.1 The controller may process the following personal data of the data subject:
3.1.1 first name and surname;
3.1.2 telephone number;
3.1.3 email address;
3.1.4 delivery address.
3.2 In addition to the above, the controller is entitled to collect information about the customer from public registers.
3.3 The legal bases for processing personal data are points (a), (b), (c) and (f) of Article 6(1) of the General Data Protection Regulation (EU) 2016/679:
a) the data subject has consented to the processing of their personal data for one or more specific purposes;
b) processing is necessary to perform a transaction to which the data subject is a party, or to take steps at the data subject’s request before entering into a contract;
c) processing is necessary to comply with a legal obligation imposed on the controller by applicable legislation;
f) processing is necessary for the legitimate interests of the controller or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject, particularly where the data subject is a child.
3.4 Personal data is processed for the following purposes, with the following maximum retention periods:
3.4.1 purpose โ ensuring security and safety; maximum retention period โ in accordance with statutory time limits;
3.4.2 purpose โ processing orders; maximum retention period โ 1 year;
3.4.3 purpose โ ensuring the operation of online store services; maximum retention period โ 1 year;
3.4.4 purpose โ customer management; maximum retention period โ 1 year;
3.4.5 purpose โ financial activities and accounting; maximum retention period โ in accordance with statutory time limits.
3.5 The controller may transfer customers’ personal data to third parties, such as processors, accountants, transport and courier companies, and payment service providers. The controller acts as the controller of personal data. Personal data necessary for processing payments is transferred to the processor AS LHV.
3.6 The controller applies appropriate organisational and technical security measures to protect personal data against accidental or unlawful destruction, alteration, disclosure or other unlawful processing.
3.7 The controller retains personal data according to the purpose of processing, but for no longer than 5 years, except where a longer retention period is required by law.
4. Rights of the data subject
4.1 The data subject has the right to access and review their personal data.
4.2 The data subject has the right to receive information about the processing of their personal data.
4.3 The data subject has the right to supplement or correct inaccurate personal data.
4.4 Where the controller processes personal data based on consent, the data subject has the right to withdraw that consent at any time.
4.5 To exercise these rights, the data subject may contact the online store’s customer support at Info@hiirematid.ee.
4.6 The data subject has the right to lodge a complaint with the Estonian Data Protection Inspectorate to protect their rights.
5. Using the online store and cookies
We currently do not use cookies and do not consider it necessary to collect information about your activity on our website.
6. Final provisions
6.1 These terms for the processing of personal data have been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation, GDPR), and the Personal Data Protection Act of the Republic of Estonia.
6.2 The controller reserves the right to amend these terms in part or in full and will notify data subjects of changes through the website or by email from info@hiirematid.ee.
