Please note: this is a translation of the Estonian privacy policy. In the event of any discrepancy or dispute, the Estonian text prevails.
1. Data protection terms
The controller of personal data of the online shop www.eemeli.ee is EEMELI OÜ (registry code 10176674), located at Pargi 27A, Jõhvi, 41537, phone +372 56641505, e-mail epood@eemeli.ee.
What personal data is processed
- name, phone number and e-mail address;
- delivery address of the goods;
- bank account number;
- cost of goods and services and payment-related data (purchase history);
- IP address;
- customer support data.
2. Purposes of processing personal data
Personal data is used to manage customer orders and deliver goods.
Purchase history data (date of purchase, goods, quantity, customer data) is used to compile an overview of purchased goods and services, to analyse customer preferences and, among other things, to resolve consumer disputes.
The bank account number is used to refund payments to the customer.
Personal data such as e-mail address, phone number and customer name is processed in order to resolve questions related to the provision of goods and services (customer support). The e-mail address is also used to send invoices, and the phone number is used to notify the customer when goods have arrived at a parcel machine.
The IP address or other network identifiers of the online shop user are processed in order to provide the online shop as an information society service and to compile web usage statistics.
3. Legal basis
Personal data is processed for the performance of the contract concluded with the customer (managing customer orders, delivery, returns of goods and refunds).
Personal data is processed to comply with legal obligations (e.g. accounting).
Processing personal data is necessary for the legitimate interest of the controller, which consists in collecting purchase history data for the purpose of resolving possible consumer disputes.
Data is processed with the customer's consent for the following activities: profiling, direct marketing.
4. Recipients to whom personal data is transferred
The name, phone number and e-mail address are transferred to the transport service provider chosen by the customer. If the goods are delivered by courier, the customer's address is transferred in addition to the contact details.
Personal data may be transferred to providers of information technology services if this is necessary to ensure the functionality of the online shop or data hosting.
If the customer signs in to the online shop with a Google account (“Sign in with Google”), Google (Google Ireland Limited) shares the customer’s name, e-mail address and Google account identifier with the online shop. They are used only to create, link and sign in to the customer account; Google does not share the password with the online shop.
5. Security and access to data
Personal data is stored on the servers of Zone OÜ, located in the territory of a Member State of the European Union or of countries that have joined the European Economic Area. Data may be transferred to countries whose level of data protection has been assessed as adequate by the European Commission, or to a company in a third country in respect of which a safeguard referred to in Article 46 or 47 or Article 49(1) of the General Data Protection Regulation has been applied.
Personal data can be accessed by the employees of the online shop, who may view personal data in order to resolve technical issues related to the use of the online shop and to provide customer support.
The online shop applies appropriate physical, organisational and IT security measures to protect personal data against accidental or unlawful destruction, loss, alteration or unauthorised access and disclosure.
Personal data is transferred from the online shop's processors to recipients (e.g. transport service provider and data hosting) on the basis of contracts concluded between the online shop and the processors. The processors are obliged to ensure appropriate safeguards when processing personal data in accordance with Article 28 of the General Data Protection Regulation.
6. Access to and rectification of personal data
Personal data can be viewed and corrected in the user profile of the online shop or through customer support. If the purchase was made without a user account, personal data can be viewed through customer support. If the request to view personal data is submitted electronically, the information is also provided by commonly used electronic means.
7. Withdrawal of consent
If personal data is processed on the basis of the customer's consent, the customer has the right to withdraw consent in the customer account settings or by notifying customer support by e-mail.
8. Retention
When an online shop customer account is closed, personal data is deleted, except for personal data (purchase history data) that must be retained for accounting purposes or for resolving consumer disputes.
In the event of disputes related to payments or consumer disputes, personal data is retained until the claim has been satisfied or until the end of the limitation period.
Personal data contained in source accounting documents is retained for seven years.
9. Restriction
The customer has the right to request restriction of the processing of their personal data if the data is incorrect or incomplete or if their personal data is processed unlawfully.
10. Objections
The customer has the right to object to the processing of their personal data if they have reason to believe that there is no legal basis for processing their personal data.
11. Erasure
To have personal data erased, please contact customer support by e-mail. Erasure requests are answered no later than within one month, specifying the period within which the data will be erased.
The reply to the request also states the personal data that will not be erased, together with the legal basis and reason.
12. Data portability
Requests for the transfer of personal data submitted by e-mail are answered within one month at the latest.
Customer support verifies the identity of the person and informs them of the personal data subject to transfer.
13. Direct marketing messages
The e-mail address and phone number are used to send direct marketing messages if the customer has given the corresponding consent. If the customer does not wish to receive direct marketing messages, they should select the corresponding link in the footer of the e-mail or contact customer support.
If personal data is processed for direct marketing purposes (profiling), the customer has the right to object at any time to the initial and further processing of their personal data, including profiling related to direct marketing, by notifying customer support by e-mail.
14. Dispute resolution
Disputes related to the processing of personal data are resolved through customer support at epood@eemeli.ee. The supervisory authority is the Estonian Data Protection Inspectorate (info@aki.ee).