1. General Provisions
1.1. This privacy policy regulates the principles of collection, processing and storage of personal data. Personal data is collected, processed and stored by the person responsible for personal data (Emmipood OÜ) (hereinafter — the data processor).
1.2. The data subject within the meaning of the privacy policy is a client or other natural person whose personal data is processed by the data processor.
1.3. A client within the meaning of the privacy policy is anyone who purchases goods or services on the data processor’s website.
1.4. The data processor complies with the data processing principles provided for by law, including the data processor processes personal data on a lawful basis, in good faith and securely. The data processor can confirm that personal data has been processed in accordance with the provisions of the law.
2. Collection, Processing and Storage of Personal Data
2.1. Personal data that the data processor collects, processes and stores is collected electronically, mainly through the website and email.
2.2. By providing their personal data, the data subject gives the data processor the right to collect, organize, use and manage personal data for the purposes specified in the privacy policy, which the data subject directly or indirectly shares with the data processor when purchasing goods or services on the website.
2.3. The data subject is responsible for ensuring the accuracy, correctness and completeness of the data provided by him. Providing knowingly false information is considered a violation of the Privacy Policy. The data subject is obliged to immediately notify the data processor of changes in the provided data.
2.4. The data processor is not responsible for damage caused to the data subject or third parties as a result of the data subject providing false information.
3. Processing of Customer Personal Data
3.1. The data processor may process the following personal data of the data subject:
3.1.1. First and last name;
3.1.2. Date of birth;
3.1.3. Phone number;
3.1.4. Email address;
3.1.5. Delivery address;
3.1.6. Current account number;
3.1.7. Payment card details;
3.2. In addition to the above, the data processor has the right to collect data about the client that is available in public registers.
3.3. The legal basis for processing personal data is Article 6(1)(a), (b), (c) and (f) of the General Data Protection Regulation:
a) the data subject has given his consent to the processing of his personal data for one or more specific purposes;
b) the processing of personal data is necessary for the performance of a contract to which the data subject is a party, or for taking measures prior to the conclusion of the contract in accordance with the request of the data subject;
c) the processing of personal data is necessary for the fulfillment of the legal obligations of the data controller;
f) the processing of personal data is necessary in the case of a legitimate interest of the data controller or a third party, unless such interest is outweighed by the interests of the data subject or fundamental rights and freedoms for which personal data must be protected, especially if the data subject is a child.
3.4. Processing of personal data in accordance with the purpose of processing:
3.4.1. Purpose of processing – security and safety Maximum period of storage of personal data: 360 days.
3.4.2. Purpose of processing – order processing Maximum period of storage of personal data: 360 days.
3.4.3. Purpose of processing – ensuring the functioning of online store services Maximum period of storage of personal data: 360 days.
3.4.4. Purpose of processing – customer management Maximum period of storage of personal data: 360 days.
3.4.5. Purpose of processing – financial activities, accounting Maximum period of storage of personal data: 360 days.
3.4.6. Purpose of processing – marketing Maximum period of storage of personal data: [360 дней] days.
3.5. The data processor has the right to transfer personal data of clients to third parties, such as authorized data processors, accountants, transport and courier companies, companies providing translation services. The data processor is the responsible processor of personal data. The data processor transfers the personal data necessary for making payments to the authorized processor.
3.6. When processing and storing personal data of the data subject, the data operator implements organizational and technical measures that ensure the protection of personal data from accidental or unlawful destruction, alteration, disclosure and any other unlawful processing.
3.7. The data processor stores data of data subjects depending on the purpose of processing, no longer than 2 years.
4. Rights of the Data Subject
4.1. The data subject has the right to access and familiarize himself with his personal data.
4.2. The data subject has the right to receive information about the processing of his personal data.
4.3. The data subject has the right to supplement or correct inaccurate data.
4.4. If the data processor processes personal data of the data subject on the basis of the consent of the data subject, the data subject has the right to withdraw consent at any time.
4.5. To exercise their rights, the data subject can contact the online store customer support service at info@emmipood.ee.
4.6. The data subject can file a complaint with the Data Protection Inspectorate to protect their rights.
5. Final Provisions
5.1. These data protection conditions were drawn up in accordance with Regulation (EU) No. 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC/EC (General Data Protection Regulation), the Personal Data Protection Act of the Republic of Estonia and the legislation of the Republic of Estonia and the European Union.
5.2. The data processor has the right to partially or completely change the data protection conditions by notifying data subjects about the changes through the home page https://emmipood.ee.
