Puidukraam Grupp OÜ (“us”, “we”, or “our” or “Puidukraam Grupp OÜ”) operates the https://puidukraam.ee/ website (the “Service”).
1. General Provisions
1.1. This Privacy Policy governs the principles of collecting, processing and storing personal data. Personal data is collected, processed and stored by PUIDUKRAAM GRUPP OÜ, the data controller (hereinafter referred to as the Controller).
1.2. For the purposes of this Privacy Policy, a data subject is a customer or any other natural person whose personal data is processed by the Controller.
1.3. For the purposes of this Privacy Policy, a customer is any person who purchases goods or services from the Controller’s website.
1.4. The Controller complies with the principles of data processing established by applicable legislation. In particular, the Controller processes personal data lawfully, fairly and securely. The Controller is able to demonstrate that personal data has been processed in accordance with applicable legal requirements.
2. Collection, Processing and Storage of Personal Data
2.1. Personal data collected, processed and stored by the Controller is obtained electronically, primarily through the website and email.
2.2. By providing their personal data, the data subject grants the Controller the right to collect, organise, use and manage the personal data provided directly or indirectly when purchasing goods or services through the website, for the purposes specified in this Privacy Policy.
2.3. The data subject is responsible for ensuring that the information they provide is accurate, correct and complete. Knowingly providing false information is considered a violation of this Privacy Policy. The data subject is obliged to notify the Controller without delay of any changes to the information provided.
2.4. The Controller shall not be liable for any damage caused to the data subject or third parties as a result of the data subject providing incorrect information.
3. Processing of Customers’ Personal Data
3.1. The Controller may process the following personal data of the data subject:
3.1.1. First and last name;
3.1.2. Telephone number;
3.1.3. Email address;
3.1.4. Delivery address;
3.1.5. Bank account number;
3.1.6. Payment-related information (payment method, payment status and transaction identifier).
3.2. In addition to the above, the Controller has the right to collect information about customers that is available in public registers.
3.3. The legal bases for processing personal data are Article 6(1)(a), (b), (c) and (f) of the General Data Protection Regulation (GDPR):
a) The data subject has given consent to the processing of their personal data for one or more specific purposes;
b) Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;
c) Processing is necessary for compliance with a legal obligation to which the Controller is subject;
f) Processing is necessary for the purposes of the legitimate interests pursued by the Controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, particularly where the data subject is a child.
3.4. Processing of Personal Data According to the Purpose of Processing
3.4.1. Purpose of processing – Security and protection
Technical log data may be processed where necessary to ensure security. Such data is retained only for as long as necessary to maintain security, investigate potential security incidents or comply with legal obligations.
3.4.2. Purpose of processing – Order processing
Personal data retention period – order information required for accounting purposes is retained for 7 years from the end of the relevant financial year.
Other personal data related to orders is retained for as long as necessary to fulfil orders, provide customer service and resolve potential complaints, taking into account legal obligations and applicable retention periods.
3.4.3. Purpose of processing – Ensuring the operation of the online store
Technical data is processed to ensure the proper operation of the online store. The retention period for WooCommerce logs is set to 30 days.
Other technical data is retained according to the purposes of its processing and the applicable retention periods of the relevant service providers.
3.4.4. Purpose of processing – Customer management
Personal data retention period – personal data related to customer communications is retained for as long as necessary to respond to customer enquiries, manage orders and resolve potential complaints.
Data that must be retained to comply with legal obligations is stored for the periods prescribed by applicable legislation.
3.4.5. Purpose of processing – Financial activities and accounting
Maximum personal data retention period – 7 years from the end of the relevant financial year, unless a longer retention period is required by law.
3.4.6. Purpose of processing – Marketing
Personal data retention period – personal data processed for marketing purposes is retained for as long as necessary to fulfil the relevant purpose or until consent is withdrawn, where processing is based on consent.
When consent is withdrawn, the processing of personal data for the relevant marketing purpose is discontinued, unless another legal basis exists for further retention of the data.
3.4.7. Purpose of processing – Web analytics
Personal data is processed to analyse website usage, improve user experience and evaluate the performance of the online store.
Maximum personal data retention period – Google Analytics 4 event and user-level data is retained for up to 14 months, in accordance with Google Analytics data retention settings.
The retention periods for analytics cookies are specified in the information on the use of cookies.
Analytics cookies are used only with the user’s consent.
3.5. Sharing Personal Data with Third Parties
The Controller has the right to share customers’ personal data with third parties, such as authorised data processors, accountants, transport and courier companies, and payment service providers.
The Controller is responsible for the processing of personal data.
The Controller transfers the personal data necessary for processing payments to the authorised processor Maksekeskus AS.
3.6. Protection of Personal Data
When processing and storing personal data, the Controller implements organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure and any other unlawful processing.
3.7. Personal Data Retention Periods
The Controller retains personal data in accordance with the purposes of processing and the retention periods specified in Section 3.4 of this Privacy Policy.
Personal data is not retained for longer than necessary to fulfil the purposes of processing or to comply with legal obligations.
4. Rights of the Data Subject
4.1. The data subject has the right to obtain confirmation as to whether their personal data is being processed and to access their personal data.
4.2. The data subject has the right to receive information about the purposes and legal bases of processing, the recipients of their personal data and the applicable retention periods.
4.3. The data subject has the right to request the correction of inaccurate personal data and the completion of incomplete data.
4.4. The data subject has the right to request the deletion of their personal data in cases provided for by law. The right to erasure may be restricted where retaining the data is necessary to comply with a legal obligation, such as the requirement to retain accounting records.
4.5. The data subject has the right to request the restriction of the processing of their personal data in cases provided for by law.
4.6. The data subject has the right to object to the processing of their personal data where the processing is based on legitimate interests.
The data subject may object at any time to the processing of their personal data for direct marketing purposes.
4.7. The data subject has the right to receive the personal data they have provided in a structured, commonly used and machine-readable format and to transmit that data to another data controller, provided that the conditions for exercising this right are met.
4.8. Where the processing of personal data is based on the data subject’s consent, the data subject has the right to withdraw that consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
4.9. To exercise their rights, the data subject may contact PUIDUKRAAM GRUPP OÜ by email at info@puidukraam.ee.
The Controller generally responds to requests within one month, in accordance with the conditions established by applicable legislation.
4.10. If the data subject believes that their rights have been violated in the processing of their personal data, they have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or seek legal remedy through the courts.
5. Final Provisions
5.1. This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation – GDPR), the Personal Data Protection Act of the Republic of Estonia, and other applicable legislation of the Republic of Estonia and the European Union.
5.2. The Controller reserves the right to amend these data protection terms in whole or in part by notifying data subjects of changes through the website puidukraam.ee.
Contact Us
If you have any questions about this Privacy Policy, please contact us by email: info@puidukraam.ee
