1. Data Controller
The data controller is Veljekeskus OÜ (registry code 17298989). Contact via email: info@veljekeskus.ee. No dedicated Data Protection Officer has been appointed.
2. Personal Data We Process
-
Order data: cart contents, products, quantities, prices.
-
Identity and contact details: name, email address, delivery address, phone number.
-
Billing data: selected payment method, payment transaction metadata (amounts, status).
-
Customer support: inquiries and correspondence (incl. claims and warranty cases).
-
Account data (for registered users): account details, order history, preferences.
-
Technical data: information collected via cookies and similar technologies (see Cookies).
3. Purposes and Legal Bases
-
Performance of a contract (GDPR Art. 6(1)(b)): processing orders, delivery, customer communication.
-
Compliance with legal obligations (GDPR Art. 6(1)(c)): accounting and tax (records retained for 7 years).
-
Legitimate interests (GDPR Art. 6(1)(f)): site operation, security and fraud prevention; ensuring customer service quality.
-
Consent (GDPR Art. 6(1)(a)): direct marketing (newsletters and offers) – consent may be withdrawn at any time.
4. Recipients and Processors
We share data only as necessary to provide our services:
-
Logistics partners (for delivery of goods).
-
Payment and banking service providers (e.g., bank transfers, bank links, card payments, PayPal).
-
IT and hosting providers (e-commerce platform, email service).
-
Accounting service and auditor (for legal compliance).
5. Transfers Outside the EEA
As a rule, we process personal data within the EU/EEA. If a processor uses third countries for processing, we ensure appropriate safeguards (e.g., adequacy decision or Standard Contractual Clauses).
6. Retention Periods
-
Sales and delivery records: 7 years (to meet accounting requirements).
-
Warranty cases and claims: up to 2 years from delivery of goods or until the dispute is finally resolved.
-
Customer correspondence: typically 2 years.
-
Marketing consents and logs: until consent is withdrawn.
-
Account data: for the lifetime of the account; upon deletion we follow the periods above.
7. Your Rights
-
Access your data and obtain copies.
-
Rectify inaccurate data.
-
Erasure (“right to be forgotten”) under applicable conditions.
-
Restriction of processing and the right to object (incl. to direct marketing).
-
Data portability in a structured, machine-readable format.
-
Withdraw consent at any time (does not affect prior processing).
-
Lodge a complaint with the Data Protection Inspectorate (aki.ee) or another competent supervisory authority.
8. Cookies and Similar Technologies
We use essential cookies for the operation of the store and, with consent, analytics and marketing cookies. You can manage consent preferences via the cookie banner and your browser settings. A detailed cookie list and purposes are provided in our cookie notice.
-
Essential: session management, cart, authentication.
-
Preferences: language and display settings.
-
Analytics (with consent): usage statistics.
-
Marketing (with consent): personalised offers and advertising.
9. Minors
To use the online store and place orders, the Buyer must be at least 18 years old.
10. Automated Decision-Making
We do not engage in profiling or automated decision-making that produces legal effects concerning you or similarly significantly affects you, except for technical fraud risk assessment.
11. Contacting Us
For any privacy-related questions, requests, or to exercise your rights, please write to info@veljekeskus.ee. We will respond within a reasonable time and generally within 30 days.
12. Changes to this Policy
We may update this policy from time to time. We will notify of material changes on the online store. This policy applies as of the date stated above.