General

1. This privacy policy sets out the principles governing the collection, processing and storage of personal data.
2. The personal data is collected, processed, and retained by the data controller Vinkymon OÜ; 8 Aia Street, Maarja small town 46202, Väike-Maarja rural municipality, Lääne-Viru County; registry code 12284089 (hereinafter referred to as the Data Controller).
3. If you have any questions about the processing of personal data, please contact us by sending an email to
   
   1. info@ebakudoonia.ee
   2. or calling +372 53444844 or +372 53420074.
4. For the purposes of the privacy policy, a data subject is a customer or other natural person whose personal data is processed by the Data Controller.
5. For the purposes of the policy, a customer is anyone who purchases goods from the website of the Data Controller.
6. The Data Controller complies with the data processing principles set out in legislation, including processing personal data lawfully, fairly, and securely. The Data Controller is able to confirm that the personal data has been processed in accordance with the law.

Collection, storage, erasure, and transfer of personal data

1. The personal data collected, processed, and retained by the Data Controller is collected electronically, mainly through the website and via email.
2. By sharing their personal data, the data subject grants the Data Controller the right to collect, organise, use, and manage the personal data that the data subject directly or indirectly shares with the data processor when purchasing goods on the website for the purposes specified in the privacy policy.
3. The data subject is responsible for ensuring that the data they provide is accurate, correct, and complete. Knowingly providing false information is considered a breach of the privacy policy. The data subject is obliged to inform the Data Controller without delay of any change in the data provided.
4. The Data Controller will not be liable for any damage caused to the data subject or to third parties by the provision of false information by the data subject.
5. In case of disputes related to payments and consumer disputes, personal data is retained until the claim is fulfilled or until the end of its expiration deadline. Personal data contained in the accounting records is retained for seven years.
6. In order to erase personal data, the data subject must contact the online shop by email. The request to erase data will be responded to within a month, at the latest, and the data erasure period will be specified, if necessary. The reply to the request will also indicate which personal data will not be erased and on what legal basis and for what reason.
7. Requests for the transfer of personal data made by email will be responded to within one month at the latest. The online shop identifies you and informs you of the personal data to be transferred.
8. Personal data can be accessed via customer support. If the request for access is made by electronic means, the information will also be provided by commonly used electronic means.
9. The Data Controller has the right to transfer personal data if necessary.
   
   1. The name, phone number, and email address will be transferred to the transport service provider chosen by the customer.
   2. In the case of goods to be delivered by courier, the address of the customer will be provided in addition to the contact details.
   3. If the accounting of the online shop is carried out by a service provider, the personal data will be transferred to the service provider for the purpose of carrying out accounting operations.
   4. Personal data may be transferred to information technology service providers if this is necessary to ensure the functionality or data hosting of the online shop.

Processing the personal data of customers

1. Purposes of processing personal data
   
   1. Personal data is processed for the purposes of the performance of the contract with the customer (management of customer orders, delivery, return of goods, and payments).
   2. Personal data is also processed to fulfil a legal obligation (e.g. accounting).
   3. The processing of personal data is necessary for the purposes of the legitimate interest pursued by the Data Controller in collecting the purchase history for the settlement of possible consumer disputes. For access to the legitimate interest analysis, please send an email to info@ebakudoonia.ee.
2. Data processing is subject to the consent of the customer.
3. The Data Controller may process the following personal data of a data subject:
   1. first and last name;
   2. phone number;
   3. email address;
   4. delivery address;
4. in addition to the above, the Data Controller is entitled to collect data about the customer that is available in public registers.
5. The Data Controller has the right to share the personal data of customers with third parties, such as data processors, accountants, transport and courier companies, and companies providing transfer services.
6. The Data Controller implements organisational and technical measures to ensure the protection of personal data against accidental or unlawful destruction, alteration, disclosure, and any other unlawful forms of processing.
7. The Data Controller has the right to transfer personal data if necessary:
   
   1. The name, phone number, and email address will be transferred to the transport service provider chosen by the customer.
   2. In the case of goods to be delivered by courier, the address of the customer will be provided in addition to the contact details.
   3. If the accounting of the online shop is carried out by a service provider, the personal data will be transferred to the service provider for the purpose of carrying out accounting operations.
   4. Personal data may be transferred to information technology service providers if this is necessary to ensure the functionality or data hosting of the online shop.
8. The legal basis for the processing of personal data is Article 6(1)(a), (b), (c), and (f) of the General Data Protection Regulation.
9. Processing of personal data for the purposes for which it is processed and the retention period:
   
   1. Order processing
      Maximum period of retention of personal data – until the customer withdraws their consent to the processing of personal data or until the statutory time limits from the last purchase on the website.
   2. Ensuring the functioning of the services of the online shop
      Maximum retention period – until the customer withdraws their consent to the processing of their personal data or until the statutory time limits from the last purchase on the website.
   3. Customer management
      Maximum period of retention of personal data – until the customer withdraws their consent to the processing of personal data or until the statutory time limits from the last purchase on the website.
   4. Financial activities, accounting
      Maximum period of retention of personal data – pursuant to the time limits specified by law.
   5. Marketing
      Maximum period of retention of personal data – until the customer withdraws their consent to the processing of personal data or until the statutory time limits from the last purchase on the website.
   6. Safety and security
      Maximum period of retention of personal data – pursuant to the time limits specified by law.

Rights of the data subject and customer

1. Data subjects have the right to request and access their personal data.
2. The data subject has the right to be informed about the processing of their personal data.
3. The customer has the right to object to the processing of their personal data if they have reason to believe that there is no lawful basis for the processing of their personal data.
4. The customer has the right to request the restriction of the processing of their personal data if the data is incorrect or incomplete or if their personal data is processed unlawfully.
5. To exercise their rights, data subjects can contact the online shop at info@ebakudoonia.ee..
6. Data subjects can lodge a complaint with the Data Protection Inspectorate (https://www.aki.ee/en) to protect their rights.

Use of cookies

1. A cookie is a small text file that the web browser automatically saves to the device of the data subject.
2. Cookies are used to collect information about how the data subject uses the website to provide a better user experience. The vinkymon.ee website uses the following cookies:
   1. session cookies, which are designed to enable users to use the website;
   2. persistent cookies, which are designed to remember the choices of the data subject on a website.
3. When visiting the website, the data subject may delete and/or block cookies stored on their devices by changing the relevant settings on their browser.
4. If the data subject does not use cookies, the website may not function as intended and/or some features may not be available to website users.

Final provisions

1. These terms and conditions of data protection have been drafted in accordance with Regulation (EU) No 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the Personal Data Protection Act of the Republic of Estonia, and the legislation of the Republic of Estonia and the European Union.
2. The Data Controller has the right to modify the terms and conditions of data protection, in whole or in part, at any time by informing data subjects of the modifications through the website www.vinkymon.ee.
3. Disputes related to the processing of personal data are settled via customer support (info@ebakudoonia.ee). The supervisory authority is the Data Protection Inspectorate of the Republic of Estonia (info@aki.ee).