Privacy policy

This is a translation for convenience. In the event of any discrepancy, the Estonian version of this policy prevails.

1. General provisions

This privacy policy sets out the principles governing the collection, processing and storage of personal data.

Personal data is collected, processed and stored by the data controller Osaühing AIMET INVEST (registry code 11131900, VAT no. EE101004552), registered at Rägavere tee 11, 44312 Rakvere (the Controller).

A data subject within the meaning of this privacy policy is a customer or other natural person whose personal data the Controller processes.

A customer within the meaning of this privacy policy is anyone who purchases goods or services from the Controller's online store.

The Controller follows the data processing principles laid down in legislation, including processing personal data lawfully, fairly and securely.

2. Collection, processing and storage of personal data

The personal data collected, processed and stored by the Controller is gathered electronically, mainly via the website and by telephone.

By sharing their personal data, the data subject grants the Controller the right to collect, organise, use and manage that personal data for the purposes set out in this privacy policy.

The data subject is responsible for ensuring that the data submitted is accurate, correct and complete. Knowingly submitting false data is considered a breach of this privacy policy. The data subject is obliged to notify the Controller immediately of any changes to the data submitted.

The Controller is not liable for damage caused to the data subject or third parties by the submission of false data by the data subject.

3. Processing of customers' personal data

The Controller may process the following personal data of the data subject:

• First and last name
• Telephone number
• Email address
• Delivery address
• Order and purchase history data

In addition, the Controller has the right to collect data about the customer that is available in public registers.

The legal basis for processing personal data is Article 6(1)(a), (b), (c) and (f) of the General Data Protection Regulation:

• the data subject has given consent to the processing of their personal data for one or more specific purposes;
• processing is necessary for the performance of a contract to which the data subject is party, or to take steps at the request of the data subject prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

Processing of personal data according to purpose:

• Purpose — processing orders and delivering goods. Maximum retention period — 7 years, arising from the Accounting Act.
• Purpose — resolving complaints and warranty claims. Maximum retention period — 3 years from fulfilment of the order.
• Purpose — direct marketing (newsletters). Maximum retention period — until consent is withdrawn.

The Controller forwards the personal data required for payments to the authorised processor Maksekeskus AS. The personal data required for delivery is forwarded to the company providing the transport service.

The Controller applies appropriate organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure and any other unlawful processing.

4. Rights of the data subject

The data subject has the right to access and review their personal data.

The data subject has the right to receive information about the processing of their personal data.

The data subject has the right to supplement or correct inaccurate data.

Where the Controller processes the data subject's personal data on the basis of consent, the data subject has the right to withdraw that consent at any time.

To exercise these rights, the data subject may contact the Controller by phone on +372 5787 0100 or by post at Nortsu tee 22, 44317 Rakvere.

To protect their rights, the data subject may lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee).

5. Cookies

The online store uses cookies to ensure the website functions, to remember the contents of the shopping cart and the selected language, and to collect website usage statistics. Cookies can be disabled or deleted in your browser settings, but in that case not all functions of the online store may work correctly.

6. Final provisions

These data protection terms have been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation) and the Personal Data Protection Act of the Republic of Estonia.

The Controller has the right to amend these data protection terms in whole or in part, notifying data subjects of the changes via the website.