Privacy policy

1. General Provisions

1.1. This privacy policy governs the principles of collection, processing and storage of personal data. Personal data is collected, processed and stored by the personal data processor KeelteTehnoloogiad OÜ reg. No. 14111335, GrandControl.ee, is located at Pärnu linn, Jalaka 10-35, Estonia, 80019  (hereinafter referred to as the data processor).

1.2. The data subject in the sense of the privacy policy is the client or other natural person whose personal data is processed by the data processor.

1.3. A client in the sense of the privacy policy is anyone who buys goods or services on the website of the data processor.

1.4. The data processor follows the principles of data processing provided for by law, among other things, the data processor processes personal data lawfully, fairly and safely. The data processor can confirm that personal data has been processed in accordance with the provisions of the law.

 

2. Collection, processing and storage of personal data

2.1. The personal data that the data processor collects, processes and stores are collected electronically, mainly through the website and email.

2.2. By providing his personal data, the data subject gives the data processor the right to collect, organize, use and manage personal data for the purposes defined in the privacy policy, which the data subject directly or indirectly shares with the data processor when purchasing goods or services on the website.

2.3. The data subject is responsible for ensuring the accuracy, correctness and completeness of the data provided by him. Providing knowingly false information is considered a violation of the Privacy Policy. The data subject is obliged to immediately notify the data processor of changes in the data provided.

2.4. The data processor is not liable for damage caused to the data subject or third parties as a result of the data subject providing false information.

 

3. Processing of personal data of clients 

3.1. The data processor may process the following personal data of the data subject:

3.1.1. Name and surname;

3.1.2. Phone number;

3.1.3. E-mail address;

3.1.4. Delivery address;

3.1.5. Current account number;

3.2. In addition to the above, the data processor has the right to collect customer data that is available in public registers.

3.3. The legal basis for the processing of personal data is Article 6(1)(a), (b), (c) and (f) of the General Data Protection Regulation:

a) the data subject has given his consent to the processing of his personal data for one or more specific purposes;

b) the processing of personal data is necessary for the performance of a contract concluded with the participation of the data subject, or for taking measures prior to the conclusion of the contract in accordance with the request of the data subject;

c) the processing of personal data is necessary to fulfill the legal obligations of the data controller;

f) the processing of personal data is necessary in the event of a legitimate interest of the data controller or a third party, unless such interest outweighs the interests of the data subject or the fundamental rights and freedoms for which the personal data must be protected, especially if the data subject is a child.

3.4. Processing of personal data in accordance with the purpose of processing:

3.4.1. The purpose of processing is security and safety. The maximum period of storage of personal data - according to the terms specified in the law

3.4.2. Purpose of processing - order processing. Maximum storage period of personal data - until the completion / cancellation of the order, but no more than 12 months

3.4.3. The purpose of processing is to ensure the functioning of the services of the online store. The maximum storage period for personal data is no more than 12 months.

3.4.4. Purpose of processing - customer management. The maximum period of storage of personal data - until the completion / cancellation of the order, but not more than 12 months

3.4.5. Purpose of processing - financial activities, accounting. Maximum storage period of personal data - according to the terms specified in the law.

3.4.6. The purpose of processing is marketing The maximum period of storage of personal data is not regulated, provided that the array of information is protected from threats of unauthorized access.

3.5. The data processor has the right to transfer personal data of customers to third parties, such as authorized data processors, accountants, transport and courier companies, companies providing translation services. The data processor is the responsible processor of personal data. The data processor transfers the personal data necessary for making payments to the authorized processor Swedbak AS and/or VoogPay.

3.6. When processing and storing personal data of the data subject, the data operator implements organizational and technical measures that ensure the protection of personal data from accidental or unlawful destruction, alteration, disclosure and any other illegal processing.

3.7. The data processor stores data of data subjects depending on the purpose of processing, but not longer than five years.

 

4. Rights of the data subject 

4.1. The data subject has the right to access and familiarize himself with his personal data.

4.2. The data subject has the right to receive information about the processing of his personal data.

4.3. The data subject has the right to supplement or correct inaccurate data.

4.4. If the data processor processes the personal data of the data subject on the basis of the consent of the data subject, the data subject has the right to withdraw the consent at any time.

4.5. In order to exercise their rights, the data subject may contact the customer support service of the online store at the e-mail address GrandControl@mail.ee.

4.6. The data subject may file a complaint with the Data Protection Inspectorate in order to protect their rights.

5. Final provisions 

5.1. These data protection conditions have been drawn up in accordance with Regulation (EU) No 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC/EC (General Regulation on data protection), the law on the protection of personal data of the Republic of Estonia and the legislation of the Republic of Estonia and the European Union.

5.2. The data processor has the right to partially or completely change the data protection conditions by notifying data subjects of the changes via the website GrandControl.ee