Privacy Policy

Privacy policy

1. General provisions

1.1. This privacy policy sets out the principles for collecting, processing and storing personal data. Kodupaber AS is the controller responsible for processing personal data.

1.2. A data subject is a customer or another individual whose personal data is processed by the controller.

1.3. A customer is anyone who purchases goods or services through the controller’s website.

1.4. The controller follows the data processing principles required by law and processes personal data lawfully, fairly and securely. The controller can demonstrate compliance with applicable data protection requirements.

2. Collection, processing and storage of personal data

2.1. Personal data is collected electronically or on paper.

2.2. By providing personal data, the data subject allows the controller to collect, organise, use and manage the data they provide directly or indirectly when purchasing goods or services, for the purposes described in this privacy policy and on the applicable legal basis.

2.3. The data subject is responsible for ensuring that the information they provide is accurate and complete. Knowingly providing false information is a breach of this privacy policy. Please inform the controller promptly if your details change.

2.4. The controller is not responsible for loss caused to the data subject or third parties by incorrect information supplied by the data subject.

3. Processing customers’ personal data

3.1. The controller may process the following personal data:

  • First and last name;
  • Email address;
  • Phone number;
  • Delivery address, including the postal code and relevant address details;
  • Bank account number.

3.2. The controller may also collect information about customers from public registers.

3.3. The legal bases for processing personal data are Article 6(1)(a), (b), (c) and (f) of the General Data Protection Regulation:

  • Consent to processing personal data for one or more specified purposes;
  • Processing necessary to perform a contract or to take steps requested by the data subject before entering into a contract;
  • Processing necessary to comply with a legal obligation;
  • Processing necessary for the legitimate interests of the controller or a third party, unless those interests are overridden by the data subject’s interests or fundamental rights and freedoms, particularly where the data subject is a child.

3.4. Personal data is retained according to its purpose:

  • Safety and security: for the periods required by law;
  • Order processing: up to three years;
  • Operation of online store services: up to three years;
  • Customer management: up to three years;
  • Financial activities and accounting: for the periods required by law;
  • Marketing: up to three years.

3.5. The controller may share personal data with third parties such as authorised processors, accountants, delivery and courier companies, and payment service providers. Kodupaber AS remains the controller of the personal data. Personal data needed to make payments is provided to the authorised processor Montonio Finance UAB.

3.6. The controller uses organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure and other unlawful processing.

3.7. Personal data is retained for the period appropriate to the processing purpose, generally for no longer than three years, unless a longer period is required by law.

4. Rights of the data subject

4.1. You have the right to access your personal data.

4.2. You have the right to receive information about how your personal data is processed.

4.3. You have the right to have inaccurate information corrected or incomplete information completed.

4.4. Where processing is based on your consent, you may withdraw that consent at any time.

4.5. To exercise your rights, contact our customer service at info@aren.ee.

4.6. You may lodge a complaint with the Estonian Data Protection Inspectorate to protect your rights.

5. Final provisions

5.1. This privacy policy is based on Regulation (EU) 2016/679 (the General Data Protection Regulation), the Estonian Personal Data Protection Act and other applicable Estonian and European Union legislation.

5.2. The controller may amend this privacy policy in whole or in part and will publish changes on zippo.ee.