Privacy Policy

The controller of personal data for the online store TINYTREASURES.EE is Tiny Treasures OÜ (registry code 17351726), located at Saare County, Muhu Municipality, Rässa village, Andrei, 94718, and the e-mail address is info@tinytreasures.ee.

What personal data is processed

  • name, telephone number, and e-mail address;
  • delivery address of goods;
  • bank account number;
  • cost of goods and services and payment-related data (purchase history);
  • customer support data;
  • IP address.

Purpose of processing personal data

Personal data is used to manage customer orders and deliver goods. Purchase history data is used to compile an overview of purchased goods and services, analyze customer preferences, and resolve consumer disputes. The bank account number is used to refund payments to the customer. E-mail and telephone are used for customer service and order-related notifications (e.g. goods arriving at a parcel machine). The online store user’s IP address or other network identifiers are processed to ensure security, provide information society services, and compile usage statistics.

Legal basis

  • Personal data is processed for the purpose of performing a contract concluded with the customer.
  • Personal data is processed to fulfill a legal obligation (e.g. accounting).
  • Personal data may be processed based on the legitimate interest of the controller (e.g. resolving consumer disputes).

Data processing may also take place based on the customer’s consent for the following activities: marketing, ensuring the security and provision of the online store service, and improving the user experience.

Transfer of personal data

Personal data is transferred to the online store’s customer support for managing purchases and purchase history and resolving customer issues. Name, telephone number, and e-mail address are transferred to the transport service provider selected by the customer. If goods are delivered by courier, the address is also transferred. Data is transferred to the accounting service provider for accounting operations. Personal data may also be transferred to information technology service providers if necessary to ensure the functionality of the online store or data hosting.

Security and access to data

Personal data is stored on Zone Media OÜ servers, located in the EU or EEA territory. Data may be transferred to countries whose level of data protection has been assessed as adequate by the European Commission, or to a third-country company to which appropriate safeguards have been applied. Access to personal data is only granted to employees who need it to perform their job duties. The online store applies physical, organizational, and technical security measures, including:

  • data exchange takes place via an encrypted connection (TSL);
  • passwords are stored in encrypted (hashed) form;
  • servers are protected by a firewall and antivirus;
  • regular backups are created;
  • access is logged and monitored.

Accessing and correcting personal data

The user can access and correct their data in the customer account settings or via customer support. If the purchase was made without an account, data can be accessed via customer support.

Withdrawal of consent

The customer has the right to withdraw their consent in the customer account settings or by notifying customer support via e-mail.

Retention

Upon closing the customer account, personal data is deleted, except for data that must be retained for accounting or resolving consumer disputes. Primary accounting documents are retained for seven years.

Restriction and objections

The customer has the right to request restriction of the processing of their personal data if the data is inaccurate or processed unlawfully, and to raise objections if there is no legal basis for processing.

Deletion

To delete personal data, customer support must be contacted via e-mail. The request will be responded to within up to 30 days, specifying the data to be deleted and the legal basis for retaining it.

Data portability

Requests for the transfer of personal data will be responded to via e-mail no later than one month after identity verification.

Direct marketing and profiling

The e-mail address and telephone number are used for sending direct marketing messages only with the customer’s consent. The customer has the right to withdraw consent at any time by using the link at the bottom of the message or by notifying customer support. If profiling takes place, information about the logic used and the consequences of personal data processing will be provided in accordance with the General Data Protection Regulation.

Dispute resolution

Disputes related to the processing of personal data are resolved via customer support (info@tinytreasures.ee or the form on the contacts subpage). The supervisory authority is the Estonian Data Protection Inspectorate.