Privacy policy
Privacy policy
PROCESSING OF PERSONAL DATA
The merchant is the controller of personal data. The merchant transfers the personal data needed to make payments to the following processors: Maksekeskus AS, Swedbank AS, LHV Pank AS, SEB Pank AS.
The controller of personal data of the online shop 4kappa.ee is 4 Käppa Kaubandus OÜ (registry code 14297357), address Tallinna tn 88, Kudjape alevik, Saaremaa vald, Saaremaa 93892, Kuressaare, Estonia, phone +372 5249 356, e-mail info@4kappa.ee.
Which personal data are processed
- name, phone number and e-mail address;
- delivery address;
- bank account number;
- cost of goods and services and payment-related data (purchase history);
- customer support data.
Purposes of processing
Personal data are used to manage customer orders and deliver goods.
Purchase history data (date of purchase, product, quantity, customer data) are used to compile an overview of purchased goods and services and to analyse customer preferences.
The bank account number is used to refund payments to the customer.
Personal data such as e-mail address, phone number and customer name are processed to resolve issues related to the provision of goods and services (customer support).
The IP address or other network identifiers of the online shop’s user are processed to provide information society services through the online shop and to compile website usage statistics.
Legal basis
Personal data are processed for the performance of the contract concluded with the customer.
Personal data are processed to fulfil legal obligations, for example accounting and the resolution of consumer disputes.
Recipients of personal data
Personal data are transferred to the online shop’s customer support to manage purchases and purchase history and to resolve customer issues.
Name, phone number and e-mail address are transferred to the transport service provider chosen by the customer. For courier deliveries, the customer’s address is also transferred.
If the online shop’s accounting is outsourced, personal data are transferred to the service provider to perform accounting operations.
Personal data may be transferred to IT service providers if this is necessary to ensure the functioning of the online shop or data hosting.
Security and access to data
Personal data are stored on the servers of Roller Äritarkvara OÜ, located in a European Union member state or in countries that have joined the European Economic Area. Personal data are transferred outside the European Economic Area only if this is necessary to provide the service and the transfer takes place on the basis of a European Commission adequacy decision or with appropriate safeguards, for example standard data protection clauses approved by the European Commission.
Personal data can be accessed by employees of the online shop who need to view them to resolve technical issues related to the use of the online shop and to provide customer support.
The online shop applies appropriate physical, organisational and IT security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised access and disclosure.
Personal data are transferred to the online shop’s processors (e.g. transport service providers and data hosting) on the basis of contracts concluded between the online shop and the processors. Processors are obliged to ensure appropriate safeguards when processing personal data.
Access to and correction of personal data
You can view and correct your personal data in your user profile of the online shop. If the purchase was made without a user account, you can access your personal data through customer support.
Withdrawal of consent
If personal data are processed on the basis of the customer’s consent, the customer has the right to withdraw consent by notifying customer support by e-mail.
Retention
When a customer account is closed, personal data are deleted unless they need to be retained for accounting purposes or to resolve consumer disputes.
If a purchase was made without a customer account, the purchase history is retained for three years.
In case of disputes related to payments and consumer disputes, personal data are retained until the claim is fulfilled or until the end of the limitation period.
Personal data required for accounting are retained for seven years.
Deletion
To have your personal data deleted, please contact customer support by e-mail. Deletion requests are answered within one month at the latest, specifying the deletion period.
Data portability
Requests for the transfer of personal data submitted by e-mail are answered within one month at the latest. Customer support verifies the identity of the requester and informs them which personal data are subject to transfer.
Direct marketing messages
E-mail address and phone number are used to send direct marketing messages if the customer has given consent. If the customer does not wish to receive direct marketing messages, they can use the link at the bottom of the e-mail or contact customer support.
If personal data are processed for direct marketing purposes (profiling), the customer has the right to object at any time to the initial and further processing of their personal data, including profiling related to direct marketing, by notifying customer support by e-mail.
Dispute resolution
Disputes related to the processing of personal data are resolved through customer support (info@4kappa.ee).
The supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, info@aki.ee).