Privacy policy

This privacy policy explains how Mailisepood (registry code 12578508) ("we") processes personal data in accordance with the General Data Protection Regulation (GDPR) and Estonian law.

Data controller

Mailisepood (registry code 12578508)
Address: Kivinuka tee 5, Vääna-Jõesuu küla, Harku vald, Harjumaa
Email: [email protected]

No separate data protection officer has been appointed; for data-protection matters, write to [email protected].

What data we collect

• Order data: name, email, phone, delivery and billing address, ordered products and order history.
• Payment data: payment takes place in the payment service provider's environment — we neither see nor store your full card details.
• Account data: if you create an account, we store the data needed to sign in.
• Usage data: statistics about how our store is used (e.g. pages visited, device type, approximate country). We collect this server-side without cookies by default; with your consent, a first-party analytics cookie also helps us recognise your device across visits. For customers and newsletter subscribers, we may link this usage data with orders and newsletter email interactions to better understand and improve the store.

Providing the data required to fulfil an order (name, contact, delivery address) is a precondition for concluding the contract — without it we cannot fulfil the order.

Purpose and legal basis of processing

• Fulfilling orders and customer support — performance of a contract.
• Accounting and statutory obligations — legal obligation.
• Store security and operation — legitimate interest.
• Understanding and improving the store, including linking website usage with orders and (for subscribers) newsletter email interactions — legitimate interest (you can object at any time). The analytics cookie used to recognise you across visits is based on your consent.
• Newsletters and marketing — your consent (which you can withdraw at any time).

Authorised processors (sub-processors)

We use the following trusted sub-processors to provide the service:

Note: FluentCart (the store) and FluentCRM (customer management) are self-hosted on our servers (Hetzner) and process data on our instructions — they are not separate external service providers. Payment service providers (bank links, card payment, instalments) and delivery providers (parcel machines, couriers) act as independent controllers and are not sub-processors of the processors listed above.

Liability note (MXroute): hosting of incoming email takes place in the USA without a formal DPA or standard contractual clauses (SCC); we use it solely to receive email and avoid transmitting sensitive personal data through this channel.

Data retention

We retain accounting source documents for 7 years (Accounting Act). We retain order data for the performance of the contract and the limitation period for legal claims (generally up to 3 years from the end of the contract). We retain account and marketing data while the account is active or the consent is valid.

Children

The online store is not directed at children (under 13) and does not knowingly collect the personal data of minors.

Transfers to third countries

Some service providers are located outside the EU/EEA. Transfers are protected by a European Commission adequacy decision, standard contractual clauses (SCC) and/or the EU–US Data Privacy Framework, as indicated in the table above.

Your rights

You have the right to access your data, rectify or erase it, restrict processing, object, and receive your data in a portable format. Where processing is based on consent (e.g. the newsletter), you have the right to withdraw consent at any time without affecting the lawfulness of prior processing. Send requests to [email protected]. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee).

Automated decisions

We do not make automated decisions that produce legal effects on you or similarly significantly affect you. The analytics described above is used only to understand and improve the store.

Cookies and web analytics

We use cookies necessary for the store to function, which do not require consent. Our web analytics works server-side without cookies by default and is based on legitimate interest. With your consent, we additionally set a first-party analytics cookie that lets us recognise your device across visits; you can decline it or withdraw consent at any time (via “Cookie settings” in the footer) without affecting how the store works. For logged-in customers and newsletter subscribers, we may link website usage with orders and newsletter email interactions to measure and improve the store; we do not use this for automated decisions that legally or similarly significantly affect you, and you can object at any time.

Changes

We may update this privacy policy from time to time. The current version is always on this page.