Privacy policy

Data controller

The controller of personal data for the online shop oden.ee is OÜ Oden Grupp (registry code 14376878, VAT number (KMKR) EE102027444), address Kassi tn 9, 12618 Tallinn, Estonia, phone +372 5610 3065, email info@oden.ee.

Personal data we process

• name, phone number and email address;
• delivery address;
• when buying as a company — company name and registry code;
• product prices and payment-related data (purchase history);
• details of customer support requests;
• website usage data (IP address, device and browser data, necessary cookies).

Purposes of processing

Personal data are used to manage orders and deliver goods.

To process a payment, OÜ Oden Grupp transfers the necessary data to the payment service provider chosen by the Customer: card, Apple Pay, Google Pay and other payments via WooPayments — WooCommerce Ireland Ltd. and its payment partner Stripe Payments Europe, Ltd.; PayPal payments — PayPal (Europe) S.à r.l. et Cie, S.C.A.

Purchase history data (date, product, quantity, customer data) is used for order management, accounting and customer support. Order data is stored in our order management system.

Refunds are made to the same payment method the Customer used for the purchase.

Contact details (email, phone, name) are processed to resolve questions related to the sale of goods (customer support).

IP addresses and other network identifiers are processed to provide the online store service, ensure security and prevent payment fraud.

Legal basis

• performance of a contract — placing, paying for and delivering the order;
• compliance with a legal obligation — e.g. accounting and resolving consumer disputes;
• legitimate interest — online store security and payment fraud prevention;
• consent — if we start using analytics or marketing cookies in the future (none are used at present).

Recipients of personal data

• The online shop’s customer support — to manage purchases and resolve customer issues.
• Carrier — for international delivery, Omniva (AS Eesti Post): recipient’s name, address, phone number and e-mail address. For order collection, no data is passed to a carrier.
• Payment service providers — data necessary for payment and fraud prevention: WooCommerce Ireland Ltd. and Stripe Payments Europe, Ltd. (WooPayments: cards, Apple Pay, Google Pay and local payment methods), and PayPal (Europe) S.à r.l. et Cie, S.C.A. (PayPal).
• Accounting software provider Smart Accounts OÜ — invoice data (buyer’s name, country, address, phone, e-mail, delivery method, order contents and amount); OÜ Oden Grupp keeps its own accounts.
• IT service providers (server and e-mail hosting) and the WordPress.com/Jetpack connection (Aut O’Mattic A8C Ireland Ltd.) required for WooPayments — to the extent necessary for the store to operate.

The map on the “Contact” page is loaded from the servers of the OpenStreetMap Foundation (United Kingdom). To display the map, the Customer’s browser transmits the Customer’s IP address and technical request data (e.g. browser type) to the OpenStreetMap Foundation. The OpenStreetMap Foundation processes these data as an independent controller under its own privacy policy (osmfoundation.org/wiki/Privacy_Policy). The transfer of personal data to the United Kingdom is based on the European Commission’s decision that the United Kingdom ensures an adequate level of protection of personal data.

If the answer to “Do you need installation?” in the request form (“Send request”, including on the “Installation” page) is “Yes”, OÜ Oden Grupp passes the request data (name, phone number and/or e-mail address, site location, answers, additional information and attached files) to the installation service provider Almasel hooldus OÜ (registry code 16835528). The purpose is to prepare an installation quote, arrange a site visit, and conclude and perform the installation contract. The legal basis is taking steps at the Customer’s request prior to entering into a contract, and performance of the contract. Almasel hooldus OÜ is the party to the installation contract and processes these data as an independent controller.

Personal data are passed to processors on the basis of contracts concluded with them. Processors must ensure appropriate safeguards when processing personal data.

Security and access

Personal data is stored on servers located in the European Union or the European Economic Area. Payment service providers may also process data outside the EU; in that case the transfer is based on safeguards recognised by the European Commission (e.g. the EU–US Data Privacy Framework or standard contractual clauses).

Personal data are accessible to online shop staff who need them to fulfil orders, provide customer support and maintain the shop technically.

The online shop applies appropriate physical, organisational and technical security measures to protect personal data against accidental or unlawful destruction, loss, alteration, and unauthorised access or disclosure.

Cookies

The online store uses only necessary cookies and similar technologies: for the shopping cart and checkout, and security and fraud-prevention cookies of payment service providers (Stripe, PayPal) on product pages, in the cart and at checkout. No analytics or marketing cookies are used at present. If we start using them, we will ask for your consent in advance and update this policy.

The choice you make in the cookie banner is stored in your browser. You can change it at any time via the “Cookies” link in the page footer.

Accessing and correcting your data

You can view and correct your data in your user profile. If you purchased without an account, customer support can provide access to your data.

Withdrawing consent

Where processing is based on consent, the Customer may withdraw it at any time — for cookies via the «Küpsised» link, otherwise by notifying customer support by email.

Data retention

• When a customer account is closed, personal data are deleted, except data that must be kept for accounting or to resolve consumer disputes.
• In disputes related to payments or consumer rights, data are kept until the claim is settled or the limitation period ends.
• Order and invoice data is retained for seven years under the Accounting Act.
• Data sent through the request form (“Send request”) — name, phone or e-mail, property location, answers and attached files — is used only to reply to the request and prepare an offer. Attached photos and plans are deleted after 90 days, and the request itself after 24 months.

Deletion and portability

To have your personal data deleted or transferred, contact customer support by email. We reply within one month at the latest; before releasing data we verify the requester’s identity.

Disputes

For questions and disputes about the processing of personal data, contact info@oden.ee. The supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), info@aki.ee.