Privacy policy

General provisions

This Privacy Policy sets out the principles governing the collection, processing and storage of personal data. Personal data is collected, processed and stored by the data controller Puhastid OÜ (hereinafter referred to as the data processor).

A data subject is a customer or other natural person whose personal data is processed by a data processor.

A customer is anyone who buys goods or services from a data processor’s website.

The data processor shall comply with all data processing principles laid down by law and shall process personal data lawfully, fairly and securely.

Collection, processing and storage of personal data

Personal data is collected electronically, mainly through the website and e-mail.

By sharing their data, data subjects grant the data controller the right to collect, use and manage their data for the purposes set out in this Privacy Policy.

The data subject is responsible for the accuracy of the data provided and must inform the data processor of any changes. In the event of misrepresentation, the data processor shall not be liable for any damage that may arise.

Puhastid OÜ is the controller of personal data and forwards the data necessary for the execution of payments to Maksekeskus AS.

Processing of customers’ personal data

A data processor may process the following personal data:

  • First name and surname
  • Date of birth
  • Phone number
  • E-mail address
  • Address for service
  • Current account number
  • Payment card details

In addition, the data controller may collect data available from public registers.

Legal basis for the processing of personal data – Article 6(1)(a), (b), (c) and (f) of the EU General Data Protection Regulation (GDPR):

  • (a) the data subject has given his or her consent to the processing of his or her personal data;
  • (b) the processing is necessary for the performance of a contract or the performance of pre-contractual measures;
  • (c) the processing is necessary for compliance with a legal obligation;
  • (f) processing is necessary for legitimate interests, provided that the processing does not adversely affect the rights of the data subject.

Purposes of processing and retention periods:

  • Safety and security – in accordance with the legal deadlines.
  • Order processing – up to 7 years
  • Operation of e-shop services – up to 7 years
  • Client management – up to 7 years
  • Accounting and financial activities – in accordance with the deadlines set by law

The data controller may share personal data with third parties (e.g. accountants, transport and courier companies, payment service providers). Data are protected by technical and organisational measures to prevent unlawful access or destruction. The storage period will depend on the purpose, but will not exceed 7 years.

Data subject rights
  • Get access to and review your personal data
  • Receive information about data processing
  • Correct or complete inaccurate data
  • Withdraw consent to the processing of personal data at any time
  • To exercise your rights, please contact epood@puhastid.ee
  • File a complaint with the Data Protection Inspectorate
Final provisions

This Privacy Policy has been drafted in accordance with the EU General Data Protection Regulation (EU) No 2016/679, the Personal Data Protection Act of the Republic of Estonia and other relevant legislation.

The Data Controller reserves the right to change the Privacy Policy by notifying the Data Controller via the website and e-mail(epood@puhastid.ee).