PRIVACY POLICY

This page explains what personal data the online shop www.maailmapuudutus.ee collects, why we use it, who we share it with and what rights you have.

1. Data controller

The controller of your personal data is Senua UÜ (registry code 12783792, Saarepera, Tõdu küla, Kanepi vald, 63510 Põlva maakond, Estonia). For data protection questions, write to Senua@senua.ee or call +372 5045885.

2. What data we process

• Order data: first and last name, email address, phone number, delivery address or chosen parcel locker, ordered products and payment details (amount, time, payment method). We do not see or store your bank card details – payments are made in the payment provider's secure environment.
• Customer account data, if you create an account in the shop.
• Newsletter data: email address and name, if you subscribe to our newsletter.
• Communication data: your emails and enquiries to us.
• Website usage data: data collected through cookies (see section 7).

3. Why we use your data and on what legal basis

• Processing and delivering your order and communicating about it – performance of a contract (Article 6(1)(b) of the General Data Protection Regulation).
• Accounting – legal obligation (Article 6(1)(c)).
• Sending the newsletter – your consent (Article 6(1)(a)). You can withdraw your consent at any time via the link at the end of every newsletter.
• Website statistics and ad targeting – your consent to cookies (Article 6(1)(a)).
• Handling complaints and defending legal claims – our legitimate interest (Article 6(1)(f)).

We do not make automated decisions or carry out profiling that has legal effects on you.

4. Who we share data with

We only share the data needed for the service in question:

• payment provider ESTO – to process payments. If you choose ESTO hire purchase or instalments, you apply directly with ESTO: ESTO collects additional data needed to process the application (such as your personal identification code and income data) and processes it as an independent controller under its own privacy terms;
• parcel delivery companies (Omniva, DPD, SmartPOST/Itella, Unisend, Matkahuolto) – to deliver your order;
• e-commerce platform Shoproller – to host the shop and order data;
• MailerLite – to send the newsletter;
• our accounting service provider – for bookkeeping;
• Google, Meta (Facebook) and GoSquared – for website statistics and advertising, if you have accepted cookies.

Some service providers (such as Google and Meta) may process data outside the European Economic Area. In that case, transfers are based on safeguards approved by the European Commission (such as the EU–US Data Privacy Framework or standard contractual clauses). We do not sell personal data.

5. How long we keep data

• order and accounting data – 7 years (required by the Estonian Accounting Act);
• customer communication and complaints – up to 3 years after the order;
• newsletter data – until you unsubscribe;
• customer account – until the account is deleted;
• cookies – depending on the type, up to 2 years.

6. Your rights

You have the right to:

• access your data and receive information about how it is processed;
• have inaccurate data corrected;
• have your data erased, unless we are required by law to keep it;
• restrict the processing of your data;
• object to processing based on legitimate interest;
• receive your data in a machine-readable format (data portability);
• withdraw your consent at any time.

To exercise your rights, write to Senua@senua.ee. We will reply within one month. If you believe your rights have been violated, you can contact the Estonian Data Protection Inspectorate (www.aki.ee).

7. Cookies

Cookies are small text files stored on your device. We use:

• necessary cookies – for the shop to work (shopping cart, login, language choice);
• analytics cookies (Google Analytics, GoSquared) – to understand how the website is used;
• marketing cookies (Meta pixel) – to measure and target advertising.

You can delete or block cookies at any time in your browser settings.

8. Changes

We may update this privacy policy. The current version is always published on this page.

Effective from 6 October 2026.