Privacy Statement

1. Controller

The controller for personal data processed through this website is Polamo Company OÜ, Tööstuse tn 75-71, 10416 Tallinn, Estonia, registry code 17632269. For any privacy question or request, email [email protected].

2. Data we process and why

• Customer account: name, email address, phone number, password (stored only in encrypted, hashed form) and saved addresses, to let you log in, order and view your orders. Legal basis: contract (Art. 6(1)(b) GDPR).
• Orders: ordered products, delivery and billing address, the real country of delivery, order history and communication about your order, to confirm, fulfil and invoice your order and handle after-sales. Legal basis: contract (Art. 6(1)(b)) and legal obligations such as accounting (Art. 6(1)(c)).
• Payment details: for bank transfers, the payment receipt you upload, to verify your payment. These files are stored privately and are only visible to you and our staff. Legal basis: contract (Art. 6(1)(b)) and accounting obligations (Art. 6(1)(c)).
• Wishlist: the products you save, to show them to you again. Legal basis: contract (Art. 6(1)(b)).
• Contact and withdrawal messages: your name, email address, message and, if you give them, your phone number and order number, to answer you or process your withdrawal. Legal basis: steps before a contract or contract (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)) and our legitimate interest in answering enquiries (Art. 6(1)(f)).
• Server logs: IP address, date and time, page requested and browser type, to run the website securely and prevent abuse; kept for up to 14 days. Legal basis: legitimate interest (Art. 6(1)(f)).

We do not use your data for automated decision-making or profiling, and we do not sell it.

3. Recipients

• Partner suppliers and carriers receive your name, delivery address and phone number to ship your order. Some partners are located outside the EU/EEA; where a transfer is necessary to deliver your order it is based on Art. 49(1)(b) GDPR, otherwise on the EU Standard Contractual Clauses.
• Hetzner Online GmbH, Germany, hosts this website and its database on servers in the EU.
• Cloudflare, Inc., USA, protects and speeds up the website (network and security service). Transfers are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.
• Resend, Inc., USA, delivers our transactional emails (order confirmations, password resets, withdrawal acknowledgements). Transfers are covered by the EU Standard Contractual Clauses.
• Banks and payment service providers, to process your payment and refunds; card details are entered on the payment provider's secure page and never stored by us.
• Accountants and public authorities, where required by law.

4. How long we keep data

Order, invoice and payment records are kept for 7 years, as required by the Estonian Accounting Act. Account data is kept until you delete your account. Messages that do not lead to an order are deleted after 2 years. Server logs are deleted after 14 days.

5. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability and to object to processing based on legitimate interest. To exercise these rights, email [email protected]. You also have the right to lodge a complaint with a data protection authority, in particular the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee, or the authority in your own country.

6. Cookies

We only use cookies that are necessary for the shop to work. Details are in our Cookie Policy (EU).

7. Changes

We update this statement when our services change. The date at the top shows the current version.