Data Protection Terms
The controller responsible for processing personal data for the online store elembeer.ee is Elembeer Pruulikoda OÜ (registry code 17 089 808), located at Harju maakond, Tallinn, Lasnamäe linnaosa, Suur-Sõjamäe tn 14, 11415, phone +372 505 0890, and email info@elembeer.ee.

What personal data we process

• Name, phone number, and email address;
• Company name;
• Delivery address;
• Bank account number;
• Value of goods and services, and payment-related data (purchase history);
• Customer support data;
• IP address.

Purpose of processing personal data
Personal data is used to manage customer orders and deliver goods.
Purchase history data (date of purchase, item, quantity, customer data) is used to compile an overview of purchased goods and services, analyze customer preferences, and also for resolving consumer disputes.
The bank account number is used to refund the customer.
Personal data such as email address, phone number, and customer name are processed to resolve issues related to goods and services (customer support) and to contact the customer upon their request via the contact form.
Email is also used to send invoices, and the phone number is used to notify about the arrival of goods at a parcel machine.
The IP address or other network identifiers of the online store user are processed for providing the online store services as information society services and for compiling website usage statistics.

Legal Basis
Processing of personal data is carried out for the performance of a contract concluded with the customer (managing customer orders, delivery, returns, and payments).
Processing of personal data is carried out to fulfill a legal obligation (e.g., accounting).
Processing of data is carried out with the customer's consent for the following activities:

• Profiling;
• Direct marketing.

Recipients of personal data
Name, phone number, and email address are transmitted to the transport service provider chosen by the customer. If the goods are delivered by courier, the customer's address is also transmitted in addition to contact details.
Personal data is transmitted to the accounting service provider for accounting operations.
Personal data may be transmitted to information technology service providers if necessary to ensure the functionality of the online store or data storage.

Security and access to data
Personal data is stored on the tilda.cc platform, which uses the services of data center providers located in the UAE and in countries that ensure an adequate level of protection for the rights of data subjects, and with whom agreements have been concluded guaranteeing the security of the processed personal data: Hetzner; GCore.
Employees of the online store have access to personal data and may view it to resolve technical issues related to the use of the online store and to provide customer support services.
The online store implements appropriate physical, organizational, and IT security measures to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorized access, and disclosure, namely:

• Data exchange with the online store is conducted via an encrypted connection (TLS);
• Customer passwords are stored in encrypted form (hashes);
• Standard encryption is used when sending emails.

The transfer of personal data from authorized processors of the online store to a recipient (e.g., transport service provider and web hosting) is based on contracts concluded between the online store and the authorized processors. When processing personal data, authorized processors undertake to guarantee the application of appropriate protective measures in accordance with Article 28 of the General Data Protection Regulation.

Accessing and rectifying personal data
Personal data can be viewed and edited in the online store user profile or via customer support. If a purchase was made without creating a user account, personal data can be viewed via customer support. If a request for access to personal data was submitted electronically, the information is also provided via commonly used electronic channels.

Withdrawal of consent
If the processing of personal data is based on the customer's consent, the customer has the right to withdraw it in the customer account settings or by notifying customer support via email.

Retention
When a customer's online store account is closed, personal data is deleted, except for personal data (purchase history data) that must be retained for accounting purposes or resolving consumer disputes.
In the case of disputes related to payments and consumer disputes, personal data is retained until the claim is fulfilled or until the expiry of the limitation period.
Personal data contained in accounting source documents is retained for seven years.

Restriction
The customer has the right to request restriction of the processing of their personal data if the data is inaccurate or incomplete, or if their personal data is processed unlawfully.

Objections
The customer has the right to object to the processing of their personal data if they have reason to believe that there is no legal basis for processing their personal data.

Deletion
To delete personal data, please contact customer support via email. A response to a request for deletion of personal data is provided within one month at the latest, specifying the data deletion period. The response also indicates which personal data will not be deleted, along with the legal basis and reason.

Portability
A response to a request for portability of personal data submitted via email is provided within one month at the latest. Customer support verifies the identity of the requester and communicates the personal data subject to portability.

Direct marketing messages
Email address and phone number are used for sending direct marketing messages if the customer has given corresponding consent. If the customer does not wish to receive direct marketing messages, they should click the relevant link at the bottom of the email or contact customer support.
If personal data is processed for direct marketing purposes (profiling), the customer has the right to object at any time to the initial and subsequent processing of their personal data, including profiling related to direct marketing, by notifying customer support via email (the relevant information must be provided explicitly and separately from any other information).

Dispute Resolution
Disputes related to the processing of personal data are resolved through customer support (phone +372 505 0890 and email info@elembeer.ee). The supervisory authority is the Estonian Data Protection Inspectorate (info@aki.ee).