1. The chief processor of personal data is OÜ Tharapita Design (E.Kitse 8, Tartu, registry code 12813033). Andmekaitse spetsialist on määratud Kaupo Noormaa, e-maili aadressiga kaupo[at]tharapita.eu

2. The processing of personal data is subject to the legislation of Estonia and the European Union.

3. The controller collects the following personal information: name, gender, birthday, personal identification code, phone number, e-mail and purchase history.

4. Among others, personal data is collected and processed for the following purposes: to make purchase analyses, to sell goods and provide services, to serve the client’s loyalty program. The controller has the right to query, analyze, sort, and take samples of personal data in the database.

5. The controller does not disclose the information received by him to third parties. Tharapita Design OÜ services, incl. digital services, are not directed towards children under 13.

6. By joining the client program, the client gives consent to the processing of his/her personal data. Personal data transmitted to the controller is protected and treated as confidential information, including information stored on the customer and his/her orders stored in the e-store order environment. The data communication between the client and the banks and the card payment center is encrypted, which ensures the security of the customer’s personal data and bank details. The data controller does not have access to client confidential bank and payment card requisitions.

7. The data controller will implement all measures, including information technology and organizational measures, for the protection of the personal data collected. Access to data editing and processing is restricted to authorized persons.

8. OÜ Tharapita Design may authorize other legal entities (authorized processors) to process personal data, provided that an agreement has been entered with such a processor under which the processor is required to keep the personal data processed as confidential and to ensure the protection of personal data in accordance with the requirements provided by law. Such authorized processors are cash register software service providers, software development partners, logistics service providers and marketing service providers.

OÜ Tharapita Design informs the client of the up-to-date list of authorized processors of legal entities based on the client’s request, submitted in writing to OÜ Tharapita Design at E.Kitse 8, 51011 Tartu or by e-mail kaupo[at]tharapita.eu

10. The customer has the right to get information and check his/her personal data, request access to the personal data, request corrections to the personal data, request limiting the personal data, request the deletion of personal data, request the transfer of personal data, rights relating to the automated processing of data, right to an evaluation by a supervisory authority. The customer also has a right to renege on his/her permission to process personal data. Teabe saamiseks ja tutvumiseks esitab klient vastava kirjaliku taotluse aadressile kaupo[at]tharapita.eu

11. The controller of personal data may send newsletters to the client, including satisfaction surveys and offers to the client’s e-mail address or via SMS only if the client has given prior consent at the time of joining the client program or in the self-service environment.

12. The customer can opt-out of the sent offers and newsletters at any time by notifying him via e-mail at kaupo​​​[at]​​​tharapita.eu or by following the instructions in the e-mail.

13. At any time, the customer can consult his personal data or partially change them by sending the corresponding request to the address kaupo[at]tharapita.eu. To delete collected personal data, the customer submits a corresponding written request to the address kaupo[at]tharapita.eu

14. The data subject has the right to file a complaint with OÜ Tharapita Design’s data protection officer, the Data Protection Inspectorate or the court if the data subject believes that his rights have been violated in the processing of personal data. The contact details of the Data Protection Authority (AKI) can be found on the website of the AKI at:http://www.aki.ee/et/inspektsioon/kontaktid-nouandetelefon.

15. The data controller changes and/or deletes the client data after the client has been identified.

16. The deadline for maintaining client’s personal data is five years from the last purchase.

17. In the event of personal data being processed for a new purpose, different from the purpose for which the data was initially collected, or if collection of the data is not based on the subject’s consent, Tharapita Design OÜ will carefully consider the permissibility of such processing. In order to determine whether processing of personal data for a new purpose is compliant with the purpose for which the personal data was initially collected, Tharapita Design OÜ will, among other things, consider:

(1) Connections between the purposes for which the personal data was collected and the purposes of the intended further processing;

(2) The context of collection of the personal data, primarily the connection between the data subject and Tharapita Design OÜ;

(3) The type of the personal data;

(4) The potential consequences of the intended further processing for the data subjects;

(5) Existence of relevant security measures. OÜ Tharapita Design may unilaterally change the privacy policy by notifying the Customer thereof at least 2 weeks in advance.

OÜ Tharapita Design may make unilateral amendments to the terms and conditions of the privacy policy pursuant to the law. Any amendments will be communicated by OÜ Tharapita Design to the data subjects on the website of OÜ Tharapita Design or in another manner.

18. OÜ Tharapita Design AS uses cookies on its website incl. those by Google Analytics and Hotjar by informing customers of this practice and asking for the customers’ permission.