Privacy policy

  1. General provisions

1.1. This privacy policy explains how ZRN OÜ (the controller) collects, processes and stores personal data in the sauh.ee online shop. It is an informative document and is not part of the sales contract.

1.2. A data subject under this privacy policy is a customer or other natural person whose personal data the controller processes.

1.3. A customer under this privacy policy is anyone who buys goods or services from the controller’s website, creates a user account or subscribes to the newsletter.

1.3.1. Data of a person who sends an enquiry via the contact form, email or phone (name, email address, message content) is processed only to reply to the enquiry and is not used for marketing without separate consent.

1.3.2. A user account (My account) is optional. You can also buy as a guest. When creating an account we process email address, name, shipping and billing addresses, saved parcel locker, order history and login data. The legal basis is performance of a contract or steps prior to entering into a contract (GDPR Art. 6(1)(b)).

1.3.3. Sending the newsletter and offers needs separate consent. Consent can be given at checkout, when registering, on the newsletter form or in My account settings. You can withdraw consent any time on the My account home page (the “Newsletter” tick box), via the email instructions, or by writing to info@sauh.ee. Creating an account does not require joining the newsletter — you can untick the box before registering or later.

1.4. The controller follows the data-processing principles set out in law and, among other things, processes personal data lawfully, fairly and securely.

 

  1. Collection, processing and storage of personal data

2.1. Personal data that the controller collects, processes and stores is collected electronically, mainly via the website and email.

2.2. Data is processed only for the purposes and legal bases named in this privacy policy. The data subject is informed about processing before submitting data (e.g. order, account, newsletter, cookies).

2.3. The data subject is responsible for ensuring that data they submit is accurate, correct and complete. The data subject must promptly notify the controller of any changes to submitted data.

2.4. The controller is not liable for damage to the data subject or third parties caused by the data subject submitting incorrect data.

 

  1. Processing of customers’ personal data

3.1. The controller may process the following personal data of the data subject:

3.1.1. First and last name;

3.1.2. Phone number;

3.1.3. Email address;

3.1.4. Delivery and billing address;

3.1.5. Selected parcel locker or delivery method;

3.1.6. Order, payment and return data;

3.1.7. User account data (including login);

3.1.8. Payment card data is processed at the payment service provider; the controller does not store the full card number on its own server.

3.2. In addition, the controller may collect customer data available in public registers when needed to perform a contract or a legal obligation.

3.3. The legal basis for processing personal data is GDPR Art. 6(1)(a), (b), (c) and (f):

  1. a) the data subject has given consent to process their personal data for one or more specific purposes (e.g. newsletter, analytics and advertising cookies);
  2. b) processing is necessary for performance of a contract with the data subject or for steps prior to entering into a contract (e.g. order, account, delivery);
  3. c) processing is necessary for compliance with a legal obligation of the controller (e.g. accounting, tax);
  4. f) processing is necessary for the legitimate interests of the controller or a third party (e.g. fraud prevention, service security), except where those interests are overridden by the interests or fundamental rights of the data subject.

3.4. Personal data processing by purpose:

3.4.1. Purpose – security. Retention: up to 12 months after the last relevant event, or longer if required by law.

3.4.2. Purpose – order processing and customer communication. Retention: during order fulfilment and thereafter until claim, withdrawal or warranty periods expire.

3.4.3. Purpose – user account. Retention: until the account is deleted or the customer asks for data to be removed, except data that must be kept by law.

3.4.4. Purpose – finance and accounting. Retention: generally 7 years under accounting and tax rules.

3.4.5. Purpose – marketing (newsletter, offers). Retention: until consent is withdrawn or you opt out.

3.5. The controller may share personal data with processors and service providers needed to run the shop: hosting and shop platform, payment services (including Stripe and Swedbank bank links), transport and parcel-locker services (e.g. UNISEND, Omniva, Smartposti, DPD), accounting, email sending, and analytics/advertising only with consent. Data is shared only to the extent needed to provide the service.

3.6. When processing and storing personal data, the controller applies organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure and any other unlawful processing.

3.7. If data is processed outside the European Economic Area, the controller ensures appropriate safeguards (e.g. European Commission standard contractual clauses) where the service provider’s location requires it.

 

  1. Cookies and tracking

4.1. The controller uses the following cookies and tracking tools on the site:

Necessary cookies (always active):

  • sauh_cookie_consent – storing your consent (1 year)
  • woocommerce_cart_hash – shopping cart data (session)

Analytics (based on consent):

  • Google Analytics (_ga, _gid) – visitor behaviour analysis (2 years) – tracks page visits and user experience
  • Microsoft Clarity (_clck, _clsk, CLID) – user experience analysis (up to 12 months) – tracks movement on the page and user behaviour for the purpose of improving the page
  • sauh_cf_vid – product filter usage statistics (1 year) – recognises a returning visitor in order to measure which product categories and types are searched for most with the filter

Advertising and conversion (based on consent):

  • Google Ads (AW-16513125748) – purchase conversion tracking (1 year) – tracks which ads lead to purchases
  • Facebook Pixel – measuring the performance of Facebook ads (1 year) – tracks user activity after a click

4.2. The data subject can control cookies via the consent banner on the site. The user can change preferences at any time or disable all tracking cookies.

4.3. More information about tracking tools:

4.4. In addition to the cookies listed above, the data controller uses the website's search engine and the product advisor chatbot, both of which collect anonymous usage statistics without installing a separate tracking cookie and without linking the search term or conversation content to a person: the search engine stores the search terms entered and the time of entry in order to improve the product range and search results; the chatbot stores only the number of openings, questions and successful answers and the general topic of the question, never the wording of the question, the IP address or a user identifier.

 

  1. Data subject rights

5.1. The data subject has the right to access their personal data and to review it.

5.2. The data subject has the right to receive information about the processing of their personal data.

5.3. The data subject has the right to complete or correct inaccurate data.

5.4. If the controller processes the data subject’s personal data on the basis of consent, the data subject may withdraw consent at any time (including newsletter and cookie/tracking consent). Withdrawal does not affect the lawfulness of processing before withdrawal.

5.5. The data subject has the right to request erasure (“right to be forgotten”), restriction of processing, data portability, and to object to processing based on legitimate interest, except where data must be kept due to legal obligations or contract performance.

5.6. To delete a user account or make a data enquiry, contact info@sauh.ee. Deleting an account does not automatically erase order data needed for accounting.

5.7. To exercise these rights, the data subject can contact shop support at info@sauh.ee.

5.8. To protect their rights, the data subject may lodge a complaint with the Estonian Data Protection Inspectorate:

Data Protection Inspectorate
E-post: info@aki.ee
Telefon: +372 612 8200
Veebisait: https://www.aki.ee/

 

  1. Final provisions

6.1. These data protection terms are drawn up in line with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Estonian Personal Data Protection Act and other relevant Estonian and EU law.

6.2. The controller may change these data protection terms in part or in full, notifying data subjects of changes via the sauh.ee website.

 

Contact / controller:
ZRN OÜ
Registry code: 17144921
Business address: Mustvee mnt 17, 48305 Jõgeva, Jõgeva parish, Jõgeva county, Estonia
Email: info@sauh.ee
Telefon: +372 58126428

Last updated: 2026-10-13