{"id":103,"date":"2022-10-13T10:55:21","date_gmt":"2022-10-13T10:55:21","guid":{"rendered":"https:\/\/sauh.ee\/?page_id=103"},"modified":"2026-10-12T22:04:24","modified_gmt":"2026-10-12T22:04:24","slug":"privaatsuspoliitika","status":"publish","type":"page","link":"https:\/\/sauh.ee\/en\/privaatsuspoliitika\/","title":{"rendered":"Privacy policy"},"content":{"rendered":"
    \n
  1. General provisions<\/span><\/li>\n<\/ol>\n

    1.1. This privacy policy explains how ZRN O\u00dc (the controller) collects, processes and stores personal data in the sauh.ee online shop. It is an informative document and is not part of the sales contract.<\/span><\/p>\n

    1.2. A data subject under this privacy policy is a customer or other natural person whose personal data the controller processes.<\/span><\/p>\n

    1.3. A customer under this privacy policy is anyone who buys goods or services from the controller\u2019s website, creates a user account or subscribes to the newsletter.<\/span><\/p>\n

    1.3.1. Data of a person who sends an enquiry via the contact form, email or phone (name, email address, message content) is processed only to reply to the enquiry and is not used for marketing without separate consent.<\/span><\/p>\n

    1.3.2. A user account (My account) is optional. You can also buy as a guest. When creating an account we process email address, name, shipping and billing addresses, saved parcel locker, order history and login data. The legal basis is performance of a contract or steps prior to entering into a contract (GDPR Art. 6(1)(b)).<\/span><\/p>\n

    1.3.3. Sending the newsletter and offers needs separate consent. Consent can be given at checkout, when registering, on the newsletter form or in My account settings. You can withdraw consent any time on the My account home page (the \u201cNewsletter\u201d tick box), via the email instructions, or by writing to info@sauh.ee. Creating an account does not require joining the newsletter \u2014 you can untick the box before registering or later.<\/span><\/p>\n

    1.4. The controller follows the data-processing principles set out in law and, among other things, processes personal data lawfully, fairly and securely.<\/span><\/p>\n

     <\/p>\n

      \n
    1. Collection, processing and storage of personal data<\/span><\/li>\n<\/ol>\n

      2.1. Personal data that the controller collects, processes and stores is collected electronically, mainly via the website and email.<\/span><\/p>\n

      2.2. Data is processed only for the purposes and legal bases named in this privacy policy. The data subject is informed about processing before submitting data (e.g. order, account, newsletter, cookies).<\/span><\/p>\n

      2.3. The data subject is responsible for ensuring that data they submit is accurate, correct and complete. The data subject must promptly notify the controller of any changes to submitted data.<\/span><\/p>\n

      2.4. The controller is not liable for damage to the data subject or third parties caused by the data subject submitting incorrect data.<\/span><\/p>\n

       <\/p>\n

        \n
      1. Processing of customers\u2019 personal data<\/span><\/li>\n<\/ol>\n

        3.1. The controller may process the following personal data of the data subject:<\/span><\/p>\n

        3.1.1. First and last name;<\/span><\/p>\n

        3.1.2. Phone number;<\/span><\/p>\n

        3.1.3. Email address;<\/span><\/p>\n

        3.1.4. Delivery and billing address;<\/span><\/p>\n

        3.1.5. Selected parcel locker or delivery method;<\/span><\/p>\n

        3.1.6. Order, payment and return data;<\/span><\/p>\n

        3.1.7. User account data (including login);<\/span><\/p>\n

        3.1.8. Payment card data is processed at the payment service provider; the controller does not store the full card number on its own server.<\/span><\/p>\n

        3.2. In addition, the controller may collect customer data available in public registers when needed to perform a contract or a legal obligation.<\/span><\/p>\n

        3.3. The legal basis for processing personal data is GDPR Art. 6(1)(a), (b), (c) and (f):<\/span><\/p>\n

          \n
        1. a) the data subject has given consent to process their personal data for one or more specific purposes (e.g. newsletter, analytics and advertising cookies);<\/span><\/li>\n
        2. b) processing is necessary for performance of a contract with the data subject or for steps prior to entering into a contract (e.g. order, account, delivery);<\/span><\/li>\n
        3. c) processing is necessary for compliance with a legal obligation of the controller (e.g. accounting, tax);<\/span><\/li>\n
        4. f) processing is necessary for the legitimate interests of the controller or a third party (e.g. fraud prevention, service security), except where those interests are overridden by the interests or fundamental rights of the data subject.<\/span><\/li>\n<\/ol>\n

          3.4. Personal data processing by purpose:<\/span><\/p>\n

          3.4.1. Purpose \u2013 security. Retention: up to 12 months after the last relevant event, or longer if required by law.<\/span><\/p>\n

          3.4.2. Purpose \u2013 order processing and customer communication. Retention: during order fulfilment and thereafter until claim, withdrawal or warranty periods expire.<\/span><\/p>\n

          3.4.3. Purpose \u2013 user account. Retention: until the account is deleted or the customer asks for data to be removed, except data that must be kept by law.<\/span><\/p>\n

          3.4.4. Purpose \u2013 finance and accounting. Retention: generally 7 years under accounting and tax rules.<\/span><\/p>\n

          3.4.5. Purpose \u2013 marketing (newsletter, offers). Retention: until consent is withdrawn or you opt out.<\/span><\/p>\n

          3.5. The controller may share personal data with processors and service providers needed to run the shop: hosting and shop platform, payment services (including Stripe and Swedbank bank links), transport and parcel-locker services (e.g. UNISEND, Omniva, Smartposti, DPD), accounting, email sending, and analytics\/advertising only with consent. Data is shared only to the extent needed to provide the service.<\/span><\/p>\n

          3.6. When processing and storing personal data, the controller applies organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure and any other unlawful processing.<\/span><\/p>\n

          3.7. If data is processed outside the European Economic Area, the controller ensures appropriate safeguards (e.g. European Commission standard contractual clauses) where the service provider\u2019s location requires it.<\/span><\/p>\n

           <\/p>\n

            \n
          1. Cookies and tracking<\/span><\/li>\n<\/ol>\n

            4.1. The controller uses the following cookies and tracking tools on the site:<\/span><\/p>\n

            Necessary cookies (always active):<\/strong><\/p>\n