The data controller of the online store www.beebad.ee is Carotenoid OÜ (registry code 10810444), address: Jõeääre tee 22, Harjumaa, phone: +372 5036996, email: baltics@beebad.com.

Personal data being processed:

− Name, phone number, and email address
− Delivery address
− Bank account number
− Information related to purchases and payments (purchase history)
− Customer support data

Purpose of personal data processing:

Personal data is used to manage customer orders and deliver goods.

Purchase history data (purchase date, product, quantity, customer details) is used to generate an overview of purchased goods and services and to analyze customer preferences.

Bank account numbers are used to issue refunds to customers.

Personal data such as email, phone number, and customer name are used to resolve issues related to the provision of goods and services (customer support).
The IP address or other network identifiers of the online store user are processed for the purpose of providing the online store as an information society service and for web usage statistics.

Legal basis:

Personal data is processed for the performance of a contract with the customer.

Personal data is processed for the fulfillment of legal obligations (e.g., accounting and resolving consumer disputes).

Recipients to whom personal data is disclosed:

Personal data is shared with the online store’s customer support for the management of purchases and purchase history and to resolve customer issues.

The name, phone number, and email address are shared with the transport service provider chosen by the customer. If the delivery is via courier, the customer’s address will also be shared.

If the store’s accounting is handled by a service provider, personal data will be transferred to the service provider for accounting purposes. Personal data may also be disclosed to IT service providers if necessary for the functioning of the online store or data hosting.

Security and access to data:

Personal data is stored on servers hosted by zone.ee, located within the territory of EU member states or countries within the European Economic Area. Data may be transferred to countries deemed to have an adequate level of data protection by the European Commission, and to U.S. companies that are part of the Privacy Shield framework.

Access to personal data is granted to the online store’s employees, who may access the data to resolve technical issues related to the use of the online store and to provide customer support.

The online store implements appropriate physical, organizational, and IT security measures to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorized access, or disclosure.

Personal data transfers to authorized processors (e.g., transport service providers and data hosting services) are based on contracts between the online store and these processors. Processors are required to ensure adequate data protection measures when processing personal data.

Accessing and correcting personal data:

Personal data can be accessed and edited via the user profile of the online store. If a purchase was made without creating a user account, personal data can be accessed through customer support.

Withdrawal of consent:

If data processing is based on customer consent, the customer has the right to withdraw consent by contacting customer support via email.

Retention:

Upon closing a customer account, personal data is deleted unless such data must be retained for accounting or consumer dispute resolution purposes.

If a purchase was made without a user account, the purchase history is retained for three years.

In the event of disputes related to payments or consumer issues, personal data is retained until the claim is fulfilled or the limitation period expires.

Personal data required for accounting purposes is retained for seven years.

Deletion:

To request the deletion of personal data, please contact customer support via email. Requests will be answered within one month, along with a clarification of the data deletion timeline.

Data portability:

Requests for data portability submitted via email will be answered within one month.

Customer support will verify identity and inform the customer which personal data will be transferred.

Direct marketing messages:

Email addresses and phone numbers are used for sending direct marketing messages if the customer has given consent. If the customer does not wish to receive such messages, they can unsubscribe via the link at the bottom of the email or contact customer support.

If personal data is processed for direct marketing purposes (profiling), the customer has the right to object at any time to both the initial and further processing of their personal data, including profiling related to direct marketing, by notifying customer support via email (this information must be clearly provided and separate from other information).

Dispute resolution:

Disputes related to personal data processing are resolved through customer support (Inri Rästa, +372 5036996, baltics@beebad.com). The supervisory authority is the Estonian Data Protection Inspectorate (info@aki.ee).

Carotenoid OÜ is the data controller and transfers the personal data necessary for payment processing to the authorized processor Montonio Finance OÜ.