Who is responsible
Palunix OÜ, Priisle tee 18, 13914 Tallinn, Estonia, is the controller of the personal data described here. For anything about your data, write to [email protected].
What we collect
When you order: your name, delivery and billing address, email address, telephone number if you give one, what you ordered and how you configured it, and the amount paid. We do not see or store your card number.
When you create an account: the same details, plus a password we only keep as an unreadable hash.
When you use the shop: a session cookie, your basket, and your language choice. Our server keeps ordinary access logs with an IP address for a short time, so we can see that the shop is working and being used fairly.
When you subscribe to our letter: your email address, until you unsubscribe.
Why we use it, and on what basis
- To make and deliver your order — because we need it to perform the agreement with you.
- To keep our books — because the law requires us to keep invoices.
- To answer your questions and keep the shop secure — because we have a legitimate interest in doing so, weighed against your privacy.
- To send you our letter — because you asked us to. You can stop it at any time with the link in every message.
We do not profile you, and we do not make automated decisions about you.
Who else sees it
Only the parties that help us run the shop, and only what they need:
- Stripe — to take your payment.
- Posti — to deliver your parcel: your name, address and, for the tracking message, your email address.
- Our email provider — to send order confirmations and our letter.
- Our hosting provider — which keeps the server the shop runs on.
We do not sell your data, and we do not hand it to anyone else, unless a court or the law obliges us to.
Outside the European Union
Some of these parties may process data outside the European Economic Area. Where that happens, it is covered by the European Commission's standard contractual clauses or an adequacy decision, so your data keeps the protection it has here.
How long we keep it
Order and invoice data: seven years, because accounting law requires it. Account data: until you ask us to delete the account. Letter subscriptions: until you unsubscribe. Access logs: a short period, then they are deleted.
Your rights
You may ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to limit what we do with it, ask for it in a portable form, or object to our use of it where we rely on a legitimate interest. Where you gave consent, you may withdraw it at any time; that does not affect what we did before.
Write to [email protected] and we answer within one month. If you think we handle your data badly, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the supervisory authority in the country where you live.
Security
The shop runs over an encrypted connection. Passwords are stored as hashes, payment keys are kept out of the code, and only the people who need access have it.
Changes
If we change this statement, the new version appears here with a new date. For a change that matters to you, we say so by email.