Privacy Policy

1. Who processes your data?

The controller of personal data is Müsteeriumite OÜ, registry code 17037645, address Pikk tn 66-11, Rakvere, Estonia.

For questions concerning the processing of personal data, write to info@müsteeriumite.ee. Website: müsteeriumite.ee.

2. What personal data do we process?

The data processed depends on how you interact with us. In particular, we may process:

• your name, email address, and telephone number;
• the service you are interested in and the content of the message or inquiry you send;
• the booking date and time, the selected service, and information about changing or cancelling the booking;
• merchandise order data: the product ordered, colour, size, quantity, order number, and other product information necessary to fulfil the order;
• delivery data, such as the name of the parcel machine, telephone number, and, where necessary, the delivery address;
• the payment amount, status, transaction identifier, and other information necessary to arrange the payment;
• technical data related to use of the website, such as the IP address, technical information about the browser and device, and server logs, to the extent necessary for the secure and reliable operation of the website.

Card details are entered in Stripe's payment environment. Müsteeriumite OÜ does not receive or store your complete payment card details.

3. Providing personal or sensitive information

Some services may concern personal relationships, family life, working life, or other topics that are sensitive for an individual. Please do not provide health data or other special categories of personal data in booking and contact forms unless this is unavoidably necessary for the specific service.

4. For what purposes and on what legal basis do we process data?

Responding to inquiries. We process contact and inquiry data to respond to an inquiry and, where necessary, to take steps prior to entering into a contract.

Booking and providing services. We process booking and contact data for the performance of a contract or to take steps at your request prior to entering into a contract.

Fulfilling merchandise orders. We process order, contact, and delivery data for the performance of a contract for the sale of goods, including preparing, producing, printing, assembling, and delivering the order and resolving returns and complaints.

Payments and accounting. We process payment and transaction data for the performance of a contract and compliance with accounting and tax obligations.

Website security. We process necessary technical information on the basis of legitimate interest to ensure the reliable operation of the website and to prevent misuse and security risks.

Web analytics. We use Google Analytics 4 only on the basis of the user's consent. Analytics cookies and related technologies are not activated before the user has given consent.

5. Google Calendar and Google Workspace

We use Google Calendar Appointment Scheduling to book services and Google Workspace for professional communications and calendar management. Data entered when making a booking is processed to arrange the booking and may be visible in Google's environment to the extent necessary to provide the service.

6. Stripe and payments

Electronic payments are processed by Stripe. For payment and fraud-prevention purposes, Stripe may process, for example, your name, email address, payment amount, payment instrument data, technical transaction data, and, for merchandise orders, the selections and delivery information collected in Stripe Checkout.

Müsteeriumite OÜ does not receive or store your complete payment card details.

7. Printing partner and order fulfilment

We use a printing partner to produce and/or dispatch merchandise products. To fulfil an order, we may provide the printing partner only with necessary data, such as:

• the customer's name;
• telephone number and, where necessary, email address;
• the parcel machine or other address information necessary for delivery;
• the product ordered, colour, size, and quantity;
• the order or shipment reference number.

The printing partner may use this data only to the extent necessary to produce, assemble, and/or dispatch the order to the customer, unless the partner has a separate legal obligation or an independent legal basis for certain processing.

If the printing partner acts as a processor on behalf of Müsteeriumite OÜ, the obligations relating to the processing of personal data are governed by an appropriate agreement or data-processing terms.

8. Logistics and delivery partners

To deliver goods, the customer's name, telephone number, parcel machine or address, and technical information related to the shipment may, to the necessary extent, be provided to the logistics service provider. This data is used to deliver the order and provide delivery information.

9. Web hosting and technical service providers

The website is hosted by Zone Media OÜ. We may use Cloudinary to deliver website images and other media content. Service providers process data only to the extent necessary to provide and secure their technical services.

10. To whom may we disclose data?

Personal data may, to the necessary extent, be processed by Müsteeriumite OÜ and our service providers, including Google, Stripe, Zone Media OÜ, Cloudinary, the printing partner, the logistics or parcel-delivery service provider, and, where necessary, the accounting service provider.

We do not sell or rent personal data to third parties.

11. Transferring data outside the European Economic Area

Some of the service providers we use are international companies, and in certain cases personal data may be processed outside the European Economic Area. In such cases, appropriate safeguards provided for in the GDPR are used, such as an adequacy decision by the European Commission or standard contractual clauses.

12. How long do we retain data?

• general inquiries and correspondence are generally retained for up to 2 years after the last substantive contact, unless there is a reason to retain them for longer;
• data related to a service booking and performance of a contract is generally retained for up to 3 years after the service is provided or the contract ends, if it may be required to bring or defend claims;
• data related to fulfilment of a merchandise order, a return, or a complaint is generally retained for up to 3 years after the order is fulfilled or the matter is finally resolved, unless a longer retention period is required by law;
• source accounting documents and related mandatory data are retained for at least 7 years after the end of the relevant financial year, unless a longer period is required by law.

13. Google Analytics and cookies

We use Google Analytics 4 to understand how the website is used and to improve the website and our services. Google Analytics is activated only after the user has given consent to analytics cookies. Analytics cookies are disabled by default and are not activated before consent is given.

14. Your rights

Depending on the legal basis and circumstances of the processing, you may have the right to receive information about the processing of your personal data, access your data, request correction of inaccurate data, request erasure or restriction of processing, object to processing, exercise the right to data portability, and, where processing is based on consent, withdraw consent at any time.

To exercise your rights, write to info@müsteeriumite.ee.

15. Right to lodge a complaint

If you believe that your personal data has been processed unlawfully, you may first contact us. You also have the right to lodge a complaint with the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate).

Andmekaitse Inspektsioon · Tatari 39, 10134 Tallinn · info@aki.ee · aki.ee

16. Changes to the Privacy Policy

We may change the Privacy Policy if our services, sales arrangements, service providers, or legal requirements change. The current version will be published on the website, and the date of the latest update will be shown at the beginning of the policy.