Privacy Policy — processing of personal data

Data controller

The controller responsible for processing personal data is Dolores OÜ, registry code 10377778, address Valge tn 13, 11415 Tallinn, Estonia.

For questions concerning personal data, please contact dolores@dolores.ee or call +372 644 2440.

What personal data we process

Dolores OÜ may process the following personal data:

• name, email address, telephone number, delivery address and billing address;
• selected parcel terminal, order contents, payment status and purchase history;
• customer account information if the customer creates an account in the online store;
• customer communication data, such as emails, enquiries and information relating to returns;
• technical data, such as IP address, device and browser information, cookie data and website usage data.

Dolores OÜ does not store customers' complete bank card details. Card payments and other payments are processed by the relevant payment service providers.

Purposes and legal bases for processing

Personal data is primarily processed for receiving and fulfilling orders, arranging payments, providing delivery, handling returns and complaints, and providing customer service. The legal basis for such processing is the performance of a contract or taking steps prior to entering into a contract.

Order and invoice data is processed in order to comply with accounting and tax obligations on the basis of a legal obligation.

Technical data may be processed on the basis of Dolores OÜ's legitimate interests in order to ensure the operation and security of the website, identify errors and prevent fraud.

Direct marketing, newsletters and marketing cookies are used on the basis of the customer's consent where consent is required by law.

Disclosure of personal data to third parties

Dolores OÜ discloses personal data only to the extent necessary to fulfil an order, operate the online store or comply with legal obligations.

• to payment service providers for processing payments;
• to delivery partners, including Smartpost, for delivering goods;
• to IT, web hosting and online store technical service providers;
• to accounting and financial service providers;
• to public authorities where disclosure of data is necessary to comply with a legal obligation.

Dolores OÜ does not sell or rent customers' personal data to third parties.

Cookies and analytics

The website may use cookies that are necessary for the operation of the online store, use of the shopping cart, improvement of the user experience, collection of statistics and marketing activities.

Necessary cookies are used to ensure the proper functioning of the website. Analytics and marketing cookies are generally used on the basis of the customer's consent where required by law.

Customers can manage the use of cookies through the cookie management solution displayed on the website or through their browser settings.

Retention of personal data

Dolores OÜ retains personal data only for as long as necessary to fulfil the purpose for which it was collected or to comply with legal obligations.

• accounting data relating to orders and invoices is generally retained for 7 years in accordance with accounting requirements;
• customer account data is retained until the account is deleted, unless the data must be retained on a legal basis or for the establishment, exercise or defence of legal claims;
• data relating to customer communications and complaints is retained for as long as necessary to resolve the enquiry or protect against possible claims;
• marketing data is retained until consent is withdrawn or the customer unsubscribes from marketing communications.

Customer rights

Customers have the right to obtain information about the processing of their personal data, request access to their data, request correction of inaccurate data, request deletion or restriction of processing, object to processing, and request data portability where applicable.

If the processing of personal data is based on consent, the customer has the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise these rights, please email dolores@dolores.ee. If a customer believes that their personal data has been processed unlawfully, they have the right to lodge a complaint with the Estonian Data Protection Inspectorate.

Security and changes to the Privacy Policy

Dolores OÜ implements reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction.

Dolores OÜ reserves the right to amend this Privacy Policy if legislation, the operation of the online store or the principles governing personal data processing change. The current Privacy Policy is published on the website https://dolores.ee/.