PROCESSING OF PERSONAL DATA

The controller of personal data in the online store VGANTON.EE is V&G ANTON OÜ (registry code 11927668), located at Maakri 19, 10145 TALLINN, Estonia.

Personal Data Processed

− name, phone number and e-mail address
− delivery address
− bank account number
− price of goods and services and data related to payments (purchase history)
− customer support data

1. Purpose of Processing Personal Data

1.1. Personal data is used to manage customer orders and deliver goods.
1.2. Purchase history data (purchase date, product, quantity, customer information) is used to prepare an overview of purchased goods and services and to analyze customer preferences.
1.3. The bank account number is used for refunding payments to the customer.
1.4. Personal data such as e-mail, phone number and customer name are processed to resolve issues related to the provision of goods and services (customer support).
1.5. The online store user’s IP address or other network identifiers are processed for providing the online store as an information society service and for website usage statistics.
1.6. V&G ANTON OÜ is the controller of personal data, but transmits the personal data necessary for payment processing to the authorized processor Maksekeskus AS.

2. Legal Basis

2.1. Personal data is processed for the purpose of fulfilling a contract concluded with the customer.
2.2. Personal data is processed for the purpose of complying with legal obligations (e.g., accounting and resolving consumer disputes).

3. Recipients of Personal Data

3.1. Personal data is transmitted to the online store’s customer support for managing purchases and purchase history and for resolving customer issues.
3.2. The customer’s name, phone number and e-mail address are forwarded to the delivery service provider chosen by the customer. If the goods are delivered by courier, the customer’s address is also forwarded.
3.3. If the online store’s accounting is handled by a service provider, personal data is transmitted to the service provider for performing accounting operations.
3.4. Personal data may be transmitted to IT service providers if necessary to ensure the functionality of the online store or data hosting.

4. Security and Access to Data

4.1. Personal data is stored on servers located in EU member states or EEA countries. Data may be transferred to countries whose data protection level has been deemed adequate by the European Commission, and to US companies that are part of the Privacy Shield framework.
4.2. Access to personal data is granted to online store employees who need the data to resolve technical issues related to the use of the online store or to provide customer support.
4.3. The online store implements appropriate physical, organizational and IT security measures to protect personal data from accidental or unlawful destruction, loss, alteration or unauthorized access and disclosure.
4.4. Transmission of personal data to authorized processors (e.g., delivery service providers or hosting providers) takes place under agreements concluded between the online store and the processors. Authorized processors are required to ensure adequate protection measures when processing personal data.

5. Accessing and Correcting Personal Data

5.1. Personal data can be accessed and corrected in the user profile of the online store. If a purchase was made without a user account, the data can be accessed through customer support.

6. Withdrawal of Consent

6.1. If personal data is processed based on customer consent, the customer has the right to withdraw this consent by notifying customer support via e-mail.

7. Retention

7.1. Upon closing the online store account, personal data is deleted unless it is required to be retained for accounting or resolving consumer disputes.
7.2. If a purchase is made without a customer account, the purchase history is retained for three years.
7.3. In case of disputes related to payments or claims, personal data is stored until the claim is fulfilled or until the expiration of the limitation period.
7.4. Personal data required for accounting is stored for seven years.

8. Deletion

8.1. To delete personal data, the customer must contact customer support by e-mail. A response to the deletion request will be provided within one month, specifying the data deletion timeframe.

9. Data Portability

9.1. Requests for personal data portability submitted by e-mail will be answered within one month.
9.2. Customer support verifies the customer’s identity and provides the personal data eligible for transfer.

10. Direct Marketing

10.1. The e-mail address and phone number are used for sending direct marketing messages if the customer has given consent. The customer can opt out by using the link in the footer of the e-mail or by contacting customer support.
10.2. If personal data is processed for direct marketing purposes (including profiling), the customer has the right to object at any time to the processing of their personal data, including profiling related to direct marketing, by notifying customer support via e-mail. This information must be clearly presented, separate from other content.

11. Dispute Resolution11.1. Disputes related to personal data processing are resolved through customer support at info@vganton.ee
Supervisory authority: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) — info@aki.ee