Privacy notice

Who is responsible for your data

The controller is Tammiko Pagar OÜ. For data protection questions, write to [email protected] or call 5569 8134.

What data we collect

• Order data: name, phone, email, ordered products and packaging, preferred date, how you receive the order, whether you order as a company, and your wishes and notes.
• Technical data: IP address and browser information to keep the website secure and prevent abuse.

Why we use your data

We use your data only to fulfil your order: to receive and confirm it, to agree on the details and payment, and to send messages about the order. The legal basis is the contract and the steps taken before entering into it (Article 6(1)(b) of the General Data Protection Regulation).

We use technical data on the basis of legitimate interest (Article 6(1)(f)) to keep the website secure. Your data is not used for marketing or sold to anyone.

Who we share data with

We use trusted service providers who process data only on our instructions:

• DigitalOcean: hosting for the website and database (servers in the European Union).
• Cloudflare: website protection and performance.
• Resend: sending emails about your order.

We disclose data to authorities only when required by law.

Transfers outside the European Union

Cloudflare and Resend are US companies. For data transfers they rely on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.

How long we keep data

We keep order data for up to 3 years after the order is fulfilled to deal with any questions or claims. Accounting documents are kept for the period required by law (7 years). Technical logs are kept for up to 30 days.

Cookies and browser storage

The public website does not use tracking or advertising cookies. The products you choose are stored only in your own browser so that your selection is not lost when you open the page again. They reach us only when you send your order.

Your rights

You have the right to:

• access your data and receive a copy of it;
• have incorrect data corrected;
• have your data erased if we are not required by law to keep it;
• object to or request restriction of processing;
• lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee).

To exercise your rights, write to [email protected].