Privacy policy

1. Controller The controller of personal data in the lelupuoti.fi online store (lelupuoti.fi) is PlayArt OÜ, registry code 12163003, Mustamäe tee 16, 10617 Tallinn, Estonia; info@playart.ee, +372 5560 0912. 2. Data and purposes We process names, contact and delivery details, order data and payment status to fulfil orders and communicate with customers. When an account is created and used, we process authentication and account data, favourites and requests saved through the account. When a review is submitted, we process its content, rating and the name selected for publication. Technical request data may include IP address, browser information and security logs. The legal basis is performance of a contract or steps prior to entering into one. Accounting and tax data are processed to comply with legal obligations. Processing for service security and fraud prevention is based on legitimate interests, balanced against individuals' rights. Consent for consent-based processing may be withdrawn at any time without affecting the lawfulness of earlier processing. Data necessary to fulfil an order must be provided; without them we cannot process the order or provide account services. Leaving optional fields blank does not prevent a purchase. Creating an account does not constitute consent to direct marketing. Newsletter subscriptions are currently inactive. PlayArt OÜ does not make decisions based solely on automated processing that produce legal or similarly significant effects. 3. Recipients and retention We use Supabase for authentication and database services and Purelymail for transactional email. Montonio may receive data where a relevant payment method is selected; the selected carrier receives data needed for delivery. Accounting and other necessary service providers and authorities prescribed by law may also receive data. Account data are retained until account deletion unless law or the handling of legitimate claims requires some data to be retained longer. Source accounting documents are retained for seven years as required by law. Other data are retained for as long as needed for their purpose and applicable requirements. We also use server and IT service providers. Where data are transferred outside the European Economic Area in providing a service, the transfer must comply with the GDPR, for example through an adequacy decision or appropriate safeguards, including standard contractual clauses. Further information about providers and transfer safeguards can be requested from the seller. 4. Your rights Subject to the conditions in law, you may request access, rectification, erasure, restriction and data portability, and object to processing. Contact info@playart.ee; we generally respond within one month, with an extension where permitted by law if necessary. You may complain to the Estonian Data Protection Inspectorate or the competent supervisory authority in your country of residence. Information and complaints: https://www.aki.ee. 5. Cookies and local storage Authentication cookies and browser local storage are described on the cookies page.