Hortulus OÜ is committed to protecting the privacy of its customers. The company’s online activities are in accordance with all relevant activities and corresponding European Union legislation and the laws of the Republic of Estonia.
PROCESSING OF PERSONAL DATA
The controller of personal data for the Hortulus.ee online store is Hortulus OÜ (registry code 10258627) located at Harju County, Tallinn, Kesklinna district, Pärnu maantee 368, 11612, telephone +372 672 6820 and e-mail address hortulus@hortulus.ee. Hortulus OÜ transfers the personal data necessary for making payments to the authorized processor Maksekeskus AS.
WHAT PERSONAL DATA IS PROCESSED
FOR WHAT PURPOSE IS PERSONAL DATA PROCESSED
Hortulus OÜ is the controller of personal data.
Personal data is used to manage customer orders and for the delivery of goods.
Purchase history data (date of purchase, goods, quantity, customer data) is used to compile overviews of purchased goods and services and to analyze customer preferences.
The bank account number is used to issue refunds to the customer.
Personal data such as e-mail, phone number, and customer name are processed to resolve issues related to the provision of goods and services (customer support).
The IP address of the online store user or other network identifiers are processed for the provision of the online store as an information society service and for generating web usage statistics.
LEGAL BASIS
The processing of personal data is carried out for the purpose of performing the contract concluded with the customer.
The processing of personal data is carried out to fulfill a legal obligation (e.g., accounting and resolution of consumer disputes).
RECIPIENTS TO WHOM PERSONAL DATA IS TRANSFERRED
Personal data is transferred to the online store’s customer support for managing purchases and purchase history and for resolving customer issues.
The name, phone number, and e-mail address are transferred to the transport service provider chosen by the customer. In the case of goods delivered by courier, the customer’s address is also transferred in addition to the contact details.
Personal data may be transferred to information technology service providers if this is necessary to ensure the functionality of the online store or data hosting.
SECURITY AND ACCESS TO DATA
Personal data is stored on the servers of Elkdata OÜ, which are located in the territory of a Member State of the European Union or countries that have joined the European Economic Area. Data may be transferred to countries whose level of data protection has been assessed as adequate by the European Commission and to US companies that have joined the Privacy Shield framework.
Access to personal data is granted to online store employees who can access the personal data to resolve technical issues related to the use of the online store and to provide customer support services.
The online store implements appropriate physical, organizational, and information technology security measures to protect personal data from accidental or unlawful destruction, loss, alteration, or unauthorized access and disclosure.
The transfer of personal data to authorized processors of the online store (e.g., transport service provider and data hosting) takes place on the basis of contracts concluded between the online store and the authorized processors. Authorized processors are required to ensure appropriate safeguards when processing personal data.
ACCESSING AND CORRECTING PERSONAL DATA
Personal data can be accessed and corrections can be made in the online store user profile. If a purchase was made without a user account, personal data can be accessed via customer support.
WITHDRAWAL OF CONSENT
If the processing of personal data is based on the customer’s consent, the customer has the right to withdraw consent by notifying customer support via e-mail.
RETENTION
Upon closing an online store customer account, personal data is deleted, unless such data needs to be retained for accounting purposes or for the resolution of consumer disputes.
If a purchase in the online store was made without a customer account, the purchase history is retained for three years.
In the event of disputes related to payments and consumer disputes, personal data is retained until the claim is satisfied or the limitation period expires.
Personal data necessary for accounting purposes is retained for seven years.
DELETION
To delete personal data, customer support must be contacted via e-mail. A request for deletion will be answered no later than within one month, specifying the period for the deletion of data.
TRANSFER
A request for the transfer of personal data submitted via e-mail will be answered within one month at the latest. Customer support will verify the identity and provide information on the personal data to be transferred.
RESOLUTION OF DISPUTES
The resolution of disputes related to the processing of personal data takes place via customer support by e-mail at hortulus@hortulus.ee. The supervisory authority is the Estonian Data Protection Inspectorate (info@aki.ee).