T@C Company Limited OÜ (hereinafter also referred to as "we" or "Our Company") is committed to protecting your privacy and processing your personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR). In this document, we explain what data we collect, for what purposes we use it, to whom we transfer it, and what rights you have regarding your personal data.
1. Purposes of Customer Data Processing and Legal Bases
T@C Company Limited OÜ processes your personal data solely for specific, pre-defined, and legitimate purposes, based on the following legal grounds:
For the performance of a contract concluded with you and pre-contractual measures
- Purpose: Data processing is necessary for the performance of our contractual obligations (e.g., order processing, product delivery, service provision) or for taking steps at your request prior to entering into a contract.
- Legal Basis: Necessity for the performance of a contract or for the implementation of pre-contractual measures at your request.
For improving services, conducting research, and market analysis
- Purpose: Provision of additional services, conducting customer satisfaction surveys, market analysis, statistics collection, and new product development.
- Legal Bases:
- Your consent (in cases where it is required, for example, for certain types of direct marketing).
- The legitimate interest of T@C Company Limited OÜ, aimed at continuously improving our products and services, enhancing user experience, and developing innovative solutions.
For the protection of our rights and prevention of abuse
- Purpose: Protection of our violated or disputed rights (e.g., in court proceedings), prevention, limitation, and investigation of abuse, as well as unlawful use of our services and products.
- Legal Bases:
- The legitimate interest of T@C Company Limited OÜ in ensuring security, preventing fraud, and protecting its operations.
- Legal obligations (e.g., transferring data to a court or law enforcement agencies upon lawful request).
- Performance of a contract (in case of disputes related to contract performance).
For fulfilling legal obligations stipulated by law
- Purpose: Fulfillment of legal requirements, such as transferring data to investigative bodies, tax authorities, or other government agencies.
- Legal Basis: Legal obligations arising from applicable law.
- The legitimate interest of T@C Company Limited OÜ in reliable risk management and general enterprise management may also serve as a supplementary basis in this context.
2. Transfer of Customer Data to Third Parties and Other Processors
We highly value the confidentiality of your data. Your personal data is not transferred to third parties without your consent, except in cases provided by law or when it is necessary to provide you with services.
We may transfer your data to the following categories of recipients:
- Data Processors: These are service providers who process data on our behalf and according to our instructions (e.g., delivery partners, IT service providers, mailing platforms, consultants). We enter into confidentiality and data protection agreements with them, obliging them to comply with strict security standards.
- Government bodies and institutions: In cases provided by law (e.g., upon request from a court, law enforcement agencies, tax authorities).
- Third parties for rights protection: To protect our legitimate rights and interests (e.g., lawyers, courts).
Who is a third party?
A third party is any natural or legal person, other than you (the client), T@C Company Limited OÜ (the data controller), and persons authorized by us to process your data (data processors).
3. Use of Data for Personalization and Marketing (Profile Analysis)
We strive to offer you the most relevant services and offers, as well as to improve your experience with our online store. For this purpose, we may use profile analysis.
What is profile analysis?
Profile analysis is the automated processing of your personal data aimed at evaluating certain personal qualities, interests, preferences, or behavioral patterns. For example, we may analyze your past purchases, viewed products, place of residence, or other data to:
- Adapt the presentation of our services on your devices.
- Generate personalized offers, discounts, and recommendations.
- Improve the usability of our online store.
- Predict your potential interests regarding our products and services.
Legal bases for profile analysis and marketing:
- The legitimate interest of T@C Company Limited OÜ in improving its products and services, enhancing user experience, and offering the most relevant products.
- Customer consent (in cases where it is required, for example, for receiving certain types of direct marketing).
- Performance of a contract (e.g., for providing services that match your preferences, if stipulated by the contract terms).
Your rights:
You have the right to object to receiving direct marketing based on profile analysis at any time. For details, see the section "Your rights as a client".
4. Your Rights as a Client Regarding Data Processing
As a data subject, you have a number of important rights that allow you to control how T@C Company Limited OÜ uses your information. You can exercise the following rights:
- Right to access data: You have the right to obtain confirmation as to whether or not your personal data is being processed, and, where that is the case, access to the personal data and information regarding the purposes of the processing, the categories of data processed, the recipients, and the storage period.
How to exercise: You can view your data in your personal account on the website https://teemaailm.ee/my-account/. - Right to rectification of data: If your personal data is inaccurate, incomplete, or outdated, you have the right to request its rectification.
How to exercise: You can make changes yourself in your personal account on the page https://teemaailm.ee/my-account/ or contact us for assistance. - Right to erasure of data ("right to be forgotten"): You can request the erasure of your personal data if, for example, it is no longer necessary for the purposes for which it was collected, or if you have withdrawn your consent (and there is no other legal basis for processing). Please note that this right does not apply if data processing is necessary for the performance of a contract, compliance with legal obligations, or for the protection of our legitimate interests.
- Right to restriction of data processing: You have the right to request the restriction of processing of your data in certain cases, for example, while verifying the accuracy of the data or the lawfulness of its processing.
- Right to data portability: You can request to receive the data you have provided in a structured, commonly used, and machine-readable format, and, if technically feasible, to transmit it to another service provider. This right applies to data processed based on your consent or for the performance of a contract.
- Right to object to data processing: You have the right to object to the processing of your personal data if it is based on our legitimate interest, including profiling for direct marketing purposes. In such a case, we will cease processing unless we have compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.
- Right to withdraw consent: If the processing of your data is based on your consent, you have the right to withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
- Right to lodge a complaint: If you believe that the processing of your personal data violates your rights or interests in accordance with applicable law, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (website: www.aki.ee) or with the relevant supervisory authority in your country.
How to exercise your rights?
To exercise your rights (with the exception of the right to access/rectify via your personal account), please contact us at [specify contact email/form]. We undertake to review your request within the statutory timeframe.
5. Customer Data Retention Period
We store your personal data no longer than is necessary to achieve the purposes for which it was collected or to comply with legal requirements. The retention period is determined by the following factors:
- Performance of a contract: Data is stored for the duration of the contract concluded with you and for a reasonable period after its termination to resolve possible issues or claims.
- Legal obligations: We are obliged to store certain data for periods established by law (e.g., tax legislation, accounting regulations, statutes of limitations).
- Legitimate interest: In some cases, data may be stored based on our legitimate interest (e.g., for fraud prevention, protection of our rights in case of disputes) for the period necessary to realize this interest.
- Your consent: If data is processed based on your consent, it is stored until your consent is withdrawn, unless there are other legal grounds for its storage.
Upon expiration of the established retention period, the data will be securely deleted or anonymized in such a way that it cannot be linked to you.