PROCESSING OF PERSONAL DATA

The controller of personal data for the online shop Plazamobiil.ee is Plaza Kaubandus OÜ (registry code: 11360534), legal address: Harjumaa, Tallinn, Karjavälja tn 4, 12918, phone: +372 5333 9950 and e-mail info@plazamobiil.ee.

Which personal data is processed

name, phone number and e-mail address;
delivery address;
bank account number;
the price of goods and services and payment data (purchase history);
customer-support data.

Why personal data is processed

Personal data is used to manage the customer’s orders and to deliver the goods.
Purchase-history data (purchase date, goods, quantity and customer details) is used to compile an overview of goods and services purchased and to analyse customer preferences.
The bank account number is used to refund payments to the customer.
Personal data such as e-mail address, phone number and customer name is processed in order to resolve questions related to the provision of goods and services (customer support).
The online shop user’s IP address or other network identifiers are processed in order to provide the online shop as an information-society service and to compile website-usage statistics.

Legal basis

Personal data is processed in order to perform the contract concluded with the customer.
Personal data is processed in order to comply with a legal obligation (for example accounting and resolving consumer disputes).
Recipients to whom personal data is disclosed
Personal data is disclosed to the online shop’s customer support in order to manage purchases and purchase history and to resolve customer issues.
The name and phone number are disclosed to the transport service provider chosen by the customer and/or to the supplier of the goods when the supplier ships the goods. If the goods are delivered by courier, or if the customer orders the goods to a post office, the customer’s address is disclosed in addition to the contact details.
If the online shop’s accounting is carried out by a service provider, personal data is disclosed to that service provider for accounting.
Personal data may be disclosed to information-technology service providers where this is necessary to ensure the functionality or hosting of the online shop.

Security and access to data

Personal data is stored on Zone.ee servers located in a Member State of the European Union or in a country that has joined the European Economic Area. Data may be transferred to countries whose level of data protection the European Commission has found adequate, and to companies that have joined the Privacy Shield framework.
Personal data is accessible to online shop employees who need it in order to resolve technical questions related to use of the shop and to provide customer support.
The online shop applies appropriate physical, organisational and information-technology security measures to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorised access and disclosure.
Personal data is disclosed to the online shop’s processors (for example a transport service provider and a hosting provider) on the basis of agreements concluded with those processors. Processors are required to apply appropriate safeguards when processing personal data.

Accessing and correcting personal data

Personal data can be viewed and corrected in the online shop user profile. If a purchase was made without a user account, personal data can be accessed through customer support.

Withdrawing consent

Where personal data is processed on the basis of the customer’s consent, the customer may withdraw that consent by notifying customer support by e-mail.

Retention

When an online shop customer account is closed, personal data is deleted, except where it must be retained for accounting or for resolving consumer disputes.
If a purchase was made in the online shop without a customer account, the purchase history is retained for three years.
In the case of disputes related to payments or consumer claims, personal data is retained until the claim is satisfied or the limitation period ends.
Personal data required for accounting is retained for seven years.

Erasure

To have personal data erased, contact customer support by e-mail. An erasure request is answered within one month, and the period for erasing the data is specified.

Portability

A request for the portability of personal data submitted by e-mail is answered within one month. Customer support verifies the person’s identity and informs them which personal data is subject to portability.

Direct marketing messages

The e-mail address and phone number are used to send direct marketing messages if the customer has given consent. If the customer does not wish to receive direct marketing messages, they should use the link in the e-mail footer or contact customer support.
Where personal data is processed for direct marketing (profiling), the customer may at any time object to the initial and further processing of their personal data, including profiling related to direct marketing, by notifying customer support by e-mail (this information must be presented clearly and separately from any other information).

Resolving disputes

Disputes related to the processing of personal data are resolved through customer support (e-mail: info@plazamobiil.ee). The supervisory authority is the Estonian Data Protection Inspectorate (info@aki.ee).