PRIVACY POLICY

General

The controller of personal data is Indevex OÜ, registry code 14255169, address Harju County, Maardu, Viieaia Road 13, 74114.
When processing the personal data of the Customer and/or the Buyer, Indevex OÜ shall follow the requirements of the current legislation of Estonia and the European Union. All personal data of the Customer and/or the Buyer held by Indevex OÜ have been collected directly from the Customer and/or the Buyer.
Indevex OÜ shall use the personal data of the Customer and/or the Buyer for the purposes for which this data was collected and to the extent necessary to fulfill these purposes. The personal data necessary for making payments shall be transmitted to the processor, Maksekeskus AS.

If the purpose for which the personal data was collected is achieved, we shall delete the redundant personal data as follows:

• customer card data 3 years after the last use of the customer card for registering the purchase;
• Online Store user account data 7 years after data collection;
• Buyer’s personal data 7 years after the purchase;
• if the data processing is based on consent, after the withdrawal of consent.

Indevex OÜ may change the Privacy Policy at any time in accordance with the requirements of personal data protection. The changes are considered to be known to the Customer and/or the Buyer as of their publication on the website of Indevex OÜ.

Legal grounds for processing personal data

Indevex OÜ shall process personal data only if the company has a legal basis for processing the data. Indevex OÜ shall process personal data on the following legal bases:

• with the consent of the person;
• for the performance of obligations arising from law;
• for performing the Contract;
• in the event of a legitimate interest.

Processing of personal data of Customers

The Customer’s personal data is collected when registering an account, concluding a purchase and sale agreement, performing direct marketing, managing invoices, resolving disputes and claims, and monitoring (profiling) behavioural habits.
In order for Customers to register in the user environment of Indevex OÜ, they must provide Indevex OÜ with the following personal data:

• given name and surname,
• e-mail address,
• telephone number,
• address of the place of residence,
• social media account details (username),
• data transmitted for payment purposes.

In case of purchases made by the Customer, Indevex OÜ transfers personal data to third party contractual partners (for example, a courier company).

For the analysis of behavioural habits, the Customer and/or the Buyer shall mark the corresponding consent box. The Customer and/or the Buyer shall give the consent for processing by voluntarily registering as a user in the Online Store.

The Customer and/or the Buyer shall have the right to withdraw their consent for the processing of personal data at any time, but this does not affect the previous processing of personal data based on the prior consent of the Customer and/or the Buyer or the data processing processes required by law.

The processing of personal data for the analysis of behavioural habits shall be terminated after withdrawal of the consent given by the Customer and/or the Buyer for the processing of personal data.

The Online Store of Indevex OÜ shall analyse behavioural habits in order to provide the Customer and/or the Buyer with personal and more suitable offers.

The Customer who has registered as a user in the Online Store can withdraw their consent at any time by logging into the Online Store/ directly contacting the data protection officer of Indevex OÜ.

Processing of the Buyer’s personal data for the performance of the purchase and sale agreement

When making a purchase in the Online Store, the Buyer must provide Indevex OÜ with the following personal data:

• given name and surname,
• e-mail address,
• telephone number,
• address of the place of residence,
• delivery address,
• data transmitted for payment purposes.

Indevex OÜ may transfer the Buyer’s personal data collected by the purchase and sale agreement to third party contractual partners.
Pursuant to the Accounting Act, the personal data of the Buyer collected upon concluding the purchase and sale agreement shall be stored for 7 years.

Rights of the Customer and the Buyer

Indevex OÜ values the rights of the Customer and/or the Buyer, thus we shall give an overview of all the rights of the Customer and the Buyer in relation to their personal data.

The Customer and the Buyer have the following rights:

• The Customer and/or the Buyer can contact the data protection officer of Indevex OÜ at any time with questions related to the processing of personal data by writing an e-mail to: info@indevex.com
• The Customer and/or the Buyer may contact Indevex OÜ at any time to obtain access to their personal data.
• The Customer and/or the Buyer have the right to contact Indevex OÜ at any time to update their changed personal data.
• The Customer and/or the Buyer may ask Indevex OÜ to delete their personal data (right to be forgotten).
• The Customer and/or the Buyer may request Indevex OÜ to restrict the processing of their personal data or submit objections to the processing of personal data.
• The Customer may request Indevex OÜ to transfer their personal data to the possession of a new controller.

The Customer and/or the Buyer have the right to apply to the Data Protection Inspectorate in connection with a complaint concerning the processing of personal data.

Transmission of personal data of the Customer and/or the Buyer

Indevex OÜ shall transfer the personal data of the Customer and/or the Buyer to the following third parties:

• under contract to transport or courier service providers;
• under consent to direct marketing service providers;
• to fulfill the obligations arising from the law to the accounting service provider;
• under contract to IT service providers;
• under the contract to cooperation partners;
• to fulfill other obligations arising from law.

Processing of personal data for direct marketing purposes

The Customer of Indevex OÜ and/or the Buyer can join direct marketing offers. Direct marketing channels include emails and regular mail.
Indevex OÜ shall transmit the personal data of the Customer and/or the Buyer to the direct marketing service providers for the purpose of direct marketing in accordance with the requirements of personal data protection.
The Customer of Indevex OÜ and/or the Buyer shall give a voluntary consent to the processing of their personal data for the purpose of direct marketing.

The consent for direct marketing is given by the Customer and/or the Buyer by marking the relevant consent box. The consent to the processing of personal data for the purpose of direct marketing is given by the Customer and/or the Buyer by voluntarily registering as a user in the Online Store; when making a purchase in the Online Store; by filling in the necessary fields when visiting the website of the Online Store; or by filling in the required fields on the customer card registration form in the retail store. Indevex OÜ shall forward the personal data of the Buyer and/or the Customer to the cooperation partners providing direct marketing services.

The Customer and/or the Buyer shall have the right to withdraw their consent for the processing of personal data for the purposes of direct marketing at any time, but this does not affect the previous processing of personal data based on the prior consent of the Customer and/or the Buyer.