PROCESSING OF PERSONAL DATA

PROCESSING OF PERSONAL DATA
The controller of the personal data of the www.viinarannasta.ee online store (the website of SuperAlko) is ALDAR EESTI OÃœ (registry code 11710650) located at F. G. Adoffi St 11, Rakvere, Lääne-Viru County 44310, telephone: 6667365, email: info@aldar.ee.
We store personal data no longer than required by law or necessary for ensuring the service and efficient customer service.

What personal data are processed

• first name and surname, personal identification code, telephone number and email address;
• delivery address;
• bank account number;
• cost of goods and services and payment details (purchase history);
• customer support details;
• type and operating system of the device;
• IP address;
• type and version of the web browser;
• pages visited;
• length of the website visit session;
• demographic information;
• reactions (incl. 'likes') to posts and other content in Facebook;
• data of the data subject's friends and mutual friends in Facebook (the processing of which has been enabled);
• posts and other content shared by the data subject in Facebook;
• comments made by the data subject in Facebook;
• mentions concerning the data subject in posts and other content in Facebook.

Why personal data are processed
Personal data are used to manage the customer's orders and deliver or hand over goods. Consent for the processing of personal data is necessary to manager orders and no orders can be placed without that.
Purchase history details (date of purchase, goods, quantity, customer's details) are used for preparing an overview of the goods and services purchased and for analysing customer preferences.
The bank account number is used to reimburse payments to the customer.
Personal data such as first name and surname, personal identification code, telephone number and email address
are processed to handle any issues relating to the provision of goods and services (customer support).
The IP address or other online identifiers of users of the online store are processed for the provision of the online store as an information society service and for web use statistics.
The website uses cookies for the organisation of the purchase session as well as for the collection of user statistics. An order can only be executed if you permit the cookies of www.viinarannasta.ee.

Legal basis
Personal data are processed for the purpose of performing a contract entered into with the customer (Article 6(1)(b) of Regulation No 2016/679/EU).
Personal data are processed to perform legal obligations (such as accounting and the settlement of consumer complaints) (clause 52 of the Preamble to and Article 6(1)(c) of Regulation No 2016/679/EU).

Recipients of personal data
Personal data are transmitted to the customer support of the online store to manage purchases and purchase history and settle any problems that the customers may have.
The first name and surname, personal identification code, telephone number and email address are transmitted to the transport service provider selected by the customer. If the goods are delivered by a courier, the customer's address is transmitted along with their contact details.
As the accounting of the online store is kept by a service provider, the personal data are transmitted to the service provider to perform accounting operations.
Personal data may be transmitted to IT service providers if this is necessary to ensure the functionality of the online store or to host data.

Security and access to data
Personal data may be accessed by the staff of the online store in order to settle technical issues related to the use of the online store and to provide customer support.
The online store takes appropriate physical, organisational and IT security measures to protect personal data against accidental or unlawful destruction, loss, alteration or unauthorised access and disclosure.
Personal data are transmitted to data processors of the online store (such as the providers of transport and data hosting services) and processed under contracts entered into between the online store and the processors. The processors must ensure appropriate safeguards when processing personal data.

Access to and rectification of personal data
Personal data can be accessed by sending an inquiry to customer support.

Withdrawal of consent
If personal data are processed based on the customer's consent, the customer has the right to withdraw their consent by informing customer support thereof via email. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The online store cannot be used if consent is withdrawn.

Storage
Personal data are erased upon the closure of a customer account of the online store, unless the storage of the data is necessary for accounting purposes or for the settlement of consumer disputes.
For purchases made without a customer account, the purchase history is stored for three years.
In the event of disputes concerning payments and consumer disputes, the personal data are stored until the claim is satisfied or until the expiry of the limitation period (three years).
Personal data needed for accounting purposes are stored for seven years of the end of a calendar year.

Restriction and erasure of data
For the restriction or erasure of personal data, customer support must be contacted via email. Requests for erasure are responded to no later than within one month and the period of erasure is specified. The same also applies to the restriction of personal data.

Portability
Portability requests submitted by email are responded to within no later than one month. Customer support identifies the person and informs them of the personal data subject to portability.

Direct marketing messages
The email address and telephone number are used for sending direct marketing messages if the customer has given their consent to receiving such messages. If the customer does not want to receive direct marketing messages, the customer should contact customer service.
Where personal data are processed for the purposes of direct marketing (profiling), the customer has the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time by notifying customer support thereof via email.

Special provisions concerning Facebook sites of SuperAlko
ALDAR EESTI OÜ and Facebook Ireland Ltd. (registry code 462932, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) are joint controllers of the data provided via the websites

https://www.facebook.com/SuperAlkoHaapsalu/
https://www.facebook.com/SuperAlkoTartuRyytli/
https://www.facebook.com/superalkoanne/
https://www.facebook.com/SuperAlkoNomme/
https://www.facebook.com/KuressaareSuperAlko/
https://www.facebook.com/ViljandiSuperAlko/
https://www.facebook.com/superalkoestonia/
https://www.facebook.com/SuperAlko-1027587037334180/
https://www.facebook.com/superalko.viinarannasta

(Facebook sites of SuperAlko) for the purposes of Article 26 of Regulation No 2016/679/EU.
ALDAR EESTI OÜ processes the personal data that the persons who have given or got shares and likes on the Facebook sites of SuperAlko have made available about themselves.
In other respects, the data collected via the Facebook sites of SuperAlko of ALDAR EESTI OÜ are processed by Facebook Ireland Ltd. Facebook Ireland Ltd. does not notify ALDAR EESTI OÜ of the data collected or of the manner of use thereof. ALDAR EESTI OÜ is not aware of the purpose or scope of the information collected by Facebook. To examine the privacy terms of Facebook Ireland Ltd., visit the website at https://www.facebook.com/about/privacy/.
The data protection officer for Facebook Ireland Ltd. can be contacted via the following link: https://www.facebook.com/help/contact/540977946302970. The supervisory body of the country where Facebook Ireland Ltd. is established is the Data Protection Commission, address 21 Fitzwilliam Square, Dublin 2, D02 RD28, Ireland, website www.dataprotection.ie, email: info dataprotection.ie, with whom you have the right to file a complaint about the activities of Facebook Ireland Ltd.

Dispute resolution
Disputes concerning the processing of personal data are settled via customer support (andmekaitse@aldar.ee). The supervisory authority is the Estonian Data Protection Inspectorate
(info@aki.ee) with whom you may also file a complaint.