This privacy policy governs the processing of personal data of customers of the GraceTea OÜ online store.
GraceTea OÜ processes customers’ personal data in accordance with the requirements of the legislation of the Republic of Estonia and the European Union, including the General Data Protection Regulation (GDPR).
What data is processed
GraceTea OÜ may process the following customer data:
- first and last name;
- phone number;
- email address;
- delivery address;
- bank details;
- order history;
- data related to the use of the online store;
- other data voluntarily provided by the customer.
Purposes of personal data processing
GraceTea OÜ processes personal data for the following purposes:
Contract performance
Personal data is used for:
- processing and delivering orders;
- communicating with the customer;
- processing payments and refunds;
- providing customer support.
The legal basis for processing is the performance of a contract or steps taken prior to entering into a contract at the customer’s request.
Compliance with legal obligations
GraceTea OÜ processes data to comply with legal obligations, including:
- accounting;
- retention of payment information;
- compliance with requests from public authorities.
Marketing and service improvement
With the customer’s consent, GraceTea OÜ may:
- send informational and promotional offers;
- provide information about discounts and new products;
- conduct customer satisfaction surveys;
- analyze online store usage to improve service quality.
The customer has the right to withdraw from marketing communications at any time.
Protection of legitimate interests
GraceTea OÜ may process data for:
- preventing fraud;
- protecting its rights;
- resolving disputes;
- ensuring the security of the online store.
Disclosure of personal data to third parties
GraceTea OÜ does not disclose personal data to third parties without a legal basis or customer consent, except where required by law.
Personal data may be shared with:
- payment service providers;
- delivery service providers;
- IT and hosting service providers;
- accounting and legal advisors;
- public authorities where required by law.
All partners processing personal data are required to maintain confidentiality and comply with GDPR requirements.
Profiling and personalized offers
GraceTea OÜ may use automated data analysis to:
- personalize offers;
- improve user experience;
- adapt the content of the online store.
Such analysis is based on the legitimate interest of GraceTea OÜ or the customer’s consent. The customer has the right to opt out of the use of their data for direct marketing purposes.
Customer rights
The customer has the right to:
- receive information about the processing of their personal data;
- access their data;
- request correction of inaccurate data;
- request deletion of data where provided by law;
- restrict processing of data;
- object to processing based on legitimate interest;
- withdraw previously given consent;
- receive their data in a machine-readable format (data portability right);
- lodge a complaint with the Estonian Data Protection Inspectorate.
Estonian Data Protection Inspectorate:
AKI – Andmekaitse Inspektsioon
Changes and deletion of data
To access, modify, delete, or restrict processing of their personal data, the customer may contact GraceTea OÜ via email: info@gracetea.ee.
GraceTea OÜ responds to customer requests within the time limits prescribed by law.
Data retention period
Personal data is stored no longer than necessary for the purposes of processing or to comply with legal obligations.
For example:
- accounting documents are stored for the period required by law;
- order-related data may be retained to resolve potential disputes and fulfill warranty obligations.
Cookies
The GraceTea OÜ online store may use cookies for:
- ensuring proper website functionality;
- saving user preferences;
- analyzing website traffic;
- improving user experience.
The customer can restrict or disable cookies in their browser settings.