Privacy Policy

The data controller responsible for the processing of personal data on the hifimarket.ee online shop is Audio Sommelier OÜ (registry code 16891515), address: Kallaste 7, Tabasalu, 76901, Estonia, phone: (+372) 5027696, e-mail: info@hifimarket.ee.

What personal data do we process?

– name, phone number and e-mail address;
– delivery address;
– bank account number;
– the cost of goods and services and payment-related information, including purchase history.

For what purposes do we process personal data?

Personal data is used to manage customer orders and deliver goods.

Purchase history data (purchase date, goods, quantity and customer information) is used to provide an overview of purchased goods and services, analyse customer preferences and, among other purposes, resolve consumer disputes.

The bank account number is used to refund payments to the customer.

Personal data such as the customer’s name, e-mail address and phone number is processed in order to handle matters relating to goods and services and to provide customer support. The e-mail address is also used to send invoices, and the phone number may be used to notify the customer when goods have arrived at a parcel locker.

Legal basis

Personal data is processed for the performance of a contract entered into with the customer, including order management, delivery, returns and refunds.

Personal data is also processed in order to comply with legal obligations, for example accounting requirements.

Purchase history data may also be processed for the purpose of resolving potential consumer disputes on the basis of the controller’s legitimate interest.

Recipients of personal data

The customer’s name, phone number and e-mail address are forwarded to the transport service provider selected by the customer. If the goods are delivered by courier, the customer’s delivery address is also forwarded to the courier.

Personal data may be forwarded to IT service providers where this is necessary for the operation of the online shop or for data hosting.

Security and access to data

Personal data is stored on servers operated by veebimajutus.ee within the European Union or the European Economic Area.

Personal data may be transferred to countries that the European Commission has recognised as providing an adequate level of data protection, or to third-country recipients where appropriate safeguards under Articles 46 or 47, or a derogation under Article 49(1), of the General Data Protection Regulation (GDPR) applies.

Employees of the online shop may access personal data where necessary to resolve technical issues related to the use of the online shop or to provide customer support.

The online shop applies appropriate physical, organisational and technical security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised access or disclosure. Data exchanged with the online shop is transmitted over an encrypted connection (TLS). Customer passwords are stored in hashed form. Appropriate security measures, including firewall protection, malware protection and regular backups stored separately from the online shop server, are used to protect the online shop’s systems.

Personal data is disclosed to processors, such as transport service providers and hosting providers, on the basis of agreements concluded with those processors. Processors are required to apply appropriate safeguards when processing personal data in accordance with Article 28 of the GDPR.

Access to and rectification of personal data

Customers can access and correct their personal data through their online shop user account or by contacting customer support.

If a purchase was made without creating a user account, personal data can be accessed through customer support.

If a request for access to personal data is submitted electronically, the information will also be provided in a commonly used electronic format.

Withdrawal of consent

Where personal data is processed on the basis of the customer’s consent, the customer has the right to withdraw that consent through the customer account settings or by contacting customer support by e-mail.

Storage

When a customer closes their online shop account, personal data is deleted except where it must be retained for accounting purposes, the resolution of consumer disputes or other legal obligations.

In the event of payment-related or consumer disputes, personal data is retained until the claim has been resolved or the applicable limitation period has expired.

Personal data contained in accounting source documents is retained for seven years.

Restriction of processing

The customer has the right to request restriction of the processing of their personal data where the data is inaccurate or incomplete, or where the processing is unlawful.

Objections

The customer has the right to object to the processing of their personal data where they have grounds to believe that there is no lawful basis for such processing.

Erasure

To request the deletion of personal data, the customer should contact customer support by e-mail.

Requests for erasure will be answered within one month. The response will specify the expected deletion period and identify any personal data that cannot be deleted, together with the applicable legal basis and reason for retaining it.

Data portability

Requests for the transfer of personal data submitted by e-mail will be answered within one month. Customer support will verify the identity of the requester and provide information about the personal data that is subject to portability.