Privacy Policy

Privacy Policy and Cookies

1. General provisions

1.1. This privacy policy describes the principles of collecting, processing and storing personal data in the online shop www.penner.ee (hereinafter the Online Shop). The controller of personal data is Penner OÜ (registry code 10912771, Võru 77, Tartu 50112, Estonia; e-mail info@penner.ee, phone +372 5866 4944), hereinafter Penner OÜ or we.

1.2. A data subject is a customer or any other natural person whose personal data Penner OÜ processes.

1.3. A customer is any person who buys goods from the Online Shop.

1.4. When processing personal data, Penner OÜ follows the principles of lawfulness, fairness, transparency and security and is able to demonstrate compliance with them.

2. Collection of personal data

2.1. We collect personal data mainly electronically through the Online Shop (orders, customer account, contact and return forms, newsletter sign-up) and by e-mail.

2.2. The data subject undertakes to provide correct and complete data and to inform us of any changes. Penner OÜ is not liable for any damage resulting from incorrect data provided by the data subject.

3. What data we process

3.1. We may process the following personal data:

  • first and last name;
  • e-mail address and phone number;
  • delivery and billing address, selected parcel locker;
  • order and purchase history, returns and correspondence;
  • for business customers, the company name, registry code and VAT number;
  • payment data (payment method, amount, payment confirmation). Penner OÜ does not see or store bank and card details (e.g. the card number) – these are entered in the payment service provider's secure environment;
  • Online Shop usage data (e.g. IP address, device, browser, pages visited) collected through cookies in accordance with your consent (see section 7).

3.2. Legal bases for processing personal data (Article 6(1) of the General Data Protection Regulation):

  • contract (point b) – placing the order, payment, delivery, returns and complaints;
  • legal obligation (point c) – accounting and taxation;
  • consent (point a) – newsletters and marketing offers, analytics and marketing cookies;
  • legitimate interest (point f) – Online Shop security, fraud prevention, customer service, service improvement and showing more relevant ads (see section 5.2).

4. Purposes of processing and retention periods

  • Processing and delivery of orders – until the order is fulfilled and claims expire (3 years).
  • Accounting (invoices, payments) – 7 years, as required by the Accounting Act.
  • Customer account – until the account is deleted.
  • Customer service and complaints – up to 3 years from the resolution of the request.
  • Newsletters and marketing – until consent is withdrawn.
  • Advertising audiences – until an objection is made or until the customer relationship ends.
  • Online Shop security – for the period required by law and by the service providers' terms.

Personal data is stored only for as long as is necessary to achieve the purpose or to fulfil a legal obligation.

5. Transfer of personal data

5.1. We transfer personal data only to the extent necessary for a specific purpose to the following processors and partners:

  • payment service providers – to make payments, we transfer the necessary data to Maksekeskus AS (bank payments) and Shopify Payments (card payments, Apple Pay, Google Pay), who act as processors;
  • delivery service providers – Smartpost and DPD for delivering goods;
  • e-commerce platform – Shopify, on which the Online Shop runs;
  • business software – Erply (management of orders, stock and invoices);
  • accounting service provider – for accounting and taxation;
  • newsletter service – only for customers who have given their consent;
  • analytics and advertising services – Google (Google Analytics, Google Ads) and Meta (Facebook, Instagram), only on the basis of your cookie consent.

5.2. Advertising audiences. We may use the contact details (e-mail address, phone number) of customers and newsletter subscribers on advertising platforms (e.g. Meta – Facebook and Instagram, Google, YouTube) to show relevant ads to them or to people with similar interests (custom and lookalike audiences). The data is transferred in encrypted (hashed) form and the advertising platform uses it only to build the audience. You have the right to object to this at any time by writing to info@penner.ee – we will then exclude your data from the audiences.

5.3. Some service providers (e.g. Shopify, Google, Meta) may process data outside the European Economic Area. In that case, data protection is ensured on the basis of a European Commission adequacy decision (e.g. the EU–US Data Privacy Framework) or standard contractual clauses.

5.4. Penner OÜ remains the controller also when transferring data to processors.

5.5. We apply organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure and any other unlawful processing.

6. Rights of the data subject

You have the right to:

  • access your personal data and receive a copy of it;
  • receive information about the processing of your personal data;
  • request the correction or completion of incorrect data;
  • request the deletion of data if there is no legal obligation to keep it;
  • request the restriction of processing and object to processing;
  • receive your data in a machine-readable format (data portability);
  • withdraw your consent at any time (e.g. unsubscribe from the newsletter via the link at the end of the e-mail);
  • contact the Estonian Data Protection Inspectorate (www.aki.ee) if you believe your rights have been violated.

Please send requests and questions to info@penner.ee.

7. Cookies

Cookies are small text files that are saved on your device when you visit a website. On your first visit to the Online Shop, you can choose in the cookie banner which cookies you allow. You can change your choice at any time via the “Cookie preferences” link in the Online Shop footer.

  • Necessary cookies – required for the Online Shop to work (shopping cart, checkout, language selection, login, remembering your cookie choice). They cannot be switched off.
  • Analytics cookies – Google Analytics, which helps us understand how the Online Shop is used (e.g. number of visitors, popular pages). Only with your consent.
  • Marketing cookies – Google Ads and Meta (Facebook, Instagram), which help show more relevant ads and measure the effectiveness of advertising. Only with your consent.

When third-party cookies are used, the privacy policies of those providers also apply. You can also delete cookies in your browser settings; blocking necessary cookies may interfere with the operation of the Online Shop.

8. Final provisions

8.1. When processing personal data, we comply with the General Data Protection Regulation (GDPR), the Personal Data Protection Act and other legislation of Estonia and the European Union.

8.2. Penner OÜ may amend this privacy policy. We will give notice of changes by publishing the new terms in the Online Shop www.penner.ee.