Controller
The controller of personal data is Ruumik OÜ, registry code 14621467, VAT identification number EE102484867, registered office at Sõpruse 13a, Viiratsi, 70101, Viljandi, Estonia (hereinafter the Online Store).
Questions about privacy or requests concerning data-subject rights may be submitted by email to info@ruumik.ee.
Personal data processed and its sources
Depending on the services used, the Online Store processes the following personal data:
- name, email address, telephone number, billing and delivery address, and company details;
- account, shopping-cart, order, invoice, payment-method, payment-status, delivery, return and refund data; the Online Store does not receive complete payment-card details;
- the content of customer-service communications, complaints, returns, quotation requests and other enquiries;
- subscriptions to newsletters, back-in-stock notifications and other optional communications, and evidence of consent or opt-out;
- IP address, device and browser information, security and error logs, cookie preferences and the consent record;
- analytics and marketing events to the extent that there is a valid legal basis and, where required, appropriate consent for the processing.
Personal data is obtained mainly from the person through the Online Store, an account, checkout, email, a form or telephone. Payment and delivery status information may be received from the payment-service provider and the carrier. Technical data is generated when the Online Store is used.
The fields required to fulfil an order are identified at checkout. If this data is not provided, it may not be possible to accept, process payment for or deliver the order. Creating an account and subscribing to newsletters or back-in-stock notifications are optional.
Purposes and legal bases for processing
| Purpose | Legal basis |
|---|---|
| Processing an order, payment, delivery or return; managing a customer account; and order-related communications | taking steps at the person's request before entering into a contract and performance of the contract |
| Managing invoices, accounting, taxes and other mandatory records | compliance with a legal obligation |
| Handling complaints, disputes and legal claims | performance of the contract or compliance with a legal obligation and, where necessary, the Online Store's legitimate interest in establishing, exercising or defending its legal rights |
| Preventing fraud, unauthorised access and technical problems | the Online Store's legitimate interest in protecting the Online Store, its customers and transactions |
| Newsletters, optional analytics and personalised marketing | consent |
| Back-in-stock notification | the person's request; if the notification contains marketing, consent |
| Strictly necessary technical operation of the Online Store | performance of the contract or the Online Store's legitimate interest in providing a secure and functioning service |
Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Acknowledging this Privacy Policy is not treated as blanket consent for processing that requires separate consent.
Recipients of personal data
The Online Store discloses personal data only to the extent necessary for the relevant purpose to the following categories of recipient:
- hosting, email, backup, security, ecommerce-platform and IT service providers;
- the payment-service provider selected at checkout;
- the carrier or delivery intermediary selected at checkout;
- the accounting-software provider and accounting-service provider;
- providers of customer communications, forms, newsletters and back-in-stock notifications;
- Complianz consent management and the analytics and marketing services identified in the cookie information, only to the extent of the actual configuration and applicable consent;
- legal, audit and IT advisers and public authorities where access is necessary to provide a service or comply with the law.
Information about specific recipients may be requested from info@ruumik.ee. When responding to a data-subject access request, the Online Store will identify the actual recipients to the extent required by applicable law.
A payment-service provider or carrier may act as an independent controller in relation to its own service. In that case, its own privacy notice also applies to its processing.
Transfers outside the European Economic Area
When certain cloud, analytics or marketing services are used, personal data may be processed outside the European Economic Area. A transfer may take place only where there is a valid legal basis and an applicable safeguard, such as a European Commission adequacy decision, a valid certification under the EU-U.S. Data Privacy Framework, or the European Commission's Standard Contractual Clauses.
Information about the particular service, country of processing and applicable transfer safeguard is available in the cookie information or may be requested from info@ruumik.ee.
Retention of personal data
The Online Store retains personal data only for as long as necessary for the purpose of processing, a legal obligation or a possible dispute:
- order, invoice, payment and accounting data is retained for seven years from the end of the financial year in which the transaction was recorded in the accounts;
- data concerning an unpaid, failed or cancelled order that did not result in an accounting record or dispute is retained for up to 90 days after the order ended;
- a customer account is generally deleted after three years of inactivity, but mandatory order and accounting data continues to be retained only to the extent necessary;
- correspondence concerning a complaint, return or substantive customer-service matter is generally retained for three years after the matter is closed and, in the event of an active dispute, until the dispute has ended;
- a marketing contact is retained until consent is withdrawn or an objection is made; the minimum record required to evidence consent and opt-out may be retained for up to three years for the defence of legal claims;
- operational back-in-stock notification data is generally deleted within 30 days after the notification is sent or the subscription is cancelled;
- security and technical logs are retained for the shortest documented period reasonably possible and, in the event of an incident, until the investigation is completed; data contained in backups is deleted through the normal controlled overwrite cycle.
Until safe automated deletion has been verified, Ruumik OÜ will conduct and document a manual retention review at least once each year.
Where data is required for an ongoing dispute, regulatory proceeding or another legal obligation, the necessary part may be retained for longer. Its use will be restricted to the remaining purpose.
Cookies
The Online Store uses Complianz to manage cookies and consent. Strictly necessary technologies may operate without consent. Optional analytics and marketing technologies are activated only on the basis of appropriate consent, and the choice may later be changed in the cookie settings.
The categories, purposes, providers and retention periods of cookies are described in separate cookie information linked from the footer of the Online Store.
Data-subject rights
Subject to the applicable conditions, a person has the right to access their personal data, request its rectification or erasure, restrict its processing, object to processing based on legitimate interest, receive personal data they have provided in a machine-readable format, and withdraw consent. A person may object to direct marketing at any time.
The Online Store does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect a person.
A request may be submitted to info@ruumik.ee. The Online Store may request additional information necessary to verify the person's identity and will generally respond within one month. The right to erasure does not apply to data that must continue to be retained to comply with a legal obligation, perform a contract or establish, exercise or defend a legal claim.
A person also has the right to lodge a complaint with the Estonian Data Protection Inspectorate: https://www.aki.ee/en.
Security and amendments
The Online Store applies technical and organisational security measures appropriate to the nature of the personal data and the risks, including access restrictions, secure connections, system updates and backups.
This Privacy Policy will be updated when the processing of personal data, service providers or legal requirements change. The current version and its effective date will be published on the website.
Version: 1.0
Effective date: 11 August 2026
Eesti
Latviešu