1. The chief processor of personal data is BuboTech Nordics OÜ (Harju maakond, Tallinn, Nõmme linnaosa, Pääsküla tn 10a-2, 10917, registry code 11938703).
Data protection specialist is appointed by Kaupo Noormaa,  kaupo [at] bubotech.eu

2. The processing of personal data is subject to the legislation of Estonia and the European Union.

3. The controller collects the following personal information: name, gender, birthday, personal identification code, phone number, e-mail and purchase history.

4. Among others, personal data is collected and processed for the following purposes: to make purchase analyses, to sell goods and provide services, to serve the client’s loyalty program. The controller has the right to query, analyze, sort, and take samples of personal data in the database.

5. The controller does not disclose the information received by him to third parties. BuboTech Nordics OÜ services, incl. digital services, are not directed towards children under 13.

6. By joining the client program, the client gives consent to the processing of his/her personal data. Personal data transmitted to the controller is protected and treated as confidential information, including information stored on the customer and his/her orders stored in the e-store order environment. The data communication between the client and the banks and the card payment center is encrypted, which ensures the security of the customer’s personal data and bank details. The data controller does not have access to client confidential bank and payment card requisitions.

7. The data controller will implement all measures, including information technology and organizational measures, for the protection of the personal data collected. Access to data editing and processing is restricted to authorized persons.

8. BuboTech Nordics OÜ may authorize other legal entities (authorized processors) to process personal data, provided that an agreement has been entered with such a processor under which the processor is required to keep the personal data processed as confidential and to ensure the protection of personal data in accordance with the requirements provided by law. Such authorized processors are cash register software service providers, software development partners, logistics service providers and marketing service providers.

BuboTech Nordics OÜ informs the client of the up-to-date list of authorized processors of legal entities based on the client’s request, submitted in writing to BuboTech Nordics OÜ at Pääsküla tn 10a-2, Tallinn, Estonia or by e-mail kaupo [at] bubotech.eu

10. The customer has the right to get information and check his/her personal data, request access to the personal data, request corrections to the personal data, request limiting the personal data, request the deletion of personal data, request the transfer of personal data, rights relating to the automated processing of data, right to an evaluation by a supervisory authority. The customer also has a right to renege on his/her permission to process personal data. In order to obtain information and get acquainted, the customer submits a corresponding written request to the address kaupo [at] bubotech.eu

11. The controller of personal data may send newsletters to the client, including satisfaction surveys and offers to the client’s e-mail address or via SMS only if the client has given prior consent at the time of joining the client program or in the self-service environment.

12. The customer can opt-out of the sent offers and newsletters at any time by notifying him via e-mail at kaupo [at] bubotech.eu or by following the instructions in the e-mail.

13. At any time, the customer can consult his personal data or partially change them by sending the corresponding request to the address kaupo [at] bubotech.eu. To delete collected personal data, the customer submits a corresponding written request to the address kaupo[at]tharapita.eu

14. The data subject has the right to file a complaint with BuboTech Nordics OÜ data protection officer, the Data Protection Inspectorate or the court if the data subject believes that his rights have been violated in the processing of personal data. The contact details of the Data Protection Authority (AKI) can be found on the website of the AKI at:http://www.aki.ee/et/inspektsioon/kontaktid-nouandetelefon.

15. The data controller changes and/or deletes the client data after the client has been identified.

16. The deadline for maintaining client’s personal data is five years from the last purchase.

17. In the event of personal data being processed for a new purpose, different from the purpose for which the data was initially collected, or if collection of the data is not based on the subject’s consent, BuboTech Nordics OÜ will carefully consider the permissibility of such processing. In order to determine whether processing of personal data for a new purpose is compliant with the purpose for which the personal data was initially collected, BuboTech Nordics OÜ will, among other things, consider:

(1) Connections between the purposes for which the personal data was collected and the purposes of the intended further processing;

(2) The context of collection of the personal data, primarily the connection between the data subject and BuboTech Nordics OÜ;

(3) The type of the personal data;

(4) The potential consequences of the intended further processing for the data subjects;

(5) Existence of relevant security measures. BuboTech Nordics OÜ may unilaterally change the privacy policy by notifying the Customer thereof at least 2 weeks in advance.

BuboTech Nordics OÜ may make unilateral amendments to the terms and conditions of the privacy policy pursuant to the law. Any amendments will be communicated by BuboTech Nordics OÜ to the data subjects on the website of BuboTech Nordics OÜ or in another manner.

18. BuboTech Nordics OÜ uses cookies on its website incl. those by Google Analytics and Hotjar by informing customers of this practice and asking for the customers’ permission.