Privacy Notice

1. Data Controller

1.1. The controller is Timbale OÜ, Registrikood 16231003, address: Mannimae/1, Pudisoo kula, Kuusalu vald, Harju maakond, 74626, Estonia.

1.2. Enquiries regarding data processing may be sent to info@timbale.pro or made by telephone on +372 6093 431.

1.3. No separate data protection officer has been appointed: all enquiries are handled by the controller at the address above.

1.4. This notice has been prepared in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR).

2. Data Processed

2.1. When an order is placed: first name and surname, telephone number, email address, delivery address or pickup point, order contents and amount, and the selected delivery and payment methods.

2.2. When an account is created: email address and the sign-in verification code, order history and wish list.

2.3. When signing in via Google or Yandex ID: email address, first name and surname, and a link to the profile photo, to the extent provided by the selected service. The password for the account with that service is not disclosed to the controller.

2.4. When subscribing to “Notify me when available”: email address and the product to be notified about.

2.5. When contacting customer support or corresponding via messaging apps: the information set out in Section 6.

2.6. Automatically when visiting the website: IP address, device and browser information, pages viewed and actions taken on the website, to the extent described in the Cookie Policy.

2.7. The controller neither receives nor stores bank card details: these are collected by the payment service provider on its own side.

2.8. Special categories of personal data (Article 9 GDPR) are not processed.

3. Purposes and Legal Bases

3.1. Placing, fulfilling and servicing orders, including delivery, payment and returns: performance of a contract, Article 6(1)(b) GDPR.

3.2. Account, wish list and back-in-stock notifications: performance of a contract and steps taken at the customer’s request, Article 6(1)(b) GDPR.

3.3. Accounting and tax records and retention of documents: compliance with a legal obligation, Article 6(1)(c) GDPR.

3.4. Marketing communications: consent, Article 6(1)(a) GDPR and Article 13 of Directive 2002/58/EC. Text of the consent: consent to marketing communications.

3.5. Analytics cookies: consent, Article 5(3) of Directive 2002/58/EC.

3.6. Protecting the website against misuse, investigating faults and defending rights in disputes: legitimate interests, Article 6(1)(f) GDPR. An explanation of the balancing of interests is available on request.

3.7. The data provided when placing an order are required for entering into and performing the contract: the order cannot be fulfilled without a name, contact details and a delivery address (Article 13(2)(e) GDPR).

4. Recipients of data

4.1. Delivery services, in order to deliver the order: name, telephone number, address and shipment details.

4.2. The payment service provider, in order to accept payments and issue refunds.

4.3. Email and messaging service providers, in order to deliver emails and messages.

4.4. The hosting provider and the web analytics service: see Sections 5 and 8.

4.5. Public authorities, where required by law.

4.6. Processors act under a contract that complies with Article 28 GDPR and are not entitled to use the data for their own purposes. Personal data are not sold.

5. Data Storage Location and Transfers to Third Countries

5.1. The website and the store’s database are hosted on servers in a data centre located in Finland (European Union).

5.2. Data may leave the European Economic Area in the course of correspondence via messaging apps (Section 6) and when the web analytics service is used (Section 8), as the operators of these services process data on their own servers.

5.3. Such transfers are permitted only on the basis of a European Commission adequacy decision or standard contractual clauses with supplementary safeguards.

5.4. Data collected by the web analytics counter are transferred to the Russian Federation, in respect of which there is no European Commission adequacy decision. Such transfers take place only after, and on the basis of, your consent to analytics cookies (Article 49(1)(a) GDPR); consent may be withdrawn at any time.

5.5. Information on the countries where data are hosted and the safeguards applied is available on request at info@timbale.pro.

6. Correspondence via Messaging Apps

6.1. Customers may contact us via Telegram and Instagram (Direct); contact details are provided in the website footer. Messages are received in the controller’s information system, where they are answered by staff.

6.2. The following are processed in the course of correspondence: profile name and photo, username and telephone number, where displayed by the messaging app; the internal account identifier used to deliver replies; message texts and attachments, including photos, videos, voice messages and files; the date and time of messages; and any contact details and order information provided by the customer.

6.3. Purposes: responding to enquiries, providing product advice, placing and servicing orders, and handling delivery, payment and return matters. Legal basis: Article 6(1)(b) GDPR and, for enquiries unrelated to an order, the legitimate interest in responding to them, Article 6(1)(f) GDPR. Correspondence is not used for marketing purposes.

6.4. The controller receives only the messages sent to its account and the profile data needed to reply. The controller has no access to the customer’s other conversations, contacts or posts.

6.5. Messages are delivered by the messaging services themselves, Telegram and Instagram (a Meta group company). They process data under their own rules as independent controllers, and their servers may be located outside the European Economic Area (Section 5).

6.6. Correspondence is retained for as long as it is needed to respond to the enquiry. Correspondence relating to an order is retained for the retention period applicable to order data (Section 7).

6.7. To have your correspondence and messaging profile data deleted, write to info@timbale.pro or send “Delete my data” in the same chat. The controller will delete them without undue delay and in any event within one month (Article 12(3) GDPR) and will notify you accordingly. Information that must be retained by law is deleted when its retention period expires. Messages held by the messaging service itself are deleted in its app.

7. Retention periods

7.1. Order data and accounting documents are retained for seven years from the end of the financial year in which the order was placed (Estonian Accounting Act).

7.2. Account data are retained for as long as the account exists. Once the account is deleted, they are erased, except for information that must be retained by law.

7.3. A “Notify me when available” subscription is retained until the notification is sent or until you unsubscribe. A record of the sent notification remains in the controller’s information system and is deleted on request to info@timbale.pro.

7.4. Records of consent are retained for three years after the consent is withdrawn or after the last action related to it.

7.5. Web analytics data are retained by the analytics service for the periods set by that service.

8. Cookies and analytics

8.1. The types, purposes and lifetimes of cookies are described separately in the Cookie Policy.

8.2. Analytics cookies are set only after you give consent, which is requested in a banner on your first visit. Your choice is stored in the sf_consent cookie for 180 days. To change or withdraw it, delete the website’s cookies in your browser settings so that the banner appears again, or write to info@timbale.pro.

8.3. No advertising or marketing trackers are installed on the website.

9. Rights of the data subject

9.1. With regard to your data, you have the right to request:

• access to your data (Article 15 GDPR);

• rectification of inaccurate data (Article 16 GDPR);

• erasure of data (Article 17 GDPR);

• restriction of processing (Article 18 GDPR);

• data portability (Article 20 GDPR);

• objection to processing based on legitimate interests (Article 21 GDPR);

• withdrawal of consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR).

9.2. Requests should be sent to info@timbale.pro. A response will be given within one month (Article 12(3) GDPR). If the request does not make clear whom the data belong to, the controller may ask you to verify your identity.

9.3. You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or with the supervisory authority in your country of residence.

10. Automated decision-making

10.1. No automated decision-making or profiling that produces legal effects for the customer takes place.

11. Changes to this notice

11.1. The current version is always published on this page of the website.

11.2. A new version takes effect from the date stated in it. Previous versions remain available.