Privacy Policy

Last updated: 2 September 2026

This Privacy Policy explains how LALE MARKETING OÜ («we», «us») collects, uses and protects personal data when you visit lalemarketingou.com or place an order. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.

1. Data controller

2. What data we collect

• Order data: name, email address, phone number, billing and shipping address, items purchased, order history.
• Payment data: payments are processed by our payment providers (card, Apple Pay, Google Pay). We never store full card numbers; we receive only a confirmation and the last four digits.
• Communication data: the content of emails or calls you send us.
• Technical data: IP address, browser type, device, pages visited and cookies (see our Cookie Policy).

3. Why we process it and on what legal basis

• To fulfil your order, deliver it and provide support — performance of a contract (Art. 6(1)(b) GDPR).
• To issue invoices and keep accounting records — legal obligation (Art. 6(1)(c)).
• To keep the website secure and improve it — legitimate interest (Art. 6(1)(f)).
• To send marketing emails, only if you opted in — consent (Art. 6(1)(a)); you can withdraw at any time.

4. Who we share data with

We share data only with processors needed to run the shop: payment providers, shipping carriers, our hosting provider, email service and accounting software. All processors are bound by data processing agreements. Where data leaves the EEA, transfers rely on adequacy decisions or Standard Contractual Clauses. We never sell personal data.

5. Retention

Order and invoice data is kept for 7 years as required by Estonian accounting law. Support correspondence is kept for 2 years. Marketing consent data is kept until you withdraw consent. Technical logs are kept for up to 12 months.

6. Your rights

You have the right to access, rectify, erase or restrict the processing of your data, to data portability, and to object to processing based on legitimate interest. To exercise any right, email contacto@lalemarketingou.com. You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or your local supervisory authority.

7. Security

The site is served over HTTPS, payment pages are PCI-DSS compliant through our providers, and access to order data is restricted to staff who need it.

8. Changes

We may update this policy from time to time. The date at the top shows the latest version.