Privacy Policy

1. What we collect and why

Orders and delivery: your name, contact details, billing or delivery details, chosen collection point, purchased items, payment status and order correspondence. We use these to enter into and fulfil your purchase, arrange delivery, handle returns and answer order questions.

Accounts: your contact and login details, saved addresses and order history, used to provide and protect your account.

Messages and comments: information you submit through forms or email. Public comments may display your chosen name, website link, comment and avatar; your email address is not published. Technical information such as IP address and browser details may be processed for spam prevention and security.

Technical data: information needed to maintain the website, keep your basket working, remember language choices and protect the service from abuse.

Optional cart reminder

If you choose the optional cart-reminder checkbox at checkout, we store your email address, basket contents, language and consent time to send one reminder approximately 24 hours later. Leaving the box unchecked does not enrol you. Withdrawing the choice, unsubscribing or placing an order stops the reminder. Reminders are limited to products available to buy online; every reminder includes an unsubscribe link. This choice does not subscribe you to a newsletter.

2. Our legal grounds

We process purchase and account data to perform a contract or take steps you request before a purchase (GDPR Article 6(1)(b)). Accounting and other legally required records are processed to meet legal obligations (Article 6(1)(c)). Security, fraud prevention, handling correspondence and defending legal claims rely on our legitimate interests, balanced against your rights (Article 6(1)(f)). Where consent is required, including for optional marketing, we rely on consent (Article 6(1)(a)).

Browsing the site or placing an order does not itself mean that you consent to marketing. You can withdraw a consent without affecting the lawfulness of processing already carried out.

3. Who receives information

We share the information needed to provide the service with payment and delivery partners, hosting and website-support providers, and accounting or professional advisers where necessary. Authorities may receive information where required by law.

• Montonio and payment providers: process payments and related transaction information. Bank credentials are entered in the payment provider’s environment, not sent to us through an ordinary contact form. See Montonio’s privacy policy.
• Delivery providers: receive the recipient and shipment details needed for the chosen service. Options may include Unisend, SmartPosti, DPD, Omniva and Montonio International Shipping, depending on destination.
• Cloudflare Turnstile: checks form interactions to prevent spam and abuse and may process IP address, browser and device signals. See Turnstile’s privacy notice.
• Google Maps: the Contact and Tallinn shop pages offer an optional interactive map. It does not load until you allow it through the privacy controls or choose “Allow Google Maps”. If you allow it, your browser connects to Google, which may receive technical information including your IP address and browser details. You can withdraw permission through “Privacy choices” in the footer by choosing “Essential only”. An external directions link opens Google’s service separately. Google’s services are governed by Google’s privacy policy.
• Google Analytics: with your permission, receives visit and shopping-event statistics, cookie identifiers and browser/device information. See Google’s privacy policy.
• tawk.to chat: loads when you open the chat. It processes your messages, any contact details you provide and technical information such as IP address and browser details to provide customer support. See tawk.to’s privacy policy.
• Gravatar: article or comment avatars may connect to Automattic’s Gravatar service using an email-derived identifier. See Automattic’s privacy policy.

Some providers operate internationally and may process information outside the European Economic Area. Their notices explain the locations, roles and transfer arrangements for their services. Applicable data-protection safeguards must be used where required.

4. Cookies and embedded services

Cookies and similar storage keep the basket, checkout, login, language and remembered age confirmation working. If you choose to remember comment details, your browser may store them for a later visit. Blocking essential cookies can prevent these features from working.

Your privacy choices: necessary first-party consent cookies remember your choices. The bleiz_privacy_v2 cookie records the categories you allow or decline for up to 182 days, or until you change the choice or clear the cookie. Additional first-party preference cookies communicate these choices to compatible site features. Open “Privacy choices” in the footer to change your choices or choose “Essential only” to withdraw permission for optional services.

Google Analytics starts only after you allow Statistics in privacy settings. It measures visits, page views, products added to the basket and purchases using cookie identifiers and browser/device information. Account and password recovery pages are excluded. Withdrawing permission disables measurement and removes Analytics cookies. Google Maps has a separate optional choice. Advertising tracking is disabled.

5. How long information is kept

Accounting documents: records required by Estonian accounting law are generally kept for seven years from the end of the relevant financial year.

Account information: kept while the account is maintained. You can request account closure; order, accounting or dispute records that must still be retained are handled separately.

Orders, messages and claims: kept to fulfil the order, resolve the matter and, where necessary, establish or defend claims during the applicable limitation periods. Relevant records may be kept longer for an ongoing dispute or legal obligation.

Published comments: remain with the discussion unless removed; you can request review or removal. Technical and security records are retained according to the security purpose and the relevant service’s settings. Contact us if you need details about a particular record.

6. Your rights and how to use them

You may request access, correction, deletion, restriction of processing or a portable copy of your data where the relevant right applies. You may object to processing based on legitimate interests, and withdraw a consent at any time. Some information cannot be deleted immediately because we must keep it by law or for a valid legal claim.

Write to info@bleiz.ee. We may ask for information needed to verify your identity. We normally respond within one month; if a lawful extension is necessary, we will explain it.

You can complain to the Estonian Data Protection Inspectorate or another competent data-protection authority.

7. Security and changes

We use reasonable organisational and technical measures to protect personal information and limit access to people and providers who need it. No internet service can promise absolute security. This notice does not remove your statutory rights or our legal responsibilities.

We update this notice when our practices change and show the revision date above. A privacy notice informs you about processing; continued browsing is not blanket consent to every future change.