Privacy notice
Last updated 22.08.2026
This notice explains what personal data the Prindla shop collects, what it is used for, how long it is kept and what rights you have. It covers this shop only.
Who processes the data
- Controller
- Prindla OÜ
- Registry code
- 17576419
- VAT number
- EE103018151
- Address
- Uus-Kalamaja tn 2/1-6, Põhja-Tallinna linnaosa, 10415 Tallinn, Harju maakond
- admin@prindla.ee
- Website
- https://www.prindla.ee
We are not required to appoint a data protection officer – the email address above answers data protection questions.
What data and what for
| Data | Purpose | Legal basis |
|---|---|---|
| Email, name, phone | Account, order confirmation and delivery notices | Performance of a contract |
| Delivery and billing address | Delivering the goods and issuing the invoice | Performance of a contract, legal obligation |
| Order rows, amounts, payment record | Fulfilling the order and accounting | Performance of a contract, legal obligation |
| Password (only as a cryptographic hash) | Signing in | Performance of a contract |
| Cart contents | Remembering the cart between visits | Legitimate interest |
| Log of sent emails | Proving that a notice was sent; customer support | Legitimate interest |
| Product review (shortened name, e.g. “Mari K.”) | Publishing the review in the shop | Consent |
| Server logs, including the IP address | Security, preventing abuse | Legitimate interest |
The data comes from you: when you create an account, at checkout and when you edit your profile. We do not buy or collect data from anywhere else.
Who we share the data with
- Payment service provider Maksekeskus AS – to process the payment we pass on your email address and IP address, together with the order total and reference number. For this data Maksekeskus AS (registry code 12268475, Liivalaia 45, 10145 Tallinn, Estonia) acts as Prindla OÜ’s authorised processor. You choose the payment method and pay in their secure environment.
- Hosting provider – the server the shop and the database run on.
- Email service provider – order confirmations and notices travel through a mail server, so the recipient address and the content of the email reach it.
- The carrier you choose with your order – the recipient name, the address or chosen parcel machine, and the phone number, so the parcel can reach you. The data goes only to the carrier you selected at checkout: Omniva or SmartPost (Itella Estonia OÜ). The other carrier sees nothing about your order.
- Accounting – invoices and payment records. Prindla OÜ does its own accounting: we use no external accounting service and invoices are not passed to any third party.
We neither collect nor see card details or bank credentials. Both card payments and bank links go through Maksekeskus AS. You enter card details and bank credentials on the Maksekeskus page or your own bank’s page and they go straight there – they never reach this shop and are not stored here.
How long we keep the data
| Data | Retention period |
|---|---|
| Orders, invoices and payment records | 7 years from the end of the financial year (Accounting Act) |
| Account and address book | Until the account is deleted |
| Content of sent emails | 12 months, after which only the fact of sending remains |
| Guest cart | 30 days from the last change |
When an account is deleted we anonymise the account and delete the address book, carts and the content of emails. Orders remain without a link to the account, because an invoice is an accounting source document that the law requires us to keep.
Your rights
You can do most of it yourself on your account page:
- View and correct your name, phone, email and addresses.
- Download your data in a machine-readable format (JSON).
- Delete your account – described above.
- Change your password, which also ends every other session.
You also have the right to request a restriction of processing, to object to processing based on legitimate interest and to withdraw a consent you have given (e.g. for publishing a review). Write to admin@prindla.ee – we answer within one month.
If you do not have an account, you can view your order through the order lookup using the order number and your email.
Cookies
The shop uses only those cookies and browser-stored keys that are strictly necessary for the service to work. There is no analytics, no advertising pixels and no third-party trackers, so no consent banner is needed.
| Name | Role | Lifetime |
|---|---|---|
eshop_token | Keeps you signed in. JavaScript cannot see it. | 12 hours |
eshop_cart_token | Links the cart to the browser when you are not signed in. | Until the cart is emptied |
eshop_session | A “session exists” marker so the header does not flicker when the page opens. | Until you sign out |
Security
Passwords are never stored in readable form – not even we can see or recover your password. Signing in is protected so that code running on the page cannot get hold of your session, and changing your password ends every other session. The number of consecutive sign-in attempts is limited.
Right to complain
If you believe we process your data incorrectly, write to us first. You also have the right to turn to the Estonian Data Protection Inspectorate (www.aki.ee).
Changes
If the content of this notice changes, we update the date above. We notify account holders of significant changes by email.