This privacy notice sets out the principles and procedures under which KODUPABER AS (hereinafter ‘Aren’ or ‘we’) processes the personal data of its customers and visitors to the website www.aren.ee.
General Principles
The purpose of this privacy notice is to ensure the protection of personal data and to provide transparent information on how Aren collects, uses and protects customers’ personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Estonian Personal Data Protection Act. This policy applies to all Aren’s customers, newsletter and social media subscribers, and website users (hereinafter ‘customer’).
Data controller
Data controller: KODUPABER Public Limited Company
Registration number: 10090317
Address: Harju County, Tallinn, Mustamäe district, Karjavälja Street 10, 12918
Email: info@aren.ee
Telephone: +372 680 6000
Please send all enquiries and requests relating to the processing of personal data to the email address info@aren.ee.
Personal data processed
Aren collects and processes personal data from the following sources: data provided by the customer when placing an order or using the website, communications with customer service, and technical data collected automatically.
The personal data processed may include the following:
- First name and surname, personal identification number
- Contact details: email address, telephone number
- Position of representatives of business customers
- Cost of goods and services and payment-related data (purchase history)
- Delivery details: delivery address, billing address
- Payment details: bank account number, payment card number (last 4 digits), payment method
- Information relating to customer surveys and/or offers
- Technical data: non-personalised data resulting from visits to and use of the online shop: IP address, device details, session and cookie information
- Information not mentioned above that is necessary for communication with customer support
Purpose and legal basis for the processing of personal data
To fulfil the contract
| Purpose of processing | Personal data processed |
| Fulfilment of orders | First name and surname, contact details, payment details |
| Delivery and returns of goods | Delivery information |
| Customer communication and support | First name and surname, contact details, job title, delivery information, payment details, purchase history, information relating to customer surveys and offers |
To comply with a legal obligation
| Purpose of processing | Personal data processed |
| Refunds | First name and surname, payment details |
| Accounting | First name and surname, payment details, purchase history |
| Resolution of consumer disputes | First name and surname, contact details, job title, delivery information, payment details, purchase history, information relating to customer surveys and offers, technical data |
Based on consent
| Purpose of processing | Personal data processed |
| Sending newsletters | Contact details |
| Personalised advertising | Contact details, purchase history, technical data |
| Consumer games | First name and surname, contact details |
On the basis of legitimate interest
| Purpose of processing | Personal data processed |
| Analysis of customer preferences and offers | Contact details, purchase history, information relating to customer surveys and offers, technical data |
| Improvement of services | Technical data |
| Ensuring security | Technical data |
Disclosure of personal data to third parties
We keep the personal data of our customers that has been disclosed to us confidential and will only disclose it to third parties with the customer’s consent, unless an obligation or right to disclose the data arises from legislation.
Aren’s customers agree that Aren has the right to process their data for the purpose of providing services to them, including the transfer of customers’ personal data to processors authorised by Aren.
Aren uses authorised processors for the following services:
- Information technology service
- Business software services
- Payment processing
- Delivery
- Marketing and statistics
Data security
Aren stores personal data on servers located within the territory of a Member State of the European Union or a country that has joined the European Economic Area. Data may be transferred to countries whose level of data protection has been deemed adequate by the European Commission, and to US companies that have joined the Data Privacy Framework.
Aren implements appropriate technical and organisational security measures to protect personal data against unauthorised access and disclosure, accidental or unlawful alteration, loss and destruction.
Access to personal data is restricted to our employees who need to access such data in order to resolve technical issues relating to the performance of a contract and to provide customer support services. Access to personal data is restricted to authorised staff who require the data to provide services under contracts concluded with them. Authorised processors are obliged to ensure appropriate safeguards when processing personal data.
Retention of personal data
Personal data is retained only for as long as is necessary to fulfil the purpose for which it was collected or to comply with legal obligations:
- E-shop customer account data is retained until the account is closed or the customer requests the deletion of the data, unless such data needs to be retained for accounting purposes or to resolve consumer disputes.
- Data relating to purchases made as a guest in the online shop (without a user account) is retained for 3 years.
- Data relating to payments and consumer disputes is retained until the claim has been settled or for 3 years.
- Marketing data is retained until consent is withdrawn.
- Source documents for accounting purposes are retained for 7 years.
Rights of the data subject
In relation to their personal data, customers have:
- the right to request access to their personal data;
- the right to have their personal data rectified;
- the right to withdraw consent to the processing of personal data;
- the right to have their data erased;
- the right to data portability;
- the right to object to the processing of personal data.
We have a legal obligation to ensure that any actions relating to personal data are carried out at the request of the person entitled to do so. For this reason, our customer support team may require the customer to verify their identity or otherwise prove their right to carry out operations relating to personal data.
To exercise your rights as a data subject, please send a digitally signed enquiry to info@aren.ee. We will respond to all enquiries and requests relating to personal data within one month at the latest.
Access to and rectification of personal data
The customer has the right at any time to obtain information about the processing of their personal data, to restrict the processing of data, and to object to the processing of data in such a way that it does not prevent Areni from providing the service to the customer.
You can access and correct the personal data stored in the online shop by logging in to the online shop using your user account.
If a purchase was made as a guest (without a user account), you can make an enquiry regarding your personal data by sending an email to info@aren.ee.
Withdrawal of consent
Where the processing of personal data is based on the customer’s consent, the customer has the right to withdraw their consent by logging into the online shop using their user account; and, as a guest (without a user account), they may withdraw their consent by sending an email to this effect to info@aren.ee.
For information on withdrawing consent to receive newsletters, see point 9.
Deletion (‘right to be forgotten’)
You have the right to request the erasure of your personal data. Please note that we cannot erase data that we process in order to fulfil contractual or legal obligations.
To request the erasure of your personal data, please send an email to info@aren.ee.
Portability
You can submit a request regarding the portability of personal data by emailing info@aren.ee. In order to facilitate the portability of personal data, customer support must verify the customer’s identity and inform them of the personal data to which the portability applies.
Submitting a complaint
Disputes relating to the processing of personal data are resolved through our customer support.
Customers have the right to lodge a complaint regarding any breach of their privacy and data protection rights with the Data Protection Inspectorate (Tatari 39, 10134 Tallinn, +372 627 4135, info@aki.ee).
Newsletters and personalised advertising
We use the customer’s email address to send newsletters. We use standard tracking pixels to collect anonymous statistics based on the newsletters. To unsubscribe from newsletters, the customer must either use the unsubscribe link in the footer of the email or contact our customer support.
Where personal data is processed for the purpose of personalised advertising, the customer has the right to object at any time to both the initial and any further processing of their personal data and to withdraw their consent by sending an email to this effect to info@aren.ee.
Social media
Customers can follow or like our Facebook, Instagram, LinkedIn and TikTok pages. In such cases, we will see your name and, by clicking on that name, we will also see the information on your public profile.
When it comes to social media, customers should bear in mind that:
- our pages are public and visible to everyone;
- anyone can publish posts on our social media pages and link to our social media pages and their public content;
- where possible, we allow automatic translation of posts;
- we use automatic content filtering on social media, which automatically prevents the publication of posts containing offensive language;
- customers may contact us privately via social media.
Aren collects statistical usage data from its social media pages, including likes, the number of site visits, etc. This data, in a non-personally identifiable form, is compiled and provided to us by marketing and statistics service providers.
Use of cookies
Aren uses cookies on its website and online shop to provide its services; the purpose of these cookies is to ensure the secure operation of the website, to improve its functionality and user experience, and to collect anonymous statistics.
Customers can manage or delete cookies via their web browser settings. If cookies are disabled, not all website features may work properly.
Further information about cookies can be found in the ‘Cookies’ section of the website.
Automated decision-making
Automated decision-making occurs when an electronic system uses personal data to make a decision without human intervention. Aren does not make automated decisions based on the personal data we collect.
Changes to this Privacy Notice
Aren may update this privacy notice in line with changes to legislation or as necessary. The current version is always available on our website.