This privacy policy describes how Kinevo OÜ processes personal data when you visit www.kinevo.ee, place an order or contact us.

Controller

The controller of personal data is Kinevo OÜ, registry code 16759810, Aia tn 4-21, 10111 Tallinn, Estonia; email info@kinevo.ee; telephone +372 5627 8860. For data protection questions, write to the same email address.

What data we process, why and on what basis

Fulfilling orders. Name, email address, telephone number, billing address, chosen parcel machine, order contents and notes. Basis: performance of a contract (Article 6(1)(b) of the General Data Protection Regulation, GDPR).
Payment. Order details, amount and payment status. Card details are entered on the payment provider’s page and we do not see them. Basis: performance of a contract (point (b)).
Accounting. Invoice and order details. Basis: legal obligation (point (c)), the Estonian Accounting Act.
Customs clearance when shipping outside the European Union. Name, address, telephone number, parcel contents and value. Basis: performance of a contract (point (b)) and legal obligation (point (c)).
Customer service, custom orders, withdrawals and complaints. Contact details, message content, order details and the content of a withdrawal statement or complaint. Basis: making and performing a contract (point (b)), legal obligation (point (c)) and our legitimate interest in resolving claims (point (f)).
User account and wishlist. Account details, order history and saved products. Basis: contract (point (b)).
Order notification in our work tool. When an order is paid, we receive a notification in Slack containing the name, email address, telephone number, note, products and amounts. Basis: legitimate interest in fulfilling orders quickly (point (f)).
Newsletter. Email address and related usage data, if you tick the optional box at checkout or sign up through a form. Basis: consent (point (a)). You can withdraw consent at any time through the link in the newsletter or by writing to us. This does not affect the lawfulness of earlier processing.
Asking for feedback and reviews. A few days after an order we may send an email asking you to review the product. We use your name, email address and order details for this. A published review shows your name. Basis: legitimate interest in receiving feedback (point (f)); you can object at any time by writing to us.
Running and securing the website. IP address, browser details, time of visit, login details and logs. Basis: legitimate interest in keeping the website working and secure (point (f)).
Visit statistics. Data from cookies and similar tools, IP address, pages viewed and device details, used by Google Analytics to measure visits. See “Cookies”.
Advertising measurement. Data from cookies and similar tools, IP address, pages viewed and device details, used by the Meta pixel to measure advertising. To measure advertising results, the shop may also send Meta shop events such as a purchase from our server (Conversions API), together with browser identifiers and IP address, the products and order value and, in hashed form, the email address, name, telephone number, city, region, postal code, country and customer number. See “Cookies”.
Recognising the browser for marketing. Data from cookies and similar tools, IP address, pages viewed and device details, used by Klaviyo to recognise the browser for newsletter and marketing. See “Cookies”.
Where a visit came from. The sbjs_* cookies record where the visitor came from, and this is saved with the order so that we can see which channels bring orders. See “Cookies”.
Order and checkout data in the marketing tool. Order details (name, email address, telephone number, address, products, amounts) and the name and email address entered at checkout together with the cart contents are sent to Klaviyo and stored there in a customer profile, even if you do not subscribe to the newsletter.

Order details are needed to make and perform the contract: without them we cannot accept or deliver an order. Signing up for the newsletter is voluntary.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

The Kinevo shop is not aimed at children. A child under 13 can sign up for the newsletter only with the consent of a parent or guardian.

Cookies

Cookies are small files that a website stores in your browser. Some of the cookies below are stored when you open the website; cart and login cookies are stored when you use those functions. The website does not currently have a separate tool for choosing cookies. You can delete and block cookies in your browser settings; if you block the cookies the shop needs to work, the cart and checkout may not work.

Cookie	Service	Purpose	Duration
woocommerce_, wp_woocommerce_session_, wordpress_*	Kinevo shop	Cart, checkout and login	End of session or up to 14 days
montonio_tz	Montonio	Time zone, to show suitable payment methods	30 days
sbjs_*	Kinevo shop (WooCommerce)	Where the visitor came from; linked to the order	End of session
_ga, _ga_3X3P0X9Y4R	Google Analytics	Visit statistics	400 days
_fbp	Meta	Telling browsers apart to measure advertising	90 days
__kla_id	Klaviyo	Recognising the browser for newsletter and marketing	400 days

Klaviyo also stores similar data in the browser’s local storage.

Who receives your data

We share data with the following service providers and authorities:

Hosting and maintenance: Zone.ee (hosting, database, logs), ReSense (website maintenance, access to website data), a backup storage service.
Payments and delivery: Montonio (payments and shipping), Omniva, DPD and SmartPosti (name, telephone number, email address, address or parcel machine). Outside the European Union, the destination country’s postal operator and customs authorities also receive the parcel details.
Email and work tools: Mailgun (order emails, European Union region), Microsoft 365 (our mailboxes), Slack (order notifications).
Newsletter and marketing: Klaviyo, which also receives order and checkout data even if you do not subscribe to the newsletter (see above).
Statistics and advertising measurement: Google (Google Analytics) and Meta (Meta pixel and events sent from our server).
Website content and security: Google Fonts and jsDelivr (loading files, IP address), Gravatar (profile pictures with reviews), Wordfence (firewall and login protection).
Instagram (Meta): if you message us on Instagram, Meta also processes the message.
Authorities: where the law requires it, for example the Estonian Tax and Customs Board or a court.

Transfers outside the European Economic Area

Google, Meta, Klaviyo, Slack, Microsoft, Wordfence, Gravatar or companies in their groups may process data outside the European Economic Area, including in the United States. The safeguards are:

Klaviyo (stores data in the United States): the European Commission adequacy decision for the EU-US Data Privacy Framework, under which Klaviyo is certified; standard data protection clauses where the framework does not apply.
Google (Google Analytics, Google Fonts): the same adequacy decision, under which Google LLC is certified; standard data protection clauses where the framework does not apply.
Meta: the same adequacy decision, under which Meta Platforms, Inc. is certified; Meta may also use standard data protection clauses.
Slack: the same adequacy decision, under which Slack Technologies, LLC is certified, and standard data protection clauses where they apply.
Microsoft (Microsoft 365): standard data protection clauses.
Wordfence (Defiant, Inc., United States): standard data protection clauses.
Gravatar (Automattic, United States): standard data protection clauses.

Other providers named above, in particular Mailgun, jsDelivr and the backup storage service, may also process data outside the European Economic Area through their own subcontractors. You can ask us by email which safeguard applies.

If you order goods to a destination outside the European Economic Area, we send the parcel details to the destination country’s postal operator and customs authorities. For Switzerland, Japan and New Zealand, and for commercial organisations in Canada, the transfer relies on a European Commission adequacy decision. Where no adequacy decision or other safeguard covers the recipient, for example in the United States, Australia, Singapore, Malaysia and the United Arab Emirates or for a customs authority outside the scope of a decision, we send only the details needed for the parcel you ordered, because the transfer is necessary to perform the contract with you (Article 49(1)(b) GDPR). You can ask for more information about the safeguards and a copy by email.

How long we keep data

Source accounting documents (invoices and the related order details): seven years from the end of the financial year.
Other order details, correspondence, withdrawal statements and complaints: for as long as needed to perform the contract and to establish, exercise or defend legal claims.
Enquiries and custom order requests that did not lead to a contract: for as long as needed to answer the enquiry and deal with any follow-up.
User account: until the account is closed; order details are kept for the periods above.
Newsletter: until consent is withdrawn.
Reviews: until you ask for them to be removed.
Web server logs: access logs for about one week and error logs for about two weeks.
Shop system logs: about 30 days.
Security tool (Wordfence): traffic and blocking records for about 30 days. For login attempts, the tool keeps about the 2,000 most recent records and deletes older ones automatically, so how long a record is kept depends on the number of login attempts.
Cookies: see the table above.

We may keep a log for longer if it is needed to investigate a security incident or to establish, exercise or defend a legal claim.

Automatic backups of the website, which include the database, are kept for about two weeks. For backups made manually, we keep the two most recent sets and delete older sets when a new backup is made. Personal data in a backup remains there until that backup is deleted, even if it has already been deleted from the website.

Your rights

You have the right to:

access your data and receive a copy of it;
have inaccurate data corrected;
have data erased when there is no longer a basis for keeping it;
have processing restricted;
object to processing based on legitimate interest;
receive the data you provided in a machine-readable format and have it sent to another controller, where processing is based on contract or consent;
withdraw consent at any time.

To use these rights, write to info@kinevo.ee. We reply within one month, free of charge. If needed, we will ask you to confirm your identity.

Complaints

You have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): Tatari 39, 10134 Tallinn; email info@aki.ee; advice line 5620 2341; www.aki.ee. You may also go to the supervisory authority of the country where you live or work, or to a court.

Changes

If our data processing changes, we will update this page.