Privacy Policy

This Privacy Policy explains how Olea Vitalis OÜ processes your personal data when you use the Olea Vitalis online shop at https://www.oleavitalis.com, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Estonian law.

Data controller

The data controller for the Olea Vitalis online shop is:

Olea Vitalis OÜ (the "merchant", "we", "us", "our") Registry code: 14586481 Address: Kopli tn 27, 10412 Tallinn, Estonia Telephone: +372 5618 4769 Email: info@oleavitalis.com

For any question about this policy or about how we process your data, or to exercise your rights, contact us at info@oleavitalis.com.

What personal data are processed

We may process the following categories of personal data:

Name
Contact information (telephone number, email address)
Payer's address and delivery address
Bank account number
Costs of goods and services and data related to payments (purchase history)
Customer support correspondence
Information related to customer surveys and/or offers
Technical and usage data: IP address and online identifiers, device and browser information, and data collected via cookies and similar technologies (see the Cookies and Analytics sections below)

Purposes and legal bases for processing

We process personal data only where we have a legal basis under Article 6 of the GDPR. The table below sets out our main processing purposes and the corresponding legal bases.

Purpose	Legal basis (GDPR Art. 6)
Managing and fulfilling your order, delivery, refunds and customer support	Performance of a contract with you (Art. 6(1)(b))
Keeping accounting records and complying with tax and other legal duties	Compliance with a legal obligation (Art. 6(1)(c))
Site and usage statistics, fraud prevention, security, and improving our store	Our legitimate interests in operating and improving a secure online store (Art. 6(1)(f))
Resolving consumer disputes and establishing, exercising or defending legal claims	Legal obligation and/or our legitimate interests (Art. 6(1)(c) / (f))
Sending direct marketing (newsletters, offers) and setting non-essential cookies	Your consent (Art. 6(1)(a)), which you may withdraw at any time

Where processing is based on our legitimate interests, you have the right to object (see the Your rights section below). Where processing is based on consent, you can withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Recipients and authorised processors

We share personal data with third parties only where necessary for the purposes above, with your consent, or when required by law. Our processors act on our instructions and are bound by data processing agreements. We use the following categories of recipients:

Suppliers (for order delivery): DPD, Itella, Omniva, Venipak
Payment service providers: Stripe, Montonio, Swedbank, SEB, Luminor, LHV, Coop
Email (order confirmations, delivery notices and, with consent, newsletters): Postmark, Brevo
Statistics and analytics: Google Analytics, PostHog, Tawk.to

We may also disclose data to public authorities where we are legally required to do so.

International transfers

Personal data are stored on Vercel servers located within the EU or EEA, or in countries deemed to provide an adequate level of protection by the European Commission. Where data are transferred to processors in the United States or other third countries, the transfer relies on an appropriate safeguard, namely the EU-U.S. Data Privacy Framework (for certified recipients) or the European Commission's Standard Contractual Clauses, together with any additional measures required. You can request more information about these safeguards by contacting us.

Security and access to data

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure. Access to personal data is limited to those who need it to perform their tasks. Data are stored on servers located within the EU or EEA as described above.

Retention

We keep personal data only for as long as necessary for the purposes for which they were collected, or as required by law:

Customer account: data are deleted upon account closure, except where retention is required for accounting or dispute resolution.
Visitor purchase history: 1 year.
Dispute data: 3 years.
Accounting data: 7 years (as required by Estonian accounting law).

When a retention period ends, we delete or anonymise the data.

Cookies

Our website uses cookies and similar technologies. Essential cookies are needed for the store to function; non-essential cookies (including analytics and marketing) are set only with your consent, which you give through our cookie banner (using Google Consent Mode v2) and can change at any time. For details, see our Cookie Policy.

Analytics and advertising tools

PostHog - product analytics hosted in the EU (eu.i.posthog.com), using anonymised events.
Google Analytics 4 - provided by Google LLC; measures sessions, traffic and conversions. It uses Google Consent Mode v2 and loads only after you opt in via the cookie banner.
Google Ads remarketing tag - used for conversion measurement and remarketing; it loads only when the Marketing cookie category is accepted.

Your rights

Under the GDPR, you have the following rights in relation to your personal data:

Access - to obtain confirmation of whether we process your data and a copy of it.
Rectification - to have inaccurate or incomplete data corrected.
Erasure - to have your data deleted ("right to be forgotten") where the conditions are met.
Restriction - to restrict processing in certain circumstances.
Data portability - to receive the data you provided in a structured, commonly used, machine-readable format and to have it transmitted to another controller.
Objection - to object to processing based on our legitimate interests, and to object to direct marketing and related profiling at any time.
Withdraw consent - to withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
Lodge a complaint - to lodge a complaint with a supervisory authority (see below).

To exercise any of these rights, contact us at info@oleavitalis.com. You can also inspect and amend certain data through your account management page. We respond to requests without undue delay and within the time limits set by the GDPR.

Direct marketing

With your consent, we send direct marketing messages such as newsletters and offers. You can opt out at any time via the unsubscribe link in each message or by contacting customer support. You may also object to direct marketing and related profiling by emailing info@oleavitalis.com.

Children

The online store is not directed at children. We do not knowingly collect personal data from children under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

Supervisory authority and disputes

If you consider that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) Email: info@aki.ee

We would, however, appreciate the chance to address your concerns first, so please consider contacting us at info@oleavitalis.com before you do.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing or in the law. The current version is always available in the online store. Please review it periodically.