Privacy Policy

Controller

The controller of your personal data is the trader identified at the bottom of this page. Data protection questions can be sent to that address and are answered within 30 days.

What we collect

• Order data: name, delivery address, email, phone, order contents and totals. Provided by you at checkout.
• Account data: email, name and a password hash, if you choose to create an account. Passwords are hashed with bcrypt and are never stored or transmitted in readable form.
• Payment data: handled entirely by Stripe. We receive a payment reference, the amount, the outcome and the last four digits of the card. We never see or store full card numbers.
• Newsletter data: email address, language, consent flag, timestamp and a hashed IP address kept as proof of consent.
• Technical data: a session cookie, a bag cookie, a language cookie and a consent cookie. Analytics identifiers are only created after you consent.

Why we process it

• To perform the contract you entered into when placing an order (Art. 6(1)(b)): taking payment, arranging production and delivery, handling returns.
• To meet legal obligations (Art. 6(1)(c)): accounting and tax records.
• With your consent (Art. 6(1)(a)): the newsletter, analytics cookies and marketing cookies. Consent can be withdrawn at any time.
• For our legitimate interests (Art. 6(1)(f)): fraud prevention, securing the store and answering support requests.

Who we share it with

Data is shared only with the processors needed to run the store, under data processing agreements, and never sold.

• Stripe Payments Europe: payment processing.
• Printful: production and dispatch. Receives your name, delivery address and the items ordered.
• The carrier assigned to your parcel: name, address and contact details for delivery.
• Our email provider: transactional order email and, with consent, Field Notes.
• Our hosting provider: storage and serving of the site and database.

International transfers

Some processors operate outside the European Economic Area. Where that happens, transfers rely on the European Commission’s Standard Contractual Clauses or an adequacy decision.

How long we keep it

• Order and invoice records: 7 years, as required by accounting law.
• Account data: until you delete the account.
• Newsletter data: until you unsubscribe, plus a short record of the withdrawal.
• Consent records: up to 6 months from the choice, then the banner asks again.

Your rights

• Access: a copy of the personal data we hold about you.
• Rectification: correction of anything inaccurate.
• Erasure: deletion, where no legal retention obligation applies.
• Restriction and objection: including objecting to processing based on legitimate interests.
• Portability: your data in a machine-readable format.
• Withdrawal of consent: at any time, without affecting processing already carried out.
• Complaint: to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.

Security

The store runs over HTTPS with HSTS, a strict Content Security Policy and modern security headers. Administrative access is role-restricted and re-checked on every request. Payment card data never reaches our servers.