Privacy Policy
Effective from 9 September 2026.
This privacy policy explains what personal data we collect in the artisanhoney.ee online shop, why we use it, who we share it with, and what rights you have over your data. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.
1. Who processes your data
The data controller is:
- Artisan Honey OÜ
- Registry code 12416510
- Helgi tee 2, Peetri, 75312 Harju county, Estonia
- E-mail: info@artisanhoney.ee
- Phone: +372 56 359 556
- Online shop: artisanhoney.ee
For any data protection question, or to exercise your rights, write to info@artisanhoney.ee. We have not appointed a data protection officer, as our activities do not require one.
2. What data we collect
2.1. Data you give us yourself
- When placing an order: first and last name, e-mail address, phone number, delivery address or chosen parcel machine, order contents and total, chosen payment and delivery method, and any comments added to the order.
- As a business customer: company name, registry code, VAT number, billing and delivery address, and the contact person’s name, e-mail and phone.
- Through a quote request, the inquiry cart or the contact form: your name or company name, e-mail, phone, the content of your request, and the products and quantities you are asking about.
- When ordering gift solutions: the text you want on a gift card or engraving and other personalisation details you provide, as well as recipients’ names and addresses if you ask us to deliver directly to them.
- When creating a customer account: username, e-mail, password (stored only in encrypted form), and your saved addresses and order history.
- When you contact us: the information you share by e-mail or phone.
2.2. Data generated when you use the shop
- IP address, browser and device information, language preference;
- pages visited, contents of the shopping cart and inquiry cart, searches made in the shop, referring website;
- web server logs and technical information collected to prevent spam;
- cookie data – see section 6.
2.3. Data we receive from third parties
- From the payment service provider: confirmation that the payment succeeded, the amount and the reference number. We never see or store your bank password or full card number.
- From carriers: tracking and delivery information for your parcel.
- From B2B marketplaces (Ankorstore, Orderchamp): the retailer’s order and contact details when an order reaches us through those channels.
3. Why and on what legal basis we process data
| Purpose | Legal basis | Retention period |
|---|---|---|
| Receiving, fulfilling and delivering orders, and communicating with you about the order | Performance of a contract (GDPR Art. 6(1)(b)) | 3 years from fulfilment of the order |
| Issuing invoices and bookkeeping | Legal obligation (Art. 6(1)(c)), Estonian Accounting Act § 12 | 7 years from the end of the financial year of the transaction |
| Answering quote requests, inquiry cart requests and contact form messages, and preparing offers | Steps prior to entering into a contract (Art. 6(1)(b)) or legitimate interest in business communication (Art. 6(1)(f)) | 3 years from the last contact |
| Managing your customer account | Performance of a contract (Art. 6(1)(b)) | Until the account is deleted |
| Handling returns, complaints and warranty claims | Legal obligation (Art. 6(1)(c)) and legitimate interest in defending legal claims (Art. 6(1)(f)) | 3 years from resolution of the claim |
| Security of the shop, fault detection, fraud and spam prevention | Legitimate interest (Art. 6(1)(f)) | Server logs up to 12 months |
| Visitor statistics and improving the shop (Google Analytics) | Consent (Art. 6(1)(a)) | Up to 14 months |
| Measuring advertising performance and ad targeting (Google Ads) | Consent (Art. 6(1)(a)) | Up to 90 days |
| Sending the newsletter and offers | Consent (Art. 6(1)(a)) | Until consent is withdrawn |
| Making offers to contact persons at business customers and retailers | Legitimate interest in developing the business relationship (Art. 6(1)(f)) | 3 years from the last contact |
Providing the data needed to place an order and issue an invoice is mandatory – without it we cannot perform the sales contract. Providing any other data is voluntary.
4. Who we share data with
We do not sell or rent your personal data. We share it only to the extent needed to provide the service, and only with the following recipients:
- Zone Media OÜ – web hosting and e-mail service (Estonia).
- Montonio Finance OÜ – payment solution (bank links, card payment, MobilePay) and the delivery method and parcel label service (Estonia).
- Carriers – Omniva (AS Eesti Post), DPD Eesti AS, Venipak, Itella / SmartPost, and the international shipping partners in the destination country via Montonio. The carrier receives the recipient’s name, address or parcel machine, phone and e-mail for delivery notifications.
- Merit Tarkvara AS – accounting software in which invoices are issued and stored.
- Google Ireland Limited – web statistics (Google Analytics), advertising (Google Ads) and search performance analysis (Search Console), only on the basis of your consent.
- Send Smaily OÜ – sending the newsletter and offers to people who have consented to receive them (Estonia).
- Legal advisors, auditors, debt collectors or public authorities – only where the law requires it or where it is necessary to establish or defend legal claims.
We have a service agreement with every processor, obliging them to process the data only on our instructions and to keep it secure.
5. Transfers outside the European Economic Area
Most of our partners are located in Estonia or elsewhere in the European Union, and your data is processed within the European Economic Area. When Google services are used, data may also be processed in the United States. In that case the transfer relies on the EU–US Data Privacy Framework recognised by the European Commission and/or on the European Commission’s standard contractual clauses. For international shipments we pass the recipient’s details to the carrier in the destination country, including, where necessary, a carrier outside the EEA, so that the parcel can be delivered.
6. Cookies
A cookie is a small text file that a website stores on your device. Necessary cookies are essential for the shop to work and are used without consent. Statistics, preference and marketing cookies are used only if you have given your consent in the cookie banner.
| Cookie or group | Purpose | Category | Duration |
|---|---|---|---|
| woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | Shopping cart contents and checkout | Necessary | Session up to 2 days |
| wordpress_*, wp-settings-* | Identifying a logged-in user and display settings | Necessary | Up to 1 year |
| pll_language | Remembering the selected language | Necessary | 1 year |
| cmplz_* | Storing your cookie choices | Necessary | Up to 1 year |
| _ga, _ga_* | Google Analytics – visit and session statistics | Statistics | Up to 2 years |
| _gcl_au | Google Ads – measuring advertising performance | Marketing | 90 days |
You can change your choices at any time through the “Cookie settings” link in the website footer. You can also delete and block cookies in your browser settings, but the cart and checkout may then not work properly.
7. Automated decisions and profiling
We do not make automated decisions about you that would have legal or similarly significant effects, and we do not build such profiles.
8. Data security
- The shop uses an encrypted HTTPS connection.
- Customer data is accessible only to those of our staff who need it for their work, and access is password-protected.
- We do not store card details or bank passwords – payment takes place in the secure environment of the payment service provider.
- Data is backed up regularly and software is kept up to date.
9. Your rights
In relation to your personal data you have the right to:
- Access the data we process about you and receive a copy of it.
- Rectify inaccurate or incomplete data.
- Erase your data (the “right to be forgotten”) where there is no legal basis or obligation to keep it. Invoice data must be kept for the 7 years required by law even if you request erasure.
- Restrict processing or object to processing that is based on our legitimate interest.
- Port your data in a machine-readable format to yourself or another service provider.
- Withdraw consent at any time – this does not affect the lawfulness of processing carried out before withdrawal. You can unsubscribe from the newsletter using the link at the end of each e-mail, and change your cookie consent through the footer link.
To exercise your rights, send a request to info@artisanhoney.ee. We reply within one month at the latest. If the request comes from an e-mail address we do not have on record for you, we may ask for additional confirmation so that data does not end up in the wrong hands.
If you believe we are infringing your rights when processing personal data, please tell us first. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, info@aki.ee, +372 627 4135, www.aki.ee), with the supervisory authority of your country of residence, or with a court.
10. Children and age confirmation
The shop is not directed at children and we do not knowingly collect data about persons under 16. The age confirmation shown when viewing gift solutions containing alcohol is stored only on your own device and is not identity verification – it is not processing of personal data in our database.
11. Changes to this privacy policy
As our services or data processing change, we will update this privacy policy. The current version is always on this page and the effective date is shown at the top. In the case of significant changes we also inform customers by e-mail or in the shop.
The terms for using the shop and buying from it are on the Terms and Conditions page.