Privacy Policy

1. General provisions

1.1. This privacy policy sets out the principles for collecting, processing and storing personal data. Personal data is collected, processed and stored by the data controller Nainto OÜ (registry code 17369761, VAT no. EE102923179), hereinafter referred to as the data controller.

1.2. For the purposes of this privacy policy, a data subject is a customer or any other natural person whose personal data is processed by the data controller.

1.3. For the purposes of this privacy policy, a customer is any person who purchases goods from the data controller’s website onlymens.ee.

1.4. The data controller follows the principles of data processing set out in applicable legislation, including processing personal data lawfully, fairly and securely. The data controller is able to confirm that personal data has been processed in accordance with applicable legislation.

2. Collection, processing and storage of personal data

2.1. The personal data collected, processed and stored by the data controller is collected electronically, mainly through the website, order placement, user account, contact form and e-mail.

2.2. By sharing their personal data, the data subject grants the data controller the right to collect, organise, use and manage the personal data defined in this privacy policy for the stated purposes, which the data subject directly or indirectly provides to the data controller when purchasing goods on the website.

2.3. The data subject is responsible for ensuring that the data provided by them is accurate, correct and complete. Knowingly submitting false data is considered a breach of this privacy policy. The data subject is required to notify the data controller immediately of any changes to the submitted data.

2.4. The data controller is not liable for any damage caused to the data subject or third parties as a result of false data submitted by the data subject.

3. Processing of customers’ personal data

3.1. The data controller may process the following personal data of the data subject:

• first name and surname;
• telephone number;
• e-mail address;
• delivery address;
• billing and payment data to the extent necessary for fulfilling the order and verifying the payment;
• order history and details of purchased products;
• content of messages and enquiries sent by the customer to the data controller;
• user account data, if the customer creates an account in the online store;
• technical data related to website usage, such as IP address, device and browser data, and cookie data.

3.2. In addition to the above, the data controller has the right to collect data about the customer that is available in public registers.

3.3. The legal basis for processing personal data is Article 6(1)(a), (b), (c) and (f) of Regulation (EU) 2016/679 of the European Parliament and of the Council:

• a) the data subject has given consent to the processing of their personal data for one or more specific purposes;
• b) the processing of personal data is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• c) the processing of personal data is necessary for compliance with a legal obligation to which the controller is subject;
• f) the processing of personal data is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

3.4. Processing of personal data according to the purpose of processing:

3.4.1. Purpose of processing – processing and fulfilling orders
Maximum retention period of personal data – up to 7 years from the fulfilment of the order, unless a longer retention obligation arises from applicable legislation.

3.4.2. Purpose of processing – delivery of goods
Maximum retention period of personal data – up to 7 years from the fulfilment of the order, unless a longer retention obligation arises from applicable legislation.

3.4.3. Purpose of processing – ensuring the functioning of online store services
Maximum retention period of personal data – up to 3 years or until the purpose of processing has been fulfilled.

3.4.4. Purpose of processing – customer management and responding to customer enquiries
Maximum retention period of personal data – up to 3 years from the last communication with the customer.

3.4.5. Purpose of processing – financial activities and accounting
Maximum retention period of personal data – according to the time limits provided by law.

3.4.6. Purpose of processing – marketing and sending newsletters
Maximum retention period of personal data – until the data subject withdraws consent or unsubscribes from newsletters.

3.4.7. Purpose of processing – website usage statistics and improving user experience
Maximum retention period of personal data – according to the retention periods specified in the cookie settings or until consent is withdrawn.

3.5. The data controller has the right to share customers’ personal data with third parties, such as authorised processors, accounting service providers, IT service providers, online store hosting service providers, transport and courier companies, and payment service providers.

The data controller is the controller of personal data. The data controller transfers the personal data necessary for making payments to the authorised processor AS LHV Pank.

3.6. When processing and storing the data subject’s personal data, the data controller applies organisational and technical measures that ensure the protection of personal data against accidental or unlawful destruction, alteration, disclosure and any other unlawful processing.

3.7. The data controller stores data subjects’ data depending on the purpose of processing, but not longer than is necessary for fulfilling the purpose of processing or complying with obligations arising from legislation.

4. Rights of the data subject

4.1. The data subject has the right to access and review their personal data.

4.2. The data subject has the right to receive information about the processing of their personal data.

4.3. The data subject has the right to supplement or correct inaccurate data.

4.4. If the data controller processes the data subject’s personal data on the basis of the data subject’s consent, the data subject has the right to withdraw consent at any time.

4.5. To exercise their rights, the data subject may contact the online store’s customer support at info@onlymens.ee.

4.6. The data subject may also file a complaint with the Estonian Data Protection Inspectorate to protect their rights.

5. Cookies

5.1. The online store may use cookies to ensure the proper functioning of the website, improve user experience, analyse website usage, and display relevant content and advertisements.

5.2. Necessary cookies are required for the basic functions of the website and generally cannot be disabled.

5.3. Analytical and marketing cookies are used only if the customer has given consent, unless otherwise permitted by applicable legislation.

5.4. The customer can manage the use of cookies through the cookie notice displayed on the website or through their browser settings.

6. Final provisions

6.1. These data protection terms have been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as the legislation of the Republic of Estonia and the European Union.

6.2. The data controller has the right to amend these data protection terms in whole or in part by notifying data subjects of changes through the website onlymens.ee.

6.3. Contact details of the data controller:

Nainto OÜ
Registry code: 17369761
VAT no.: EE102923179
Address: Harju County, Kuusalu Parish, Kuusalu Small Borough, E. Ahrensi tn 14-10, 74601, Estonia
E-mail: info@onlymens.ee
Phone: +372 5848 6135
Website: onlymens.ee