Privacy notice

Controller and processor

The controller is Starmaker OÜ. The webshop is operated on our behalf by our technology partner Drezon Technologies OÜ (registry code 17516009), acting as a processor under a data-processing agreement and bound by the same confidentiality and security obligations described here.

Data we collect

When you place an order: your name, e-mail address, telephone number, and — unless you collect in person — your delivery address. When you pay: no card number ever reaches us; the payment provider handles the card and returns only a reference and a result. When you subscribe to our newsletter: your e-mail address, the language you chose, and the time and IP address of your consent, which is how we can prove the subscription was yours.

How we use it

To take, fulfil and deliver your order; to send you the order confirmation and a dispatch notice; to answer you when you write to us; to meet our accounting and tax obligations; and, if you have agreed, to send you our newsletter and to measure how the shop is used.

Legal basis

Performance of a contract for the order itself. Legal obligation for accounting records. Consent for the newsletter and for analytics — both of which you may withdraw at any time, without affecting anything already done on the basis of the consent you gave before withdrawing it.

Confirming your age, when you buy alcohol

Estonian law does not let us sell alcohol to anyone under 18, so when a page shows alcoholic drinks — or when your basket contains one — we ask you to confirm that you are over 18.

That confirmation is your own statement, and we treat it as exactly that. We do not ask for your ID-card, we do not read your personal identification code, and we do not run any electronic identity check. All we record is that we asked, what you answered, and when. A signed cookie called oh_age remembers your answer for thirty days so you are not asked on every page.

The real check happens at the door. The courier — or our own staff, if you collect in person — checks a physical identity document when the alcohol is handed over, and will not leave it with anyone under 18 or in a parcel machine. That check happens in person and nothing from it is recorded by us.

The legal basis for recording your answer is our legal obligation as a licensed seller of alcohol.

Who else sees your data

We share only what each recipient needs. Montonio processes bank and card payments — payment initiation is provided by Montonio Finance UAB in Lithuania, supervised by the Bank of Lithuania — and Stripe processes international card payments. Swotzy and the carrier it books receive the delivery address, the recipient's name and telephone number so the parcel can arrive. Our own restaurant system, Haldus, receives gift-card and accounting records. Our accountant and, where the law requires it, the Estonian Tax and Customs Board receive invoice and export records. Nobody receives your data for their own marketing, and we do not sell it.

Keeping the shop safe from fraud

We record the IP address an order was placed from, and we count how many payment attempts come from one address or one e-mail. This is how the shop survived a card-testing attack that put over nine thousand declined charges through the previous system, and it is why a stranger cannot use this shop to test stolen cards at your expense. The legal basis is our legitimate interest in preventing fraud and in keeping the shop working for everyone else. These records are kept with the order and are not used to profile you or to make any automated decision about you as a person.

Sending your parcel outside the EU

If we send goods to you outside the European Union, the sale is an export and customs paperwork has to name a sender and a recipient. Your name, address and the contents and value of the parcel therefore appear on the customs declaration and are seen by the carrier and by the customs authorities of both countries. We keep the export documents with the order because the tax authority may ask us to prove the parcel left the Union. That is a legal obligation, not a choice.

Where your data goes

Our own servers are in the European Union. Two recipients are not: Stripe and Google are United States companies. Both are covered by the European Commission's adequacy decision for the EU-US Data Privacy Framework, and both are also bound by standard contractual clauses. Google only receives anything at all if you accepted analytics on the cookie bar. If you would rather nothing reached them, decline — the shop works exactly the same either way.

How long we keep it

Your rights

You may ask for a copy of the data we hold about you, ask us to correct it, ask us to delete it where no legal obligation requires us to keep it, object to processing, or ask for it in a portable form. Write to us and we will answer. You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Cookies

Analytics

We use Google Analytics to understand how the shop is used — which pages are read, which are not, and where people give up. No analytics script is loaded and no analytics cookie is set until you accept on the cookie bar. The tag does not exist in the page beforehand, so there is nothing to run and nothing to switch off. Advertising and remarketing signals are explicitly denied. You can change your answer at any time using the Cookies link at the foot of any page.

Changes

If this notice changes materially, we will ask for your cookie consent again rather than assume the answer you gave to the previous wording still stands.

Contact

Write to info@shoppe.ee or Vana turg 1, 10140 Tallinn, Estonia.