General Provisions

1.1. This privacy policy governs the collection, processing, and storage of personal data by Awero OÜ (registry code 16456392), located at: Valga County, Otepää Municipality, Sihva Village, Vokipoe, 67301 (hereinafter the data controller).

The data subject is a customer or other natural person whose personal data is processed by the data controller.

A customer is anyone who purchases goods or services from the data controller’s online store.

1.4. The data controller complies with applicable legislation in the processing of personal data and processes data lawfully, fairly, and securely. The data controller is able to demonstrate compliance with applicable legislation in the processing of personal data.

2.Collection, Processing, and Storage of Personal Data

2.1. Personal data is collected electronically via the website, email, and, if necessary, on paper.

2.2. By providing data, the data subject grants the data controller the right to process such personal data for the purposes defined in the privacy policy.

2.3. The data subject is responsible for the accuracy of the data provided and is obliged to notify the data controller of any changes in the data.

2.4. The data controller is not liable for any damage resulting from the submission of incorrect data.

Processing of Customers’ Personal Data

3.1. Processed personal data:

• First and last name
• Date of birth (if necessary)
• Phone number
• Email address
• Delivery address
• Bank account number
• Payment details (purchase history)
• IP address
• Customer support communication data

3.2. The data controller may also collect data available in public registers.

3.3. The legal basis for processing personal data is:

• GDPR art 6(1)(a) – consent of the data subject
• GDPR art 6(1)(b) – performance of a contract
• GDPR art 6(1)(c) – compliance with a legal obligation
• GDPR art 6(1)(f) – legitimate interest

3.4. Processing purposes and retention periods:

3.5. Transfer of personal data:

Personal data may be shared with the following parties:

• Maksekeskus AS – for payment processing
• Transport and courier companies – for goods delivery
• Accounting service providers – for fulfilling legal obligations
• IT service providers – for ensuring website functionality and data hosting

All authorized processors are obliged to ensure data protection in accordance with GDPR Article 28.

3.6. Security and technical measures:

The data controller implements the following security measures:

• Data exchange with the online store occurs via an encrypted TLS connection
• Passwords are stored encrypted (in hashed form)
• Standard encryption is used for sending emails
• Servers are protected by firewalls and antivirus software
• Regular backups are made and stored separately from the server

3.7. Retention period:

Personal data is retained for its intended purpose, but no longer than 7 years or until the validity of the legal basis (e.g., consent).

4. Rights of the Data Subject

4.1. Right to access one’s personal data

4.2. Right to obtain information about the processing of personal data

4.3. Right to rectification and supplementation of data

4.4. Right to withdraw consent

4.5. To exercise rights, contact can be made at the email address info@awero.ee

4.6. Right to lodge a complaint with the Data Protection Inspectorate: info@aki.ee

5. Additional Provisions

5.1. Account closure and data deletion

• Upon account closure, personal data is deleted, except for data required by law to be retained (e.g., purchase history).
• Deletion requests are responded to within up to 30 days.

5.2. Data portability

• Requests are responded to no later than 30 days
• Identity is verified before data is released

5.3. Restriction of processing and objections

• The customer has the right to request restriction of processing or to object if there is no legal basis for processing

6. Final Provisions

6.1. The privacy policy is prepared in accordance with the General Data Protection Regulation (EU) 2016/679 and the Personal Data Protection Act of the Republic of Estonia.

6.2. The data controller has the right to amend the privacy policy. Changes will be notified on the website https://awero.ee.