Privacy Policy

1.1. This Privacy Policy governs the principles for collecting, processing and retaining personal data. Personal data is collected, processed and retained by the data controller Glara Sport OÜ (registry code 17478817, address Lõõtsa tn 5, Tartu 50109, Estonia) (hereinafter the Controller).

1.2. For the purposes of this Privacy Policy, a Data Subject is a customer or another natural person whose personal data is processed by the Controller.

1.3. For the purposes of this Privacy Policy, a Customer is any person who purchases goods or services through the Controller's online platform.

1.4. The Controller observes the data-processing principles established by law and, among other things, processes personal data lawfully, fairly and securely. The Controller is able to demonstrate that personal data has been processed in accordance with applicable law.

2.1. Personal data collected, processed and retained by the Controller is collected electronically, primarily through the online Platform and by email.

2.2. By providing their personal data, the Data Subject grants the Controller the right to collect, organise, use and manage, for the purposes specified in this Privacy Policy, the personal data that the Data Subject provides to the Controller directly or indirectly when purchasing goods or services through the online Platform.

2.3. The Data Subject is responsible for ensuring that the data they provide is accurate, correct and complete. Knowingly providing false information is considered a breach of this Privacy Policy. The Data Subject must notify the Controller immediately of any changes to the data provided.

2.4. The Controller is not liable for damage caused to the Data Subject or third parties by the Data Subject providing false information.

3.1. The Controller may process the following personal data of a Data Subject:

1. first name and surname;
2. telephone number;
3. email address;
4. delivery address;
5. bank-account number;
6. payment data, transmitted through a payment service provider;
7. order history;
8. IP address and website-usage data.

3.2. In addition to the above, the Controller has the right to collect information about a Customer that is available in public registers.

3.3. The legal bases for processing personal data are points (a), (b), (c) and (f) of Article 6(1) of the General Data Protection Regulation:

• (a) the Data Subject has consented to the processing of their personal data for one or more specific purposes;
• (b) processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject before entering into a contract;
• (c) processing is necessary for compliance with a legal obligation to which the Controller is subject;
• (f) processing is necessary for the purposes of a legitimate interest.

3.4. Processing of personal data by purpose:

3.4.1. Security and safety

Maximum retention period for personal data—as provided by the time limits established by law.

3.4.2. Order processing

Maximum retention period for personal data—up to 3 years.

3.4.3. Ensuring operation of the online Platform

Maximum retention period for personal data—up to 3 years.

3.4.4. Customer management

Maximum retention period for personal data—up to 5 years.

3.4.5. Financial operations and accounting

Maximum retention period for personal data—as provided by the time limits established by law.

3.4.6. Marketing

Maximum retention period for personal data—until consent is withdrawn.

3.5. The Controller has the right to share Customers' personal data with third parties such as processors, accountants, transport and courier companies, and payment service providers.

3.6. When processing and retaining a Data Subject's personal data, the Controller implements organisational and technical measures that protect personal data against accidental or unlawful destruction, alteration, disclosure and other unlawful processing.

3.7. The Controller retains Data Subjects' data according to the purpose of processing, but for no longer than 7 years unless a longer retention obligation arises from law.

4.1. The Data Subject has the right to access and review their personal data.

4.2. The Data Subject has the right to receive information about the processing of their personal data.

4.3. The Data Subject has the right to supplement or correct inaccurate data.

4.4. Where the Controller processes the Data Subject's personal data on the basis of consent, the Data Subject has the right to withdraw that consent at any time.

4.5. To exercise their rights, the Data Subject may contact customer support at support@glarasport.com.

4.6. The Data Subject has the right to lodge a complaint with the Estonian Data Protection Inspectorate.

5.1. These data-protection terms have been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation), the Personal Data Protection Act of the Republic of Estonia and applicable legislation.

5.2. The Controller has the right to amend these data-protection terms in part or in full by notifying Data Subjects of the amendments through the online Platform.