Privacy Policy
Version of 02.11.2026
This policy describes what personal data the controller collects, why, who receives it and what rights the data subject has.
1. Who is responsible for the data
Controller: Slidena Grida Osaühing, registry code 17633643, registered address: Endla tn 61, Tallinn, Harju maakond, 10615, Estonia (the seller, see section 1 of the Terms of Sale). Contact for data matters: [email protected].
2. What data, why and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Order data: name, email, phone, address, contents, total and status of the order | To accept and fulfil the order, send emails about it, deliver | Performance of a contract (Art. 6(1)(b) GDPR) | While the order is being fulfilled, then for the period the accounting law requires |
| Payment data | To take payment. The payment is processed by Stripe (payment provider); the seller only receives the payment status and the email. The card number never reaches the seller | Performance of a contract | Set by Stripe; the seller keeps only the order status |
| Correspondence with support | To answer questions and complaints | Performance of a contract, legitimate interest | As long as needed to solve the matter and to defend against claims |
| Google sign-in for the YouTube subscriber discount: the stable Google account ID (not the name or email), the YouTube channel name (it is public and shown as «Hi, …» on the site) and the promo code issued | To check once whether the account subscribes to the channel or is on the sponsor list and to issue one promo code per account. Only read access to YouTube (youtube.readonly) is requested and it is revoked right after the check. The subscription list, name and email are not stored | Consent (Art. 6(1)(a) GDPR): the person signs in and ticks the access themselves | While the code is valid and the promotion runs, then deleted |
| Site visit data: random visit number, pages viewed, checkout steps, source of the visit (site or UTM tag), country from the delivery network, device type | To understand where buyers come from and at which step an order is not completed | Legitimate interest (Art. 6(1)(f) GDPR) | No longer than 24 months. IP address and cookies are not recorded in these statistics |
| Google Analytics 4 statistics (only after cookie consent): browser identifier, pages viewed, purchase event, country and device type | To understand how the store works. Advertising and personalisation are switched off | Consent (Art. 6(1)(a) GDPR) | Up to 14 months in Google Analytics |
| Technical server logs: IP address, time, browser | Security and fixing faults | Legitimate interest | A limited time, then deleted |
| Accounting and tax data | To meet legal obligations | Legal obligation (Art. 6(1)(c) GDPR) | 7 years under the Estonian Accounting Act |
The controller does not take decisions based solely on automated processing that significantly affect the data subject. The store is not intended for children under 16. Providing order data is necessary to conclude the contract; without it the order cannot be fulfilled.
3. Who receives the data
- Stripe: taking payments (Stripe privacy policy).
- Brevo: sending order emails (Brevo privacy policy).
- Cloudflare: site delivery, protection, DNS and email forwarding (Cloudflare privacy policy).
- Google: sign-in and YouTube check (Google privacy policy) and Google Analytics 4 after consent.
- Manufacturers and carriers: order contents, name, phone and address for delivery.
- The hosting provider of the server on which the store runs (Linveo, LLC, USA).
- Accountants and authorities where the law requires it.
Some of these companies may process data outside the EU, including in the USA. Such transfers rely on the safeguards of the GDPR: standard contractual clauses or an adequacy decision.
4. Data from Google and YouTube
The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. YouTube data is used only to check the subscription or sponsorship and issue the discount; it is not passed to third parties and not used for advertising. Access can be revoked at any time at myaccount.google.com/permissions. This processing is also covered by the Google Privacy Policy and the YouTube Terms of Service.
When you pay in cryptocurrency, the transaction data is written to a public blockchain; the seller cannot change or delete it.
5. Security
The site works over HTTPS. Card data does not appear at the seller. Only authorised people can access orders, and the working panel is protected by a one-time code.
6. Rights of the data subject
- to obtain a copy of your data and information about its processing;
- to correct inaccurate data;
- to request deletion when there is no longer a reason to keep the data;
- to restrict processing or object to it, including processing based on legitimate interest;
- to receive the data in a machine-readable form where it is processed under a contract;
- to withdraw consent where processing is based on consent.
To use these rights write to [email protected]. The controller answers within one month. If you think your rights have been violated you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data protection authority of your place of residence in the EU.
7. Cookies and browser storage
See Cookies.
8. Changes
The controller may change this policy and publishes the new version on this page with a date.