Privacy Policy

  1. General Provisions

1.1. This privacy policy governs the collection, processing, and storage of personal data by Design Pack OÜ (registry code 12814802, address Tuleviku tee 12, Peetri, 75312 Harju County, Estonia) – hereinafter referred to as the data controller.

1.2. A data subject is any individual whose personal data is processed by the data controller.

1.3. A client is any person who uses the e-shop, submits an inquiry, or purchases products from the data controller.

1.4. The data controller ensures the lawful, fair, and secure processing of personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR).

  1. Collection, Processing, and Storage of Personal Data

2.1. Personal data is collected primarily via the website’s contact forms and email.

2.2. By submitting their data, the data subject grants the data controller the right to collect, organize, use, and manage the data for the purposes defined in this privacy policy.

2.3. The data subject is responsible for ensuring that the information provided is accurate and up to date and must inform the data controller of any changes without delay.

2.4. The data controller is not liable for damages caused by inaccurate or incorrect data submitted by the data subject.

  1. Processed Personal Data and Legal Grounds

3.1. The data controller may process the following personal data:

  • Full name
  • Email address
  • Phone number
  • Delivery address
  • Order details
  • Payment information (via Maksekeskus AS)

3.2. Legal grounds for data processing:

  • Consent (Art. 6(1)(a) GDPR)
  • Contract performance (Art. 6(1)(b))
  • Legal obligation (Art. 6(1)(c))
  • Legitimate interest (Art. 6(1)(f))

3.3. Purposes and retention periods:

Purpose

Retention Period

Order processing

Up to 3 years from purchase

Customer communication

Up to 2 years

Accounting

According to law (7 years)

Marketing (with consent)

Up to 2 years or until consent is withdrawn

3.4. Personal data may be shared with:

  • Authorized processors (e.g., IT service providers, Maksekeskus AS)
  • Accounting service providers
  • Transport and delivery companies (e.g., DPD, Itella)
  1. Data Subject Rights

4.1. Right to access and review personal data
4.2. Right to receive information about data processing
4.3. Right to request correction or deletion
4.4. Right to withdraw consent
4.5. Right to file a complaint with the Data Protection Inspectorate (Estonia)

To exercise these rights, contact us at: info@greeneco.fi

  1. Final Provisions

5.1. This privacy policy complies with the General Data Protection Regulation (EU) 2016/679 and Estonian data protection legislation.

5.2. The data controller reserves the right to amend this policy by publishing updates on the website: www.greeneco.fi