Privacy policy

1. Who we are

The controller of personal data collected through the SM Market online shop is Black Bean Advertising Agency OÜ, registry code 17136809, Pirni 7/2, Tallinn, Eesti (“we”). For any data protection question write to herman@mustuba.ee.

2. What data we process and why

• Orders: name, email, phone, delivery address or parcel locker, company name and registry code (if given), order contents, amounts and payment status. Purpose: to conclude and perform the sales contract, deliver goods, handle returns and warranty claims. Legal basis: performance of a contract (GDPR art. 6(1)(b)).
• Accounting: invoices and payment records. Legal basis: legal obligation (GDPR art. 6(1)(c)) under the Estonian Accounting Act.
• Enquiries: name, email and the content of messages sent via the contact form or email. Legal basis: our legitimate interest in answering you (GDPR art. 6(1)(f)) or steps before entering into a contract.
• Technical data: server logs (IP address, time, requested page) kept for security and error tracking. Legal basis: legitimate interest.

We do not use your data for automated decision-making or profiling. We send marketing emails only if you have separately agreed to it.

3. Payments and instalments

Payments, payment in three parts and hire purchase are provided by ESTO AS. When you choose an ESTO payment method, you are redirected to ESTO, which processes your data as an independent controller under its own privacy policy (including credit checks for instalment products). We receive from ESTO only the status of the payment, never your bank login or card details.

4. Who receives your data

• courier and parcel locker companies, to deliver your order;
• suppliers and manufacturers, only to the extent needed to fulfil the order or a warranty claim (usually without your contact details);
• our hosting and email service providers, who process data on our behalf under a data processing agreement;
• our accountant and, where required by law, public authorities.

Data is stored in the European Union. If a service provider processes data outside the EU/EEA, we make sure appropriate safeguards (such as the EU standard contractual clauses) are in place.

5. How long we keep data

Order and accounting documents are kept for 7 years from the end of the financial year, as required by the Accounting Act. Data needed for warranty and claims is kept for the duration of the claim period (at least 2 years from delivery). Enquiries are deleted within 2 years if no contract follows. Server logs are kept for up to 90 days.

6. Cookies and browser storage

The shop uses only what is technically necessary: your shopping bag and the cookie notice choice are stored in your own browser (localStorage). We do not use advertising or analytics cookies. Fonts are served from our own server, so no third party sees your visit.

7. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive your data in a portable format. Write to herman@mustuba.ee and we will reply within one month. If you think we have violated your rights, you may contact the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

8. Changes

We may update this policy when our services or the law change. The current version is always published on this page.