Privacy Policy

1. General provisions

This Privacy Policy describes how Alfamarket OÜ (hereinafter — "we", "the Company") collects, uses, stores and protects the personal data of users and customers of the online store alfatruck.ee, in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the legislation of the Republic of Estonia.

2. What data we collect

• Name, surname

• Contact email and phone number

• Delivery address and billing address

• Company data (for legal entities): company name, registry code, VAT number

• Order data and purchase history

• Payment data — processed by our payment partner Stripe Payments Europe, Ltd. and/or the bank; we do not store bank card details

• Technical data: IP address, device type, cookies, website visit analytics

3. Purposes of data processing

• Placing and fulfilling orders, delivering goods

• Issuing invoices and accounting

• Communicating with the customer about their order

• Improving the website and customer service

• Determining the visitor's country from their IP address — to display prices and VAT rates matching the delivery country

• Sending newsletters and promotions — only with the user's consent

• Complying with legal requirements (tax and accounting)

4. Legal grounds for processing

• Performance of the sales contract (Art. 6(1)(b) GDPR)

• Compliance with legal obligations (tax and accounting law, Art. 6(1)(c))

• The Company's legitimate interest (fraud prevention, service improvement, Art. 6(1)(f))

• User consent (marketing communications, Art. 6(1)(a))

5. Who has access to the data

• Stripe Payments Europe, Ltd. — payment processing and provision of delivery/payment methods

• Logistics partners: Omniva, DPD, Unisend, SmartPosti and other carriers involved in order delivery

• Hosting provider (server located in the EU, Hetzner, Helsinki, Finland)

• Accountant or accounting software (as needed)

• Government authorities — in cases provided for by law

We do not sell or share personal data with third parties for marketing purposes without the user's consent.

6. Data retention period

Order data and related documents are kept for the period required by Estonian law for accounting documents (generally 7 years). Data processed on the basis of consent is kept until the consent is withdrawn.

7. User rights

Under the GDPR, the user has the right to:

• request access to their personal data;

• request correction of inaccurate data;

• request erasure of data ("the right to be forgotten"), unless this conflicts with legal requirements;

• restrict the processing of data;

• object to the processing of data for marketing purposes;

• withdraw consent at any time;

• lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

8. Cookies

The website uses cookies to operate the shopping cart, authentication, visit analytics and, with the user's consent, ad personalisation. Details are available in a separate Cookie Notice on the website.

9. Data security

The Company applies technical and organisational measures to protect personal data from unauthorised access, loss or disclosure (HTTPS connection encryption, restricted access to the server and database).

10. Changes to the policy

We may update this Privacy Policy from time to time. The current version is always available on the alfatruck.ee website.