Privacy policy

The controller of personal data is:

NPC Print OÜ

Registration code: 14545312

VAT number: EE102090882

Address: Marja tn 7, Kristiine linnaosa, 10617 Tallinn, Harju maakond, Estonia

Telephone: +372 5580 077

Email: info@ero24.ee

For data protection questions or to exercise your rights, write to info@ero24.ee.

Depending on how the customer uses the Online Store, we may process:

Contact and identification details

• first and last name;
• email address;
• telephone number;
• delivery address and billing details.

Order information

• order number;
• ordered products, quantities and prices;
• order date and status;
• selected delivery method and delivery details;
• selected payment method and payment status;
• information on returns, withdrawal statements and complaints.

Order contents are confidential. Access is limited to what is necessary for fulfilment, customer service, legal obligations or protecting the Online Store's legitimate interests.

Customer account information

If an account is created, we may process its identifier, contact details, order history, settings and authentication information.

The Online Store does not store passwords in readable form.

Payment information

We may process payment method, status, identifier, amount and time.

Payment service providers process electronic payments.

The Online Store does not store full payment card details in its system.

Technical and website usage data

Using the store may involve processing:

• IP address;
• device and browser technical details;
• time of visit;
• pages visited and actions taken;
• technical website usage logs;
• cookie and similar technology identifiers;
• language and region preferences;
• technical advertising campaign and conversion data.

Customer service information

When you contact us, we may retain contact details, the enquiry and correspondence needed to resolve it.

We process personal data primarily for:

• receiving and fulfilling orders;
• processing payments;
• delivering goods;
• communicating with customers;
• sending order and delivery notifications;
• handling returns and withdrawals;
• resolving complaints;
• managing customer accounts;
• meeting accounting and tax obligations;
• preventing fraud and abuse;
• securing the store and information systems;
• analysing and improving the store;
• measuring advertising effectiveness;
• adapting advertising and marketing with customer consent.

We do not use order contents to draw unnecessary inferences about customers.

The legal basis depends on the purpose.

Performance of a contract — GDPR Article 6(1)(b)

This covers data necessary for receiving orders, payment, delivery, customer communication, returns and other actions under the sales contract.

Legal obligation — GDPR Article 6(1)(c)

This covers information we must retain or use to meet accounting, tax and other statutory duties.

Legitimate interests — GDPR Article 6(1)(f)

We may process data to secure the store and systems, prevent fraud and abuse, establish, exercise or defend legal claims and improve essential store functions.

Consent — GDPR Article 6(1)(a)

We use consent where required, including for analytics and advertising technologies.

Customers may withdraw consent at any time through the store's cookie settings.

We may share necessary personal data with service providers to operate the store.

Montonio

Montonio Finance OÜ provides electronic payment intermediation services.

The provider receives the information necessary to process the payment.

Logistics and delivery partners

The selected partner receives necessary delivery information, such as name, telephone, email, address or selected parcel locker.

We do not share more information about ordered product contents than necessary for the service or required by law.

Google Analytics

With customer consent, Google Analytics analyses website usage.

It may process visits, device, browser, approximate location, website actions and other usage events.

Google Ads

With customer consent, Google Ads advertising and conversion measurement technologies may be used.

Google Ads helps measure campaign effectiveness and, with the relevant consent, adapt advertising and remarketing.

Google Analytics and Google Ads technologies operate according to the customer's consent choices.

IT and hosting providers

Server, hosting, email, database, security, backup and other IT providers may support the store's operation.

Other service providers

Where necessary, data may be shared to the required extent with accounting, legal and other professional providers.

The Online Store does not sell customers' personal data to third parties.

ero24.ee uses cookies and similar technologies to operate the store and, with consent, for analytics and advertising.

Cookie consent is managed by ERO24’s own solution. Your choice is stored for 180 days in the ero24_consent cookie. Analytics and advertising measurement are off by default. Change your choice or withdraw consent using Cookie settings at the bottom left.

Strictly necessary cookies

These support essential functions, such as:

• the basket;
• session management;
• security;
• checkout;
• retaining necessary user preferences.

Consent is not requested where a cookie or technology is strictly necessary to provide the service.

Analytics cookies

With the relevant consent, analytics technologies, including Google Analytics, analyse store usage and performance.

Advertising cookies

With the relevant consent, Google Ads technologies may measure advertising effectiveness, track conversions and, where permitted, adapt advertising.

Google Consent Mode

Google Analytics and Google Ads consent signals are managed together with ERO24.

The consent status sent to Google depends on the customer's choices in ERO24.

Customers may later change preferences or withdraw consent through the store's cookie settings.

The precise list of cookies, providers, purposes and retention periods is shown in ERO24 settings.

Some providers, including international technology and analytics services, may process personal data outside the EEA.

Such transfers use the legal bases and safeguards required by applicable data protection rules, for example a European Commission adequacy decision or standard contractual clauses.

Data is retained only as long as needed for its collection purpose or statutory obligations.

Accounting documents and data are retained for the statutory period, normally seven years from the end of the financial year in which the transaction was recorded.

Order data is retained to the extent and for the period needed for the sales contract, accounting and tax duties and potential legal claims.

Account data is normally retained while the account exists and afterwards only where a legal obligation or other valid legal basis requires it.

Customer service correspondence is retained as needed to resolve enquiries and handle potential legal claims.

Marketing consent records are retained while consent is valid and, as necessary, after withdrawal to demonstrate consent or its withdrawal.

Cookie and analytics retention periods depend on the cookie or service; details appear in ERO24 settings.

Once retention is no longer needed, data is deleted or anonymised unless another legal basis supports continued retention.

We apply technical and organisational measures appropriate to the risk and nature of the data.

These may include:

• encrypted HTTPS/TLS connections;
• access limited by job duties;
• authentication and access controls;
• secure password processing;
• software and system security updates;
• backups and other appropriate technical safeguards.

Given the nature of the products, order contents are treated confidentially and access is limited by duties and need.

Under the conditions in the GDPR, customers may:

• receive information about processing;
• request access to their data;
• request correction of inaccurate or incomplete data;
• request erasure where no basis for further processing exists;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• exercise data portability where applicable;
• withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing before withdrawal.

Erasure is not an absolute right. For example, data that must still be retained by law cannot be deleted.

To exercise your rights, write to:

info@ero24.ee

We respond without undue delay, normally within one month, subject to GDPR conditions.

Where necessary, we may request additional information to verify the applicant's identity before acting.

Marketing messages are sent where a basis exists under applicable law.

Where marketing relies on consent, the customer may withdraw it at any time.

Unsubscribe using the link in the marketing email or by writing to info@ero24.ee.

Opting out does not affect necessary order communications, such as confirmations, payment and delivery notices and return or complaint handling messages.

The store does not make solely automated decisions with legal or similarly significant effects on customers unless an applicable legal basis and required safeguards exist.

With consent, Google Analytics and Google Ads may process technical usage data for analytics, advertising measurement or adaptation.

If you believe processing has infringed your rights, contact:

NPC Print OÜ

Email: info@ero24.ee

Telephone: +372 5580 077

You may also complain to the competent data protection supervisory authority.

In Estonia, the authority is:

Andmekaitse Inspektsioon

Tatari 39

10134 Tallinn

Email: info@aki.ee

Website: aki.ee

The store may change this policy when processing practices, services, legislation or other significant circumstances change.

The current version is published on ero24.ee.

Where necessary, we inform customers of significant changes by appropriate means.