The data controller of the online store ledcity.ee is LuxElekter OÜ (registration code 10183792), located at Laki 26, 12915 Tallinn, phone +37253030757, and e-mail: info@luxelekter.ee
What personal data is processed
Name, phone number and e-mail address; delivery address; bank account number; price of goods and services and payment-related data (purchase history); customer support data.
Purpose of processing personal data
Personal data is used to manage customer orders and deliver goods. Purchase history data (purchase date, goods, quantity, customer data) is used to provide an overview of purchased goods and services and to analyse customer preferences. Bank account number is used for refunding payments to the customer. Personal data such as e-mail, phone number and customer name are processed to resolve issues related to goods and services (customer support). The user’s IP address and other network identifiers are processed for providing the information society service and for website usage statistics.
Legal basis
Personal data is processed for the performance of a contract with the customer. Processing is also carried out to comply with legal obligations (e.g. accounting and consumer dispute resolution).
Recipients of personal data
Personal data is shared with the online store’s customer support for managing orders and resolving customer issues. Name, phone number and e-mail address are shared with the delivery service provider chosen by the customer. In case of courier delivery, the customer’s address is also shared. If accounting is handled by an external provider, personal data is shared for accounting purposes. Personal data may also be shared with IT service providers if required for the operation or hosting of the online store.
For payment processing, necessary personal data is transferred to Maksekeskus AS, which processes payments, ensures payment security and helps prevent fraud.
Security and access to data
Personal data is stored on zone.ee servers located within the European Union or the European Economic Area. Data may be transferred to countries recognised by the European Commission as providing an adequate level of data protection or under other GDPR-compliant safeguards. Access to personal data is granted to employees of the online store for resolving technical issues and providing customer support. Appropriate physical, organisational and technical security measures are used to protect personal data against accidental or unlawful destruction, loss, alteration or unauthorised access.
Transfers to authorised processors (e.g. delivery and hosting providers) are based on agreements ensuring adequate data protection.
Access and correction
Personal data can be accessed and corrected in the user profile. If a purchase was made without an account, data can be accessed via customer support.
Withdrawal of consent
If processing is based on consent, the customer has the right to withdraw consent by contacting customer support via e-mail.
Data is processed in accordance with applicable laws and only to the extent necessary for order processing, delivery, payment processing and customer service.
Personal data required for payment processing is transferred to Maksekeskus AS, which processes it for payment handling and security purposes.
Personal data is not shared with third parties except where required by law or necessary to fulfil the order.
Data retention
When a customer account is closed, personal data is deleted unless it must be retained for accounting or dispute resolution purposes. If a purchase was made without an account, purchase history is stored for three years. In case of disputes, data is retained until the claim is fulfilled or the limitation period expires. Accounting-related data is stored for seven years.
Data deletion
To request deletion of personal data, the customer must contact customer support. Requests are answered within one month and the deletion timeline is clarified.
Data portability
Requests for data portability submitted via e-mail are handled within one month. Customer support verifies identity and informs which data can be transferred.
Direct marketing messages
E-mail address and phone number are used for direct marketing messages if the customer has given consent. If the customer does not wish to receive such messages, they can unsubscribe via the link in the e-mail footer or contact customer support. Customers may object to processing for marketing purposes at any time.
Dispute resolution
Disputes related to personal data processing are resolved via customer support (info@luxelekter.ee). The supervisory authority is the Estonian Data Protection Inspectorate (info@aki.ee).