Privacy Policy

Last updated: 18 August 2026

DSD de Luxe Estonia respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect personal data when you visit our online shop, place an order, contact us or otherwise use our services.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679) (“GDPR”) and applicable Estonian legislation.

1. Data Controller

The data controller responsible for your personal data is the company operating the DSD de Luxe Estonia online shop.

If you have questions about how your personal data is processed or wish to exercise your data protection rights, please contact us using the contact details provided on our website.

2. Personal Data We Collect

Depending on how you interact with our online shop, we may collect the following categories of personal data:

Contact information: name, email address, telephone number and delivery address.
Order information: products purchased, order number, order date, delivery information and payment status.
Payment information: payment-related information necessary to process your transaction. We do not normally store complete payment card details when payments are processed by external payment service providers.
Communication data: information you provide when contacting our customer service or submitting an enquiry.
Technical information: IP address, browser type, device information, operating system and information about how you interact with our website.
Marketing preferences: information about whether you have consented to receive marketing communications.

3. How We Use Your Personal Data

We may process your personal data for the following purposes:

To process and fulfil your orders.
To arrange delivery and provide customer service.
To process payments and refunds.
To communicate with you regarding your orders or enquiries.
To comply with our legal and accounting obligations.
To prevent fraud, misuse and security incidents.
To analyse website usage and performance.
To send promotional communications where you have provided the required consent or where permitted by applicable law.

4. Legal Basis for Processing

We process personal data on one or more of the following legal bases under the GDPR:

Contract: when processing is necessary to fulfil an order or provide services requested by you.
Legal obligation: when we are required to process data to comply with applicable laws, accounting requirements or other legal obligations.
Legitimate interests: where processing is necessary for purposes such as website security, fraud prevention, business administration and improving our services, provided that our interests do not override your rights and freedoms.
Consent: where you have voluntarily provided consent, for example for certain marketing communications or optional cookies.

Where processing is based on consent, you may withdraw your consent at any time.

5. Cookies and Similar Technologies

Our website may use cookies and similar technologies to ensure that the website functions properly, remember your preferences, analyse website traffic and, where applicable, support marketing activities.

Some cookies are necessary for the operation of the online shop, while others are optional and may require your consent.

You can manage your cookie preferences through the cookie settings available on our website. You can also adjust your browser settings to control or delete cookies.

6. Sharing Personal Data

We may share personal data with trusted service providers where this is necessary to operate our online shop and provide services to you. These may include:

Payment service providers
Delivery and logistics companies
E-commerce and website service providers
IT, hosting and technical service providers
Marketing and analytics service providers, where applicable
Professional advisers or authorities where disclosure is required by law

We only share personal data where there is an appropriate legal basis for doing so and, where applicable, appropriate contractual and data protection safeguards are in place.

7. International Data Transfers

Some of our service providers may process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we take appropriate measures to ensure that the transfer complies with applicable data protection legislation. This may include relying on an adequacy decision of the European Commission or appropriate safeguards such as Standard Contractual Clauses.

8. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected.

Order and transaction-related information may be retained for the period required by applicable accounting, tax and other legal requirements.

Where processing is based on consent, we will generally retain the relevant data until you withdraw your consent or the purpose for which it was collected no longer applies, unless we have another lawful basis for retaining it.

9. Your Rights

Under the GDPR, you may have the following rights:

Right of access – to request information about the personal data we process about you.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of your personal data in certain circumstances.
Right to restriction – to request that processing of your data be restricted in certain circumstances.
Right to data portability – to receive certain personal data in a structured, commonly used and machine-readable format.
Right to object – to object to certain types of processing, including processing based on legitimate interests and direct marketing.
Right to withdraw consent – where processing is based on your consent, you may withdraw it at any time.

To exercise your rights, please contact us using the contact details provided on our website.

You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe that your personal data has been processed unlawfully.

10. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration or disclosure.

However, no method of transmitting or storing information electronically can be guaranteed to be completely secure.

11. Children's Privacy

Our online shop is not intended for children who are unable to enter into a legally binding contract under applicable law. We do not knowingly collect personal data from children for purposes unrelated to providing services requested by their legal representatives.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technologies, legal requirements or data processing practices.

The latest version will always be published on our website, together with the date of the most recent update.

13. Contact

If you have questions about this Privacy Policy or the way we process your personal data, please contact us using the contact information available on the DSD de Luxe Estonia online shop.