1.1. This privacy policy governs the principles of the collection, processing and storage of personal data. Personal data are collected, processed and stored by C-box OÜ (hereinafter: controller).
1.2. For the purposes of this privacy policy, a data subject is a customer or any other natural person whose personal data are processed by the controller.
1.3. Personal data are any information relating to the data subject through which it is possible to directly or indirectly identify the person.
1.4. A visitor is a person using the website C-box.eu.
1.5. A customer is a natural or legal person who uses or has expressed their wish to use the services of C-box OÜ.
1.6. The controller complies with the principles for the processing of data laid down by laws, and processes the personal data in a legal, fair and secure manner. The controller is able to confirm that the personal data have been processed in accordance with legal provisions.
2.1. The personal data collected, processed and stored by the controller are collected electronically, mainly via the website and e-mail.
2.2. By sharing his or her personal data, the data subject grants the controller the right to collect, organise, use and manage, for the purposes specified in the privacy policy, the personal data which the data subject provides directly or indirectly to the controller by purchasing products or services on the website.
2.3. The data subject is responsible for making sure that the data he or she provides are accurate, correct and complete. Knowing submission of false information is considered to be a breach of the privacy policy. The data subject is required to promptly notify the controller of any changes to the data submitted.
2.4. The controller is not held liable for any damage caused to the data subject or any third parties by the data subject's submission of false information.
3.1. The controller may process the following personal data of the data subject:
3.1.1. The personal data disclosed by the data subject to C-box (name, e-mail address, postal address, telephone number);
3.1.2. The personal data generated in the normal communication between the data subject and C-box;
3.1.3. The personal data clearly published by the data subject (e.g. in social media);
3.1.4. The personal data generated by using the services (e.g. when using the C-box application);
3.1.5. The personal data generated through visiting and using the website (e.g. time spent on the website);
3.1.6. Personal data received from third parties;
3.1.7. The personal data generated and combined by C-box (correspondence during customer relationship, or list of order history).
3.2. In addition to the above, the controller shall have the right to collect data about a customer from public registers.
3.3. The legal bases for the processing of personal data are Article 6 (1) (a), (b), (c) and (f) of the General Data Protection Regulation:
a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
b) the processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
c) the processing is necessary for the controller to comply with a legal obligation;
f) the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
3.4. Processing of personal data in accordance with the purpose of the processing:
3.4.1. Purpose of processing – safety and security
Maximum personal data retention period – according to the time limits specified in the applicable legislation
3.4.2. Purpose of processing – processing of the order
Maximum personal data retention period – one month
3.4.3. Purpose of processing – ensuring the functioning of the services in the application
Maximum personal data retention period – five years
3.4.4. Purpose of processing – customer relationship management
Maximum personal data retention period – five years
3.4.5. Purpose of processing – marketing
Maximum personal data retention period – five years
3.5. The controller shall have the right to share the personal data of the customers with third parties, such as data processors, accountants, transport and courier companies and companies providing transfer services. The controller is the controller of the personal data.
3.6. In processing and storing the data subject’s personal data, the controller shall apply organisational and technical measures that ensure the protection of personal data against accidental or unlawful destruction, alteration and disclosure and any other unlawful processing.
3.7. The controller shall retain the data relating to data subjects for a period of not more than 10 years, depending on the purpose of the processing.
4.1. The data subject shall have the right to access his or her personal data.
4.2. The data subject shall have the right to obtain information on the processing of his or her personal data.
4.3. The data subject shall have the right to supplement or correct inaccurate data.
4.4. Where the data controller processes the personal data of the data subject on the basis of the data subject’s consent, the data subject shall have the right to withdraw the consent at any time.
4.5. To exercise his or her rights, the data subject can contact the customer support of C-box at info@c-box.eu.
4.6. To protect his or her rights, the data subject may lodge a complaint with the Data Protection Inspectorate.
5.1. The website of C-box (c-box.eu) collects and processes data about the visitors of the websites and other information society services by using cookies (i.e. small information pieces stored by the visitor’s browser on the hard disk of the visitor's computer or other device) or other similar technologies (e.g. IP address, device information, location information).
5.2. C-box OÜ uses cookies to improve the quality of the website, and the visitor experience, and to inform the visitor and the customer about the content that might interest them, as well as about offers.
5.3. C-box OÜ uses session, persistent and advertising cookies. A session cookie is automatically deleted after each visit; persistent cookies remain when the website is used repeatedly. Third-party cookies are used by the websites of the partners of C-box OÜ. C-box does not control the generation of these cookies, so information about these cookies is available from third parties.
5.4. The customer shall have the right to refuse all or part of the cookies by selecting the settings for his or her web browser and cookies respectively.
6.1. This privacy policy has been prepared in accordance with Regulation (EU) No. 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and in accordance with the Personal Data Protection Act of the Republic of Estonia and European Union legislation.
6.2. The controller shall have the right to change this privacy policy, in whole or in part, by notifying the data subjects of the changes via the website c-box.eu.