Privacy Policy

Väikekaru OÜ (registry code 17529153, address Loitsu 1-138, 13622 Tallinn, Estonia; hereinafter the Controller) is committed to protecting your personal data in accordance with the European Union General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act. This privacy policy explains what data we collect, why and how we use it, with whom we share it, and what your rights are.

This policy applies to all visitors and customers of the online store beebicuddles.ee. By using the online store, you agree to this policy.

1. Personal data collected

We collect data that you provide to us directly, and data generated by using the online store:

Contact information: name, email address, phone number
Delivery information: delivery address, city, postal code, country
Order information: products purchased, quantities, prices, order history, payment method (full payment details are not stored on our servers)
Technical data: IP address, browser type and version, device type, visit time and duration, pages viewed, cookies, and analytics data
Communication data: emails sent by you, customer service inquiries, and feedback
Marketing preferences: whether you have subscribed to the newsletter and what notifications you have chosen

2. Purposes and legal basis for data collection

We process your data only for specific and lawful purposes:

Performance of a contract — accepting, processing, arranging delivery of orders, issuing invoices, and customer service (GDPR Art. 6(1)(b))
Legal obligation — accounting and tax records in accordance with Estonian laws (GDPR Art. 6(1)(c))
Legitimate interest — fraud prevention, ensuring online store security, improving user experience, and collecting statistics (GDPR Art. 6(1)(f))
Consent — marketing communications, newsletters, and personalized offers, if you have explicitly given your permission (GDPR Art. 6(1)(a))

3. Sharing data with third parties

We share your data only to the extent necessary to provide the service. Our trusted partners are:

Shopify Inc. — e-commerce platform and technical data processor (USA; data protection ensured by standard contractual clauses – SCC)
Maksekeskus AS — payment intermediary that securely processes payments for orders. Väikekaru OÜ does not have access to customer's bank and payment card data.
Omniva, DPD, Itella SmartPOST — for delivery arrangements, we provide name, delivery address, and phone number
Klaviyo — email marketing platform, if you have subscribed to the newsletter (USA; data protection ensured by SCCs)
Google LLC — login service (Google Sign-In), through which customers can log in to the online store with their Google account. In this case, Google provides us with your name and email address. You can review Google's privacy policy at policies.google.com/privacy. Online store visit statistics via Google Analytics 4; data is anonymized and does not contain personally identifiable information (USA)

We do not sell, rent, or disclose your personal data to third parties for any other purpose.

4. Data retention

We retain personal data only for as long as necessary:

Order and invoice related data: 7 years in accordance with the Estonian Accounting Act
Customer account data: until the account is deleted or 3 years from the last purchase
Marketing consent and communication history: until consent is withdrawn
Technical logs and analytics data: up to 26 months (Google Analytics 4 default retention period)

After the retention period expires, the data will be deleted or anonymized.

5. Cookies

We use cookies to operate the online store, collect statistics, and improve the user experience. Cookies are divided into four categories:

Essential cookies — ensure the basic functions of the online store such as shopping cart, login, and security. They cannot be disabled, as the online store will not function correctly without them.
Analytical cookies — collect anonymous statistics on how visitors use the online store (e.g., most popular pages, duration of visits). We use Google Analytics 4 service.
Functional cookies — remember your preferences, such as language and currency, to make usage more convenient.
Marketing cookies — allow us to show you relevant ads and measure the effectiveness of campaigns. Implemented only with your prior consent.

You can manage the use of cookies in your browser settings. Disabling essential cookies may affect the operation of the online store.

6. Your rights

Under the GDPR, you have the following rights, which you can exercise at any time:

Right of access — you can ask what personal data we process about you and receive a copy of it
Right to rectification — you can request the correction of inaccurate or incomplete data
Right to erasure (right to be forgotten) — you can request the deletion of data if there is no longer a legal basis for its processing
Right to restriction of processing — you can request the temporary suspension of data processing, for example, during a dispute
Right to data portability — you can receive your data in a structured and machine-readable format and transmit it to another service provider
Right to object — you can object to processing based on legitimate interest
Right to withdraw consent — you can withdraw your marketing consent at any time, without affecting the legality of processing carried out before the withdrawal

To exercise your rights, please contact: info@beebicuddles.ee. We will respond to your request within 30 days at the latest.

7. Opting out of marketing

If you have subscribed to our newsletter, you can unsubscribe at any time:

By clicking the link "Unsubscribe from newsletter" at the bottom of each email
By sending an unsubscribe request via email: info@beebicuddles.ee

Opting out of marketing does not affect the sending of order-related notifications (e.g., order confirmation, delivery information).

8. Data security

We implement appropriate technical and organizational security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. All data transfers take place via encrypted connection (SSL/TLS). Access to personal data is limited only to employees and partners who need it to perform their duties.

9. Complaint to the supervisory authority

If you believe that your personal data is being processed unlawfully, you have the right to lodge a complaint with the Data Protection Inspectorate (AKI):

Website: www.aki.ee
Address: Tatari 39, 10134 Tallinn
Email: info@aki.ee
Phone: +372 627 4135

We recommend contacting us first to find a solution directly before filing a complaint.

10. Data transfer outside the EU

Your data may be processed outside the European Economic Area (EEA), especially on servers of Shopify (USA) and Klaviyo (USA). In such cases, we ensure data protection through safeguards consistent with GDPR — in particular, through standard contractual clauses (SCCs) approved by the European Commission.

11. Policy changes

Väikekaru OÜ reserves the right to amend this privacy policy. In case of significant changes, we will notify you by email or via a notice on the website beebicuddles.ee at least 14 days in advance.

Last updated: June 2026