Privacy
Controller: ALTRIX OÜ, Pikk tn 78-21, 50603 Tartu linn, Tartu maakond, Eesti, info@allikasilm.ee.
What we process and why
- Name, email, phone, delivery address — to fulfil and deliver the order (contract, GDPR art. 6(1)(b)). Shared with the carrier (Venipak, Omniva, OSC) for delivery only.
- Invoice data — kept 7 years under the Accounting Act (art. 6(1)(c)).
- Newsletter email — only with your consent (art. 6(1)(a)); unsubscribe via the link in every email.
- Name, pick-up point or address, order number: if the goods are shipped by a partner seller, we pass these data to the partner only for the label (legal basis: contract, Art. 6(1)(b)). The partner does not see your email address. Your phone number is passed to the carrier when the label is created so that you can be notified about the parcel; the carrier prints it on the label, so the partner sees it only there. The partner acts on our behalf, may not use the data for advertising and deletes them no later than 30 days after delivery.
Cookies
Necessary — cart, language choice and your cookie choice (as_lang, as_consent, WooCommerce session cookies). The shop cannot work without them, so they need no consent.
Analytics — Google Analytics 4 (Google Ireland Ltd), cookies _ga and _ga_*, kept for up to 2 years. Analytics cookies are set only after you press “Accept all” in the cookie banner. Before that the Google tag runs in Consent Mode without cookies and sends only anonymous technical signals. No advertising and no data shared for ads.
Session recordings — Microsoft Clarity (Microsoft Ireland Operations Ltd, processor acting on our behalf): recordings of visits and heatmaps, to find where the site is inconvenient. Form fields, addresses and payment details are hidden and not sent to Microsoft. Cookies _clck (up to 1 year) and _clsk (1 day); recordings are kept for 30 days, aggregated data for up to 13 months. Switched on only after “Accept all”.
Chat — live chat runs on Crisp (Crisp IM SAS, France); the chat window appears after you make a choice in the cookie banner and uses its own cookies for the conversation to work. The name and email sent through the chat form reach our mailbox and are used only to reply.
You can change or withdraw consent at any time via the “Cookie settings” link at the bottom of the page.
Reminders and reviews
If you entered your email at checkout but did not finish the order, we may remind you about your cart — no more than two emails within 24 hours, each with a “Stop cart reminders” link. 14 days after delivery we ask once how your plants are doing. The legal basis is the shop’s legitimate interest; cart data is used for reminders for up to 3 days.
Your rights
Access, rectification, erasure, restriction, portability and withdrawal of consent — on request to info@allikasilm.ee. We reply within 30 days. Complaints: Estonian Data Protection Inspectorate (aki.ee).
Sellers on ALLIKASILM
What data we collect
- Seller data: company name or name of the FIE, registry code, registered address, names of representatives and the contact person. For DAC7 reporting on a FIE, also the personal identification code and date of birth (a FIE is reported as a natural person).
- Contact details: email, phone, address.
- Payment and tax data: IBAN and account holder’s name, KMKR number, tax status (VAT-registered or not).
- Plant health data: PTA register number, right to issue plant passports, address of the growing site.
- Trading data: products, prices, orders, shipments and tracking numbers, refunds, commissions, payouts, sales and payout statements, self-billing invoices (Endale arve koostamine), the self-billing agreement and the record of its acceptance (date, time, sign-in method), records of document confirmation, “Paid out” statements.
- Correspondence and reviews: messages in the seller account and by email, decisions on the review of products and the account, complaints and reports of violations.
- Technical data: sign-ins to the seller account, IP address, time of actions, to protect the account.
Why and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Registration, account review, publication of products, orders, payouts | contract, Art. 6(1)(b) |
| Accounting: sales and payout statements, self-billing invoices | legal obligation, Art. 6(1)(c): Raamatupidamise seadus § 6, 7, 12; Käibemaksuseadus § 37 |
| Reporting on sellers to EMTA (DAC7) | legal obligation, Art. 6(1)(c): Maksualase teabevahetuse seadus §§ 20²⁰–20²⁵ |
| Plant traceability, PTA requests | legal obligation, Art. 6(1)(c): Regulation (EU) 2016/2031 |
| Contact filter in texts and messages, fraud prevention, protection of marketplace customers | legitimate interest, Art. 6(1)(f) |
| Handling complaints and reports of violations | legal obligation and legitimate interest, Art. 6(1)(c) and (f) |
The contact filter automatically hides phone numbers, email addresses and links in product pages and messages. It does not itself take decisions to suspend an account; such decisions are taken by a person.
A product listing may be declined automatically by software (Marketplace rules, section 4). On your request a person will review the decision.
Who we share data with
- The buyer: only the name or farm name and the town of dispatch. The seller’s contact details are not shared with the buyer.
- Carriers: Omniva, Venipak, DPD (ALTRIX labels) and the carrier the seller works with under its own contract: data for the label and shipment (dispatch address, name, phone).
- The bank: for payouts.
- ALTRIX’s processors: website and email hosting (Zone Media OÜ, Estonia), payment service Paysera (Lithuania), Crisp chat (Crisp IM SAS, France), Google Analytics (Google Ireland Ltd), Microsoft Clarity (Microsoft Ireland Operations Ltd; only with consent to cookies), the accounting firm that keeps ALTRIX’s accounts. We do not translate sellers’ texts and do not pass them to translation services.
- Authorities: as required by law: EMTA, PTA, the police and courts on request.
- AI review of listings: Anthropic (USA; transfer under the EU standard contractual clauses) — only the text and photos of the listing, without buyers’ data.
Data are stored in the EU. The exception is Google Analytics (only with consent to cookies): Google may process data in the USA. The basis is the European Commission’s adequacy decision on the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795), in which Google LLC participates.
Buyers’ data held by the seller
To ship an order, the seller receives the buyer’s name, pick-up point or address and the order number, only what is needed for the label. The seller does not see the buyer’s email address or phone number in the seller account. The carrier prints the recipient’s phone number on the label, and that is the only place the seller sees it. The seller processes these data on our behalf (Art. 28 GDPR), only for shipping, and deletes them no later than 30 days after delivery. Using them for mailings or advertising is prohibited.
How long we keep data
| Data | Period |
|---|---|
| Incomplete registration (email not confirmed or application not sent) | 30 days, then deleted |
| Declined seller application | 90 days after the refusal (in case of appeal), then deleted |
| Data of an active seller | for as long as the agreement is in force |
| Sales and payout statements, self-billing invoices, payouts | 7 years after the end of the financial year (Raamatupidamise seadus § 12) |
| Data for DAC7 | the current and the 6 preceding calendar years, no more than 10 years (Maksualase teabevahetuse seadus § 8 lg 3) |
| Records of the origin and sale of plants: which seller (PTA register number) supplied each unit, order number | 3 years (Regulation (EU) 2016/2031, Art. 69(1) and (4)) |
| Data for protection against bypassing the marketplace (name, contact details) | 24 months after the end of the agreement (the non-circumvention period under the “Seller terms”) |
| Correspondence, complaints, review decisions | 3 years after the end of the agreement: the general limitation period for claims arising from a transaction (Tsiviilseadustiku üldosa seadus § 146 lg 1) |
Seller’s rights
The same as the buyer’s: access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest. Data that we are required by law to keep are not deleted before the end of the retention period. Requests to info@allikasilm.ee; we reply within 30 days. Complaints may be lodged with the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).