Legal
Privacy policy
Last updated: 15 August 2026
This policy explains how ZASU OÜ (trading as “Vaelmar”), the data controller, processes your personal data under the EU General Data Protection Regulation (GDPR). Contact: hello@vaelmar.com.
What we collect, why, and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Order & delivery details (name, address, email, phone) | To take payment, fulfil and ship your order, and contact you about it | Performance of a contract (Art. 6(1)(b)) |
| Collector inscription (when required for your destination or chosen by you) | To create the personalised print file you approve | Performance of a contract (Art. 6(1)(b)) |
| Payment details | Stripe processes the payment and tells us whether it succeeded. We do not receive your full card number | Performance of a contract |
| Order records & invoices | Accounting and tax retention | Legal obligation (Art. 6(1)(c)) |
| Contact-form details (name, email address and message) | To receive and reply to your question | Steps requested before a contract or performance of a contract (Art. 6(1)(b)); our legitimate interest in answering other enquiries (Art. 6(1)(f)) |
| Email address (newsletter, if you opt in) | To send you updates and offers | Consent (Art. 6(1)(a)). Withdrawable anytime |
| Pages viewed, shopping events, device/browser details, IP address and Meta browser/click identifiers | Google Analytics and Meta Pixel/Conversions API, to measure site and advertising performance and attribute purchases | Consent (Art. 6(1)(a)) for visitors in the EU, EEA and UK; where local law permits, legitimate interest (Art. 6(1)(f)) with an opt-out elsewhere. Withdrawable anytime |
| Email, phone, name and delivery location converted to SHA-256 hashes after a consented purchase | To improve Meta purchase matching and avoid counting the same browser/server purchase twice. We do not send card details, collector inscriptions or other order notes to Meta | The same tracking choice and legal basis described above |
Who we share it with
- Stripe. Payment processing. (Stripe Payments Europe; transfers under the EU–US Data Privacy Framework / SCCs.)
- Google (Firebase Hosting / Google Cloud). Website hosting and server logs.
- Google Analytics. Consent-controlled website and commerce measurement.
- Meta Platforms Ireland Limited. Consent-controlled advertising measurement through Meta Pixel and Conversions API. Contact identifiers are normalized and SHA-256 hashed before server transmission.
- Resend. Delivering contact-form messages, confirmation and order emails, and maintaining the newsletter sending list.
We do not sell your data. We give each provider only the information it needs for its part of the service.
International transfers
Where a provider stores data outside the EEA (e.g. some Stripe, Google or Meta infrastructure), the transfer is covered by EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework where applicable.
How long we keep it
Order and invoice records, and where applicable the approved collector inscription and its personalised print file, are kept for up to 7 years so we can document and fulfil the order, handle product claims and meet record-keeping duties. Contact messages are kept only as long as needed to answer and handle the enquiry. Newsletter details are kept until you unsubscribe. Google Analytics event data is kept for no longer than 14 months. Meta processes event data under its Business Tools terms and your Meta privacy controls. A failed server-side Meta Purchase delivery is retried for no longer than 7 days. Your cart and selected delivery country remain in your browser until you clear them or your browser storage.
Cookies
Your cart and cookie choice are saved in your browser. If you are in the EU, EEA or UK, Google Analytics and Meta Pixel load only after you press “Accept”; the server-side Meta connection follows the same choice. Elsewhere they run by default where permitted, and you can opt out at any time through the “Cookies” link in the footer or your browser’s Global Privacy Control. Meta may set _fbp and _fbc identifiers for measurement and attribution; declining removes them from this site.
Your rights
You have the right to access, rectify, erase, restrict, port, and object to the processing of your data, and to withdraw consent at any time. To exercise any of these, email hello@vaelmar.com. You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).
See also our Seller details, Terms of Sale and Returns & Refunds.