Effective from 19 August 2026
1. General
1.1. This privacy policy explains how TIN.CANDLES OÜ (registry code 16824453, address Läänemere tee 6-43, 13913 Tallinn, e-mail info@inlove.ee) — hereinafter We or the Controller — collects, uses, stores and protects the personal data of visitors to and customers of the online store inlove.ee (hereinafter the Online Store).
1.2. Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR) and the Personal Data Protection Act of the Republic of Estonia.
1.3. By using the Online Store, you confirm that you have read this privacy policy.
1.4. This privacy policy is available in Estonian, Russian and English. In the event of any discrepancy between the language versions, the Estonian version prevails.
2. What data we collect
2.1. When you place an order:
- first name and surname;
- e-mail address;
- phone number;
- delivery address or the location of the chosen parcel locker;
- for a buyer who is a legal person: business name, registry code, VAT number, billing address;
- order contents, amount and order history;
- information about the payment method (We do not see or store your bank or card details).
2.2. When you create an account: username, e-mail address, encrypted password, order history.
2.3. When you subscribe to the newsletter: e-mail address and, if you wish, your first name.
2.4. When you contact us: name, e-mail address, phone number and the content of the correspondence.
2.5. Technical data collected automatically: IP address, device and browser type, pages visited, time and duration of the visit, referring website — collected through cookies (see section 8).
3. Purposes and legal bases of processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Receiving and fulfilling orders and delivering goods | Performance of a contract (Art. 6(1)(b)) |
| Processing and confirming payments | Performance of a contract (Art. 6(1)(b)) |
| Accounting and storing invoices | Compliance with a legal obligation (Art. 6(1)(c)) |
| Customer support, handling claims and returns | Performance of a contract / legitimate interest (Art. 6(1)(b), (f)) |
| Sending the newsletter and offers | Consent (Art. 6(1)(a)) |
| Operation, security and statistics of the Online Store | Legitimate interest (Art. 6(1)(f)) |
| Marketing and analytics cookies | Consent (Art. 6(1)(a)) |
4. Sharing data with third parties
4.1. We do not sell or rent your personal data to third parties.
4.2. Personal data is transferred only to authorised processors who are necessary for fulfilling the order, and only to the minimum extent necessary:
| Recipient | Data transferred | Purpose |
|---|---|---|
| Maksekeskus AS (reg. code 12268475, Niine 11, Tallinn) | name, e-mail, order number and amount | payment processing |
| Itella Estonia OÜ (SmartPost) and other carriers used | name, phone, e-mail, delivery address or parcel locker | delivery of goods |
| Web hosting provider | data stored on the server | web hosting |
| Accounting service provider | invoice and transaction data | accounting |
4.3. Personal data may be disclosed to law enforcement or supervisory authorities where there is a legal basis for this.
4.4. Data is not transferred outside the European Economic Area, unless the service provider uses the European Commission’s standard contractual clauses or another safeguard permitted under Chapter V of the GDPR.
5. Data retention periods
5.1. Order and invoice data — 7 years under § 12 of the Accounting Act.
5.2. Customer account data — until the account is deleted or up to 3 years from the last login.
5.3. Newsletter data — until consent is withdrawn (you can unsubscribe with one click in every e-mail).
5.4. Customer support correspondence — up to 3 years from the enquiry.
5.5. Cookies — according to the periods set out in section 8.
5.6. After the retention period, the data is deleted or anonymised.
6. Your rights
You have the right to:
- access your personal data and receive a copy of it (Art. 15);
- request the correction of inaccurate data (Art. 16);
- request the erasure of data (Art. 17) — except data that must be kept by law;
- request the restriction of processing (Art. 18);
- receive your data in a machine-readable format and transfer it (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
- lodge a complaint with the Data Protection Inspectorate (Tatari 39, 10134 Tallinn, e-mail info@aki.ee, www.aki.ee).
To exercise your rights, send a request to info@inlove.ee. We will reply within one month at the latest. We may ask for additional information to verify your identity.
7. Data security
7.1. The Online Store uses an encrypted connection (SSL/TLS), so data transmission is protected.
7.2. Only persons who need access to personal data to perform their duties have such access, and they are bound by a duty of confidentiality.
7.3. We apply appropriate technical and organisational security measures (access restrictions, backups, regular software updates).
7.4. Payment transactions take place in the secure environment of Maksekeskus AS — We have no access to your bank or card details.
7.5. In the event of a personal data breach that is likely to result in a high risk to your rights, we will notify you and the Data Protection Inspectorate in accordance with the procedure established by law.
8. Cookies
8.1. A cookie is a small text file that a website stores on your device.
8.2. The Online Store uses the following types of cookies:
- Strictly necessary cookies — ensure that the shopping basket, login and security work. They cannot be switched off and no consent is requested.
- Preference cookies — remember the chosen language and settings. Kept for up to 1 year.
- Statistics and analytics cookies — help us understand how visitors use the Online Store. Based on consent, kept for up to 2 years.
- Marketing cookies — make it possible to show relevant advertising. Based on consent, kept for up to 1 year.
8.3. We ask for consent on your first visit through the cookie banner. You can change or withdraw your consent at any time via the banner settings link or by deleting cookies in your browser.
8.4. Blocking cookies in your browser may prevent some functions of the Online Store (e.g. the shopping basket) from working.
9. Children’s data
The Online Store is not aimed at persons under the age of 16 and does not knowingly collect their personal data. If we learn that we have collected such data without parental consent, we will delete it immediately.
10. Changes
10.1. We have the right to amend the privacy policy unilaterally by publishing a new version on the Online Store website together with its effective date.
10.2. In the event of significant changes, we will notify registered customers by e-mail.
11. Contact
For all questions concerning the processing of personal data:
TIN.CANDLES OÜ
Registry code: 16824453
Address: Läänemere tee 6-43, 13913 Tallinn
E-mail: info@inlove.ee
Phone: +372 55659903