Controller and contact
Baldin Trade OÜ, registry code 17633956, Allika tn 1, 76610 Keila, Estonia, is the controller of personal data processed through BT Beauty. For privacy requests, contact info@btbeauty.eu. This notice is provided under Regulation (EU) 2016/679 (GDPR) and the Estonian Personal Data Protection Act.
Data we process
• Contact details: name, email address and telephone number. • Order data: goods, prices, delivery address, delivery and payment status, order and invoice history. • Account data, if you create an account: profile, sign-in credentials or social sign-in identifier, saved addresses, cart and wishlist. • Return and complaint data: declarations, descriptions, photographs and correspondence. • Technical data: IP address and browser information of sign-in sessions and security records.
We do not receive or store your card details or online banking credentials; you enter them on the payment provider’s page.
Purposes and legal bases
• Performance of the contract and steps before it (GDPR Article 6(1)(b)): orders, payment, delivery, returns, complaints and your account. • Legal obligations (Article 6(1)(c)): accounting and tax records, consumer-law obligations and requests from authorities. • Legitimate interests (Article 6(1)(f)): security of the store and accounts, preventing fraud and abuse of returns, and establishing, exercising or defending legal claims. You may object to this processing. • Consent (Article 6(1)(a)): only where we ask for it separately, for example for optional cookies. You may withdraw consent at any time.
We do not send advertising emails. We send only messages needed for your order and account, such as order confirmations, order documents and sign-in emails.
Who receives your data
Our processors, bound by contracts under GDPR Article 28: • netcup GmbH, Germany: server hosting; • Zoho Corporation B.V., the Netherlands: email delivery.
Independent controllers, each responsible for its own processing: • Paysera LT, UAB, Lithuania: payment processing; • our suppliers and carriers in the EU, such as DPD: dispatch and delivery, receiving only the data needed for this; • Google or Meta, only if you choose to sign in with them; • authorities, courts and professional advisers, where required by law or needed to defend claims.
We do not sell personal data.
Processing location
We store and process your data in the EU/EEA. If you choose Google or Facebook sign-in, these providers may transfer data to the United States under the EU–US Data Privacy Framework adequacy decision (GDPR Article 45).
How long we keep data
• Orders, invoices, payment and accounting records: 7 years from the end of the financial year (Accounting Act, RPS § 12). • Return, withdrawal and complaint records: together with the related order records, as evidence for accounting and the 3-year limitation period for claims (TsÜS § 146). • Customer service emails: 3 years after the matter is closed. • Account, saved addresses, cart and wishlist: until you delete your account. • Sign-in sessions with IP address and browser information: until the session expires, at most 7 days. • Security rate-limit records: up to 1 day, in pseudonymised form. • Server security logs: up to 30 days. • Cookie choices: in your browser for up to 180 days.
After these periods, data is deleted or anonymised. Deleting your account removes account access and profile data; records that the law requires us to keep remain for the periods above.
Your data protection rights
You may request access, correction, erasure, restriction and, where applicable, portability. You may object to processing based on legitimate interests and withdraw consent at any time. Contact this store’s email; we may need to verify your identity. We normally respond within one month. A permitted extension requires notice within that month. You may complain to the Estonian Data Protection Inspectorate (aki.ee) or your competent supervisory authority. See GDPR Articles 12–22 and 77 and the Estonian Data Protection Inspectorate. Rights may be limited where a statutory retention duty or another applicable exception requires it.
Security and required information
We restrict access by role, protect account sessions and use transport protection and security logging appropriate to the processing risk (GDPR Article 32). Contact and delivery details are required to perform your purchase; without them we cannot deliver the order. Optional fields are identified where collected. We do not make solely automated decisions producing legal or similarly significant effects about your statutory return rights.