1. General Provisions 1.1. This privacy policy regulates the principles of collecting, processing, and storing personal data. Personal data is collected, processed, and stored by JO EHTED OÜ (hereinafter referred to as the Data Processor).

1.2. A data subject in terms of this privacy policy is a customer or other natural person whose personal data is processed by the Data Processor.

1.3. A customer in terms of this privacy policy is anyone who purchases goods or services from the Data Processor’s website.

1.4. The Data Processor follows the data processing principles set out in legislation, including processing personal data lawfully, fairly, and securely. The Data Processor can confirm that personal data has been processed in accordance with legal requirements.

2. Collection, Processing, and Storage of Personal Data 2.1. Personal data collected, processed, and stored by the Data Processor is gathered electronically, mainly through the website and email.

2.2. By sharing personal data, the data subject grants the Data Processor the right to collect, organize, use, and manage personal data that the data subject directly or indirectly shares when purchasing goods or services on the website, for purposes defined in this privacy policy.

2.3. The data subject is responsible for ensuring that the data provided is accurate, correct, and complete. Knowingly submitting false information is considered a violation of the privacy policy. The data subject must immediately notify the Data Processor of any changes to the submitted data.

2.4. The Data Processor is not liable for damages caused to the data subject or third parties due to the submission of false information by the data subject.

3. Processing of Customer Personal Data 3.1. The Data Processor may process the following personal data of the data subject:

• First and last name
• Phone number
• Email address
• Delivery address
• Bank account number
• Payment card details

3.2. In addition, the Data Processor has the right to collect customer data available in public registers.

3.3. The legal basis for processing personal data is Article 6(1)(a), (b), (c), and (f) of the General Data Protection Regulation: a) The data subject has given consent to process their personal data b) Processing is necessary for the performance of a contract c) Processing is necessary for compliance with a legal obligation f) Processing is necessary for legitimate interests pursued by the Data Processor

3.4. Personal data processing according to purpose:

• Security and safety: Retained as required by law
• Order processing: Maximum 60 days
• E-shop service operation: Maximum 60 days
• Customer management: Maximum 60 days
• Financial activities and accounting: As required by law
• Marketing: Maximum 90 days

3.5. The Data Processor may share customer personal data with third parties such as authorized processors, accountants, transport and courier companies, and payment service providers. Montonio Finance OÜ is an authorized processor for payment processing.

3.6. The Data Processor implements organizational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure, and any other unauthorized processing.

4. Data Subject Rights 4.1. The data subject has the right to access and review their personal data.

4.2. The data subject has the right to receive information about the processing of their personal data.

4.3. The data subject has the right to supplement or correct inaccurate data.

4.4. Where processing is based on consent, the data subject has the right to withdraw consent at any time.

4.5. To exercise their rights, the data subject can contact customer support at jodisain@gmail.com.

4.6. The data subject has the right to file a complaint with the Data Protection Inspectorate.

5. Final Provisions 5.1. This privacy policy has been prepared in accordance with Regulation (EU) 2016/679 (GDPR), the Estonian Personal Data Protection Act, and other applicable EU and Estonian legislation.

5.2. The Data Processor has the right to partially or fully modify these privacy policy terms, notifying data subjects of changes through joehted.ee.

Last updated: February 22, 2025