Privacy policy

Valid from 17 October 2026. In case of any discrepancy, the Estonian version prevails.

This page explains what personal data we collect in the raniorg.ee online shop, why and for how long we keep it, and what rights you have.

1. Data controller

2. What data we collect

• When you order: name, email, phone, parcel locker or delivery address, ordered products, amount, payment method and payment status, and any additional information you write.
• In the contact form: name, email, phone (if you add it) and your message.
• Product review (optional): your rating, the text you write and the name you choose to publish (by default your first name and last initial), linked to your order to confirm the purchase. We email a review invitation to all customers after delivery.
• Customer account (optional): email, name and phone (if you add them), your favourite parcel locker (if you chose one), sign-in times and your choice about receiving offers (with the time consent was given or withdrawn). When you sign in with Google, we receive your name, verified email and Google account identifier – not your password or any other data. Your account shows the orders placed with the same email.
• Customer account conversations: your messages and ours, and photos you send in a conversation (we make photos smaller and remove extra image data such as location).
• Prize draw (optional, on a campaign page): name, email, phone (optional), the time of entering and confirming, and a separate newsletter choice.
• Gift to a recipient / corporate gifts (optional): recipient name and phone (parcel locker code), greeting, preferred delivery week; company name, registry code and VAT number; a corporate recipient list (name, phone, parcel locker, email) and greeting card text and logo. Used only to fulfil the order and deleted together with the order contact data (2 years).
• "Notify me when back in stock": email and product – we send one email when the product is back, then the data is deleted.
• Abandoned cart: only if you are signed in and have given marketing consent, we store your cart and send one reminder after 24 hours if you have not ordered (deleted after 30 days or when you order).
• Gift code: the code amount, balance, validity, who it was issued to and the orders it was used in.
• Newsletter (optional): email, language, how you subscribed (footer form, checkout, account or email button) and the time of subscribing, confirming and unsubscribing.
• Technical data: to prevent spam and abuse we keep a hash of your IP address and email address (not the address itself) for up to 24 hours.

When paying by bank link, you enter your bank details in your own internet bank. They never reach us.

Your name, email, phone and parcel locker are required for an order – without them we cannot accept the order or send the parcel. Everything else (account, newsletter, review, conversation) is optional.

3. Why we use the data

• Fulfilling your order – sending the confirmation, matching the payment to the order, shipping the parcel and communicating with you (performance of a contract, GDPR Art. 6(1)(b)).
• Accounting – documenting sales as required by law (legal obligation, GDPR Art. 6(1)(c)).
• Answering the contact form and protecting the shop from spam (legitimate interest, GDPR Art. 6(1)(f)).
• Customer account – signing in and showing your orders (performance of a contract, GDPR Art. 6(1)(b)).
• Loyal customer offers – if you are signed in and have an earlier paid or delivered purchase, we use your earlier purchases to work out which discounts apply to you (e.g. −15% on a flavour you have not bought before, or free delivery). This is a simple automatic rule with no legal or similarly significant effect on you (legitimate interest in rewarding loyal customers, GDPR Art. 6(1)(f)).
• Collecting and publishing product reviews (invitation after purchase, publishing in our shop and in Google Search/Shopping) – legitimate interest in helping other shoppers choose (GDPR Art. 6(1)(f)); publishing with your consent, given when you submit the review. You can ask us to delete your review by emailing info@raniorg.ee.
• Offers and news by email – only if you have given your consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time on your account page (untick the box) or via the link in each email – either way sending stops immediately. When you sign up in the footer form or with the checkout checkbox we first send a confirmation email – the subscription starts only once you confirm. In the order confirmation and shipping emails we may politely ask whether you would like the newsletter; you subscribe only if you press the button yourself, and “Don't ask again” stops the question. We keep an unsubscribed address only so that we do not email you again.

We do not sell or give your data to third parties for marketing.

4. Who we share data with

• Maksekeskus AS – processing bank link payments (order number, amount, email and IP address for fraud prevention); as a payment service provider Maksekeskus is itself a controller.
• Maksekeskus AS (Tarne+) and the carrier you choose (Omniva, DPD, Smartpost, Venipak or Unisend) – registering and delivering your parcel (name, phone, email, parcel locker, order number).
• Zone Media OÜ – web hosting and email service on whose servers the data is stored.
• Google – if you choose "Sign in with Google", Google confirms your email to us (under Google's own privacy terms). Published product reviews (public name, text, rating, date) are sent to Google Merchant Center so they can appear in Google Search and Shopping. Google LLC may process data in the USA; transfers rely on the EU–US Data Privacy Framework. We serve the site's fonts from our own server – your IP address does not reach Google.

Our other partners process data within the European Union. We may also share data with our accountant and with public authorities where required by law.

5. How long we keep data

• Prize draw: unconfirmed entries are deleted after 30 days; all entrants' data is deleted after the period stated in the draw terms (30 days by default) after the draw. The draw log keeps only the time, the number of entrants and the winner's first name and last initial. We use the data only to run the draw and contact the winner (GDPR Art. 6(1)(b)); the newsletter is sent only if you ticked its separate box.
• Your contact details (email, phone, delivery address, notes) are deleted automatically after 2 years – the period for complaints about defects.
• Order contents, amounts, payment details and the buyer's name are kept for 7 years, as required by the Accounting Act. After that the order is deleted completely.
• Messages (contact form and customer account messages, with our replies) are kept for up to 2 years after the last message in the conversation and are then deleted automatically. The same applies to photos sent in a conversation: we make them smaller and remove extra image data (e.g. location); only the participants of the conversation can see them.
• IP address and email hashes are deleted automatically within 24 hours; expired sign-in links and sessions are deleted automatically.
• Newsletter: unconfirmed sign-ups are deleted after 30 days; subscriber data is kept until you unsubscribe. An unsubscribed address stays only on a suppression list so that we do not email you again.
• A published review is kept until you ask us to delete it (it only carries the name you chose, so deleting order contact details does not affect it).
• Customer account data is kept until you delete your account ("Delete account" on the account page) or ask us to delete it. Deleting the account also stops the newsletter. Orders are kept for the periods above; messages are deleted 2 years after the last message (write to us if you want them deleted sooner).

6. Cookies and browser storage

We do not use advertising or tracking cookies or third-party analytics tools (such as Google Analytics).

• Your shopping cart, discount code and language choice, a marker that you are signed in on this browser (no personal data), a marker if you chose "Not now" at a newsletter invitation (60 days) and your statistics choice ("Allow" / "Don't allow") are saved in your browser (localStorage).
• Your checkout details (name, phone, email, parcel locker, notes) stay in your browser so they are not lost if a payment is interrupted. They are deleted after a successful order. Right after an order your email is briefly kept in the browser session so that the thank-you page can offer the newsletter.
• The order form uses a technical session cookie that prevents repeated submissions and is deleted when you close the browser.
• Signing in to your customer account stores a sign-in cookie (up to 60 days from your last visit or until you sign out), and signing in with Google uses a short-lived security cookie (10 minutes). These are necessary for the account to work.

Visitor statistics are our own and cookieless: we count page views, add-to-cart actions and where visitors come from (e.g. Google or Facebook). Only if you press "Allow" at the statistics question do we also count time spent on a page, clicks on buttons and links (the button text, never what you type) and the country based on the browser time zone (consent, GDPR Art. 6(1)(a)). You can change your choice at any time via the "Statistics settings" link in the footer. IP addresses are not stored – a visitor is represented by a hash whose random part changes every day and is deleted, so nobody can be identified or followed from day to day (legitimate interest in improving the shop, GDPR Art. 6(1)(f)). Per-visitor rows (daily hash, source, device) and aggregate data are kept for up to 2 years; since the random part of the hash is deleted every day, they cannot later be linked to any person. No cookie consent banner is needed because we only use cookies needed for the site to work and your own choices.

7. Your rights

You have the right to:

• access your data and receive a copy of it;
• have inaccurate data corrected;
• have your data deleted, unless we are required by law to keep it;
• restrict or object to the processing of your data;
• receive your data in a machine-readable format.

Write to info@raniorg.ee – we will reply within one month. If you believe we have violated your rights, you may contact the Estonian Data Protection Inspectorate (www.aki.ee).