Privacy policy

1. Data controller and contact details

The data controller for personal data is Tiimiriided OÜ (hereinafter referred to as we), registry code 14563362, address Aida 7, 80010 Pärnu, Estonia. For data protection queries and to exercise your rights, you can contact us via the email address info@tiimiriided.ee, by telephone +372 5660 8532 or in writing to the stated address.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter GDPR), the Estonian Personal Data Protection Act and other applicable legislation.

2. What data we receive and where it comes from

2.1. We collect data primarily from you yourself when you fill out a contact form or product enquiry, send an email or place an order. The scope of the data processed depends on the service used:

• for enquiries and quotes, name, email address, phone number provided by you, name of the company or organisation and role of representation, as well as the content of the enquiry, product selections, quantities, and attached files;
• for an order placed via the shopping cart or confirmed on the basis of a quotation, the contact details of the customer and, where applicable, the recipient, the products ordered, sizes, quantities, design options, text to be added to the product, delivery method, and the data necessary for delivery and invoicing;
• for payments and refunds, the payment amount, time, status, transaction or order identifier and, where necessary, the payer’s name and account number;
• in the case of customer communication, correspondence, order confirmations, complaints and evidence required for their resolution;
• for sending newsletters and offers, email address, name if available, represented organisation and professional role, field of activity or previous purchase necessary for assessing the relevance of the offer, and the source of contact details, basis for sending, notification, consent and opt-out data;
• when using the website, the IP address, time of the request, technical data of the browser and device, error messages, and data related to cookies and consent preferences to the extent described in section 6.

2.2. We also receive payment status and transaction data from the payment service provider, and shipment tracking data from the delivery partner. The contact details of a company's or organisation's contact person may originate from the organisation they represent. In order to make relevant offers to companies and organisations, we may also use professional contact details published in public sources, such as the organisation's website, a public business register or a trade directory. We only use the data necessary for the purpose of the approach under the conditions described in section 3.5.

If we obtain personal data from somewhere other than yourself, we also provide information about their source and the categories of data being processed. We provide the information required under Article 14 of the GDPR within a reasonable period, at the latest within one month of obtaining the data; if we contact you earlier or disclose the data to another recipient earlier, we provide the information at the latest at the time of that action. We take into account the exceptions provided for in Article 14, such as when you already have the relevant information.

2.3. We require the fields marked as mandatory on the form to process the relevant query or fulfil the order. If this information is missing, we may not be able to respond, prepare a quotation or fulfil the order. Failing to complete the optional fields will not prevent the use of the service, provided the necessary data is available. Please provide only the information necessary for the query or order.

3. Objectives and legal bases

3.1. Enquiries, quotations and orders

We use the data to reply to you, prepare a quotation, coordinate the design, send the order into production, arrange payment, and deliver the goods. If you are a natural person concluding a contract, the legal basis is taking steps at your request prior to entering into a contract or the performance of a contract (Article 6(1)(b) of the GDPR).

3.2. Corporate representatives and other communication

We process the contact details of a company or organisation's contact person on the basis of our legitimate interest in managing customer relations and in concluding and performing a contract with the person represented. The same basis applies to responding to general enquiries, provided that the enquiry does not relate to a contract to be concluded with you (Article 6(1)(f) of the GDPR).

3.3. Accounting and statutory obligations

We process invoices, payment details and other required documents to fulfil accounting and tax obligations. The legal basis is compliance with a legal obligation (Article 6(1)(c) of the GDPR).

3.4. Complaints and defence of rights

When resolving complaints, we proceed from the performance of the contract and the applicable statutory obligation. To submit claims, respond to them, and prove agreements and the proper fulfilment of the order, we retain the necessary data on the basis of legitimate interest (Article 6(1)(f) of the GDPR).

3.5. News, offers and collaboration opportunities

We may send information by email about Team Clothing products, services and cooperation opportunities based on your choices, a previous customer relationship or a legitimate interest related to the activities of the organisation you represent. In doing so, we follow the principles set out below and the requirements provided in section 103¹ of the Electronic Communications Act.

Offers sent on the basis of consent. If you give consent to receive news or offers, we will use your data within the scope of that consent (Article 6(1)(a) of the GDPR). Submitting an enquiry or order does not in itself constitute the giving of marketing consent.

Offers for existing customers. We may use the email address obtained in the course of selling a product or service to offer our similar products or services, provided that we gave you a clear and simple option to refuse this free of charge when collecting the address and you have not refused. The option to opt out is also available in every subsequent message. When processing personal data, we rely on our legitimate interest to maintain the customer relationship and introduce relevant products or services to the customer (Article 6(1)(f) of the GDPR), having previously assessed the necessity of the processing and its impact on your rights.

Offers aimed at businesses and organisations. We may send product and cooperation offers related to its activities to the contact details of a legal entity without prior consent, including by using contacts obtained from public sources. The sender is identifiable in every message, and opting out of offers is free and easy. If the data used allows a contact person to be identified, we process it on the basis of our legitimate interest in establishing and developing business relationships and introducing solutions related to the organisation's needs (Article 6(1)(f) of the GDPR). We pre-assess the contact person's professional connection to the offer, the necessity of data use, and the rights and reasonable expectations of the contact person. Prior consent is required to use a personal email address, except in the case of the existing customer exception described above.

Declining offers. You have the right at any time to opt out of offers free of charge and to prohibit the use of your data for direct marketing. To do this, use the opt-out link in the email or send your opt-out request to info@tiimiriided.ee. Following your withdrawal, we will cease using the relevant data for marketing purposes. The withdrawal of consent does not affect the lawfulness of processing carried out prior to it. We will continue to send notices necessary for the fulfilment of the order on the basis of contract performance.

3.6. Website security and consent management

We process limited technical logs on the basis of legitimate interest to ensure the reliability of the website, detect misuse and resolve errors (Article 6(1)(f) of the GDPR). We process evidence of giving and withdrawing consent to fulfil the accountability obligation arising from Articles 5 and 7 of the GDPR (Article 6(1)(c)). Optional analytics and advertising tracking are covered in section 6.

3.7. Feedback and presentation of completed work

If we wish to publish feedback in your name or a photo in which you are identifiable, we will ask for separate consent to do so and explain the content and channels of publication. Giving consent is voluntary and it can be withdrawn at any time.

4. Recipients of data and transfer

4.1. We transfer personal data only to the extent necessary for the respective service provider to perform their task. Depending on the service used, recipients of the data may include web hosting and maintenance, email, file management, order management, accounting, proposal letter and consent management service providers. We arrange the processing with service providers processing data on our behalf on the basis of an agreement complying with the requirements of Article 28 of the GDPR.

4.2. When using the Montonio payment solution, we transmit the order and payment data necessary for making the payment to Montonio. Montonio Finance UAB (registration code 305205122, Lithuania) is an independent controller when providing payment initiation and card payment services. Montonio Finance OÜ may act as our processor when providing additional services for the management of orders and shipments. You can find information about Montonio's data processing in its privacy policy.

Montonio privacy policy

4.3. To deliver the goods, we will provide the recipient's name, necessary contact details, delivery address, and shipment details to the carrier or parcel locker service provider chosen in the order. Depending on the chosen delivery method, the delivery partners are DPD, Omniva, and Smartpost. In the case of any other delivery agreed upon based on an offer, we will inform you of the delivery method used before transferring the data.

4.4. If the design or manufacture of a product requires the use of personal data, we will provide the designer or manufacturer only with the content of the order necessary for this purpose, such as the text to be added to the product and the corresponding product selection. Design and manufacturing partners may also be located in other countries of the European Economic Area, including Poland.

4.5. In the event of a statutory obligation, we shall forward the necessary data to the competent authority. For the protection of rights, we may provide relevant data to a legal adviser or dispute resolution body.

4.6. If the service used involves the transfer of or access to data outside the European Economic Area, the transfer must be based on a permitted ground under Chapter V of the GDPR. We use an applicable European Commission adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses together with supplementary measures where necessary. The specific web service recipient, processing countries, and the basis for the transfer are set out in the cookie settings before consent is requested. Information regarding transfers to third countries via other services is provided before the respective processing begins. You can obtain further information and a copy of the applicable safeguards by contacting info@tiimiriided.ee.

5. Data retention

5.1. We proceed on the basis of the following retention periods. Upon expiry of the retention period, we shall delete the data or render it unidentifiable:

• enquiries and quotes that did not lead to my order, together with the necessary correspondence: up to 12 months from the last substantive communication;
• data evidencing the performance of the order and agreements, approved designs, and necessary correspondence: generally for up to 3 years from the performance of the order; temporary working files containing personal data shall be deleted earlier once their purpose has been fulfilled;
• accounting source documents: 7 years from the end of the financial year in which the transaction was recorded in the accounting based on them; for other accounting documents, we follow the deadline provided by law for them;
• data of recipients of news and offers based on consent: until the withdrawal of consent or the termination of the respective notification; we review the list at least once a year and remove unnecessary or invalid contacts;
• Contact details of previous clients and organisations for sending quotes on the basis of a legitimate interest: until there is a justified need to make quotes and the contact remains relevant, or until opting out of quotes. We assess at least once a year the duration of the client relationship, the time elapsed since the last purchase or substantive communication, and the continued suitability of the contact person's professional role and the quotes. Upon the end of the need or suitability, we remove the data from the marketing list;
• minimum information necessary to prove consent, the origin of contact details, notification and the basis for sending: during the relevant processing and, where necessary, for up to 3 years after its termination. We retain evidence of consent to fulfil the burden of proof; other evidence to the necessary extent on the basis of a legitimate interest to prove the lawfulness of our activities. We retain the minimum record of opting out of marketing to comply with a statutory prohibition for as long as necessary to rule out unwanted re-contacting;
• website security and log files: generally up to 90 days; the portion necessary for proving a specific security incident until the case is resolved and the limitation period for the relevant claim expires;
• cookies and related data: until the expiry date indicated for the respective service in the cookie settings or until the earlier withdrawal of consent, unless there is another legal basis for further processing;
• feedback and photos published with consent: until the withdrawal of consent or the end of the purpose of publication; we assess the need for publication at least once a year.

5.2. If longer retention of specific data is necessary due to an ongoing dispute, claim or legal obligation, we shall retain only the data necessary for this purpose until the respective reason ceases to exist. Data preserved in backups shall be deleted in the course of normal backup overwriting; their use is restricted to the necessity of system restoration. Upon restoration, we shall re-apply previously made deletions.

6. Cookies and User Metrics consent management

6.1. Cookies are small data files saved on the device. The website may also use other technologies with a similar purpose. Choices regarding cookies and related data processing are managed through the User Metrics solution.

6.2. We use strictly necessary cookies to provide the service you have requested, such as ensuring the shopping cart functions, maintaining a secure session and remembering your cookie preferences. Consent is not requested for their use if they meet the conditions of strict necessity stipulated by law. The legal basis for the associated processing of personal data is, depending on the purpose, the performance of a contract, the legitimate interest in ensuring security, or the legal obligation to prove consent.

6.3. We use analytics, advertising and other voluntary cookies and related processing of personal data only on the basis of your prior consent. The purpose of analytics is to understand website usage and improve its performance. The purpose of advertising technologies is to evaluate advertising performance and to show offers matching your interests. Precise services and data usage are described in the cookie settings before making a selection.

6.4. You can accept all optional cookies, decline them or select purposes individually. Optional choices are switched off by default. Continuing to use the website or closing the notice is not considered consent. Declining does not prevent sending an enquiry or making a purchase.

6.5. To change your choices and withdraw your consent, open the „Cookie settings“ link in the website footer. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

6.6. The cookie settings set out the provider of each service used, the purpose, the data processed, the names and duration of the cookies or other storage tools, information on data retention, recipients, and, where applicable, the transfer of data outside the European Economic Area and its legal basis. This information supplements these terms and conditions. During consent management, we store the choice made, the time and version of the choice, and the technical identifier necessary to implement and verify the choice.

7. Your rights

7.1. You have the right to obtain information about the processing of your personal data and a copy of the data being processed, to request the rectification of inaccurate data, and, under the conditions set out in the GDPR, the erasure of data or restriction of processing.

7.2. Where we process the data you have provided by automated means on the basis of consent or a contract, you have the right to receive it in a structured, commonly used and machine-readable format and to transmit those data to another controller. Where technically feasible, you can request the direct transmission of the data.

7.3. You have the right to object, on grounds relating to your particular situation, to processing based on legitimate interests. In such a case, we will cease the processing in question, unless we demonstrate compelling legitimate grounds or the processing is necessary for the establishment, exercise or defence of legal claims. In the event of an objection to processing for direct marketing purposes, we will cease using the data for that purpose.

7.4. You can withdraw your consent at any time. The withdrawal does not affect the lawfulness of processing carried out prior to it. The right to erasure does not cover data that we are required to continue retaining to comply with a legal obligation or for another reason permitted under the GDPR.

7.5. To exercise your rights, please contact info@tiimiriided.ee. We shall respond without undue delay and at the latest within one month of receiving the request. Considering the complexity and number of requests, we may extend the time limit by up to two months, informing you of the extension and the reasons for it within the first month. In the event of reasonable doubt, we may request additional information necessary to verify identity. The processing of requests is generally free of charge; charging a fee or refusing to fulfil a request is only possible on the grounds provided for in the GDPR.

7.6. If you find that your personal data is being processed unlawfully, you have the right to lodge a complaint with the Data Protection Inspectorate (www.aki.ee, info@aki.ee, Tatari 39, 10134 Tallinn) or to another competent data protection supervisory authority, and to lodge a court action. Contacting us is not a prerequisite for lodging a complaint.

8. Data protection and automated decisions

8.1. We implement technical and organisational security measures appropriate to the risk of processing. We restrict access to individuals who need the data to perform their job duties, and we use access management and appropriate security measures to protect the data.

8.2. We do not make decisions based solely on automated processing concerning you that produce legal effects or similarly significantly affect you. The personalisation of consent-based advertising may involve the assessment of interests; the operation of the respective service is described in the cookie settings.

9. Modification of terms

We update the privacy policy if data processing or applicable law changes. We publish the up-to-date text on the website along with the date of the latest update. We will notify you of any significant change in an appropriate manner before it is implemented. If a new processing purpose requires consent, we will ask for it separately.