Privacy Terms

It is important for Baltic Pack EST AS (hereinafter Baltic Pack or us) that our customers (hereinafter also you) feel well and safe when communicating with us and ordering goods from us. For that reason, we make sure to protect the personal data you have entrusted us with.

The purpose of these Privacy Terms is to help you understand where we obtain your personal data, for what purposes and how we use them and what are your rights with respect to your personal data.

These Privacy Terms apply to you if you order goods from our Vins de France online store either as a registered customer (i.e. via an account) or a guest (incl. as a representative of a business customer) but also if you simply submit an information request on our website vinsdefrance.ee or contact us by phone or e-mail.

 

1. Data controller

Data controller is the person who decides why and how personal data is processed.

The administrator of the website vinsdefrance.ee and the data controller of your personal data is:

Baltic Pack EST AS
Address: Pae 1-7, Pärnu, 80010 Pärnumaa
E-mail: office@balticpack.ee

 

2. Which personal data do we collect and where do we obtain them?

The type of personal data that we use in each case depends on the purpose for which you contact us and what information you disclose to us. Some personal data are always required to provide services – such mandatory fields are marked with an asterisk (*).

Depending on the aforementioned, we may collect and process the following personal data.

• Identification data – surname and first name. These data you disclose to us yourself, when creating an account, making a purchase as a guest or submitting an information request.

• Contact details – phone number, e-mail, residential address. These data you disclose to us yourself, when creating an account or making a purchase as a guest.

• Purchase history – information about the goods you have bought from the online store (product, quantity, price, purchase date). These data are created when you order goods via our online store.

• Data of a representative of a business customer – surname and first name, e-mail address, telephone number and job title of a customer that is a legal entity or a partner of such legal entity. These data you disclose to us yourself, when creating an account, making a purchase as a guest or submitting an information request.

We do not store payment information, credit or debit card information.

 

3. For what purpose and on what legal basis do we process your personal data?

Personal data are used for different purposes and for each purpose the processing must take place on a legal basis. Baltic Pack relies on the following legal basis for processing of your personal data.

• Data processing required for the performance of a contract

We will process data on this legal basis if it is necessary for the performance of a contract between you and us or the implementation of pre-contractual measures taken at your request.

• Data processing required to fulfil the duties imposed on Baltic Pack by law

In some cases, we need to process your personal data because we are required to do so by law. If the obligation to process data arises from law, neither we nor you can influence the processing of such data.

• Data processing arising from the legitimate interest of Baltic Pack

A legitimate interest means that processing of your personal data is not directly required for the performance of the contract nor do we have a legal obligation to do so but we still need to process your personal data. This is to improve our products and services by constant development and make business decisions by keeping statistics. We also process the data of a representative of a business customer on the basis of a legitimate interest, so that we can fulfil the contract and orders entered into with the customer who is a legal entity and communicate with the customer on this matter.

As under the legitimate interest we are not obligated to process your data by law or for performance of our contractual obligations but we also do not request your permission for the processing, you have the right to ask for explanations as well as to present objections, if you consider that processing of your data for the purposes set out in the below table infringes your rights.

• Data processing based on your consent

In some cases, we need your consent to process your data, such as for the forwarding of direct marketing message but also if we have no other legal basis for processing the data.

Some examples of the purposes and legal basis for processing your personal data.

 

Purpose of the processing of personal data	Personal data categories	Legal basis for processing
Pre-contractual relations (offer requests and responses thereto)	Identification data, contact details	Performance of contract
Order management, delivery of goods	Identification data, contact details	Performance of contract
Settlement (preparing and submitting invoices, collecting payments)	Identification data, contact details	Performance of contract
Maintaining and developing the customer relationship (concluding contracts, forwarding information related to the performance of the contract)	Identification data, contact details, shopping history	Performance of contract, legitimate interest
Identification of the customer	Identification data	Performance of contract
Management of circumstances and events affecting the provision of services to the customer (providing information, resolving complaints, customer support services)	Identification data, contact details, shopping history	Performance of contract
Accounting (including retention of source documents)	Identification data, contact details	Legal obligation
Informing the Estonian Data Protection Inspectorate and the data subject about personal data breaches	Identification data, contact details, shopping history	Legal obligation
Responding to information requests from public authorities and state institutions	Identification data, contact details, shopping history	Legal obligation
Communication with a representative of a business customer for the performance of a contract and orders entered into with a business customer and for any other purposes related to the customer relationship	Information of a representative of a business customer	Legitimate interest
Maintenance and development of a customer relationship (responding to inquiries, general customer service, forwarding information)	Personal data, contact details, service details	Legitimate interest

 

 

4. Who else can process your personal data in addition to Baltic Pack?

Should it be necessary for the purposes of processing personal data, we may share your personal data with the following persons:

• Persons providing services to us. Persons providing the following services have access to your data to the extent necessary (i.e. to the extent necessary to provide services to us): business software provider, IT administration and maintenance service provider, mail server provider, auditor, lawyers, collection service providers, customer support providers, marketing and advertising partners, payment service providers.

• Public authorities (e.g. Estonian Police and Border Guard Board, Estonian Data Protection Inspectorate). We will only transfer your information if we are required to do so by law.

• Third parties in connection to Baltic Pack transactions. We may share your data with third parties when making corporate deals, e.g. when selling the company or a part of it to another business. Also, in the context of creation, merger or other kind of reorganisation of a joint undertaking.

Your personal data will be stored on a web server provided and protected by Zone Media OÜ. These computer servers are accessed through firewalls and security gateways. We do not store or transfer your personal data outside the European Economic Area.

 

5. How long can personal data be retained?

We will retain your personal data for as long as required by law or as necessary to fulfil the purposes described in the Privacy Terms. Here are some examples of data retention periods:

Retention period	Examples
7 years (from expiry or termination of contract)	Accounting source documents (e.g. contract with client, orders and invoices).
Until withdrawal of consent	Data for the processing of which you have given your consent, e.g. forwarding of direct marketing offers to your e-mail or via phone.

 

You can get additional information about the retention period of your personal data by sending a corresponding request to office@balticpack.ee.

 

6. Security of your personal data

Baltic Pack has established the necessary legal, organizational, physical and technical security measures to protect your personal data. Some examples of the measures we use:

Physical measures – paper documents containing personal data are kept in locked rooms and lockers that are accessible only to certain employees for the performance of their duties; data processing rooms and IT systems are adequately protected against fire, overheating, water, power fluctuations and power outages.

Technical measures – all work computers are protected by a screen saver with a password when the employee leaves; IT systems do not allow new login attempts and lock the user ID if the number of failed login attempts exceeds a certain limit; it is ensured that particularly vulnerable systems (e.g. laptops, smartphones) are adequately protected (for example, by means of encryption or other measures).

Organizational measures – roles and profiles are assigned to all users of IT systems; the access rights are revoked upon an employee’s departure from Baltic Pack; it is ensured that no unauthorised access to premises used for processing personal data is possible via public premises.

Your online store user account information is password protected. To ensure protection, do not share your password with third parties. If you share your computer with other people, we recommend that you close your browser window at the end of your session. Signing out protects your information when you share your computer with someone else or use a public computer.

 

7. Your rights in respect of personal data

Right of access – you have the right to know what data we have collected about you, for what purpose it is being processed; to whom the data are disclosed; how long the data are stored; what are your rights regarding the rectification, erasure and restriction of data processing

Right of rectification – you have the right to request the rectification of personal data concerning you if they are incorrect or incomplete. You can also edit certain information by logging in to your Baltic Pack account.

Right of erasure – in certain cases, you have the right to request that we delete your personal data, especially if we no longer need it, you withdraw your consent to the processing of the data and there is no other basis for further processing of the data or if we have used your data illegally.

Right to restriction of processing – in certain cases, you have the right to prohibit or restrict the processing of your personal data for a certain period of time (e.g. if you have objected to the processing).

Right to object – you have the right to object to the processing of personal data based on the legitimate interests of Baltic Pack, incl. profiling carried out on the basis of our legitimate interest. Upon filing an objection, we must stop processing your personal data, unless we can prove that we are processing your personal data for a valid legitimate reason or for the purpose of establishing, exercising or defending legal claims. You also have the right to object to the processing of personal data carried out for the purpose of direct marketing; if you submit such an objection, we will stop using the data for direct marketing.

Right to data portability –if the processing of personal data is based on your consent or a contract concluded with us and the data is processed automatically, you have the right to receive the personal data concerning you that you have provided to us as data controller, in a structured, commonly used and machine-readable format. You also have the right to demand that Baltic Pack transmits such data directly to other service provider, if technically possible (i.e. the other service provider is capable of accepting such data in the format to be transmitted).

If you wish to exercise any of the above rights, please contact us at office@balticpack.ee. In order for us to respond to your request, we must identify you in advance so that we do not provide information to an unauthorized person. We will respond to your inquiries within 30 days.

 

8. The right to file a complaint with the Data Protection Inspectorate and the court

We respect your privacy and we want the processing of your data to be transparent and comprehensible. For this reason, we have also drawn up this Privacy Terms. For additional information regarding your personal data or the exercise of your rights, you can always contact us at office@balticpack.ee.

If you find that the processing of your personal data violates the requirements of the General Data Protection Regulation, you have the right to address the Data Protection Inspectorate or a court in defence of your rights and interests

 

9. Changes to the Privacy Terms

Baltic Pack may unilaterally amend and supplement these Privacy Terms from time to time, in particular in the event of changes in the laws governing the processing and protection of personal data or our own data processing regulations. We will inform you of such updates on our website.