PRIVACY POLICY
Sundari Invest OÜ (hereinafter Sacred Amrita) establishes the principles on the basis of which Sacred Amrita, as a personal data processor, processes the personal data of its customers. The Privacy Policy applies to all customers who are natural persons and purchase goods from the online store of Sacred Amrita (hereinafter the online store) and visit the online store. Personal data are used to provide the best customer service possible and to fulfil all contractual relationships and legal obligations. All personal data provided to Sacred Amrita is confidential and will not be disclosed to third parties.
1. DEFINITIONS
1.1. A data subject is a natural person whose personal data is processed.
1.2. The Privacy Policy is this text, which sets out the principles for the processing of personal data at Sacred Amrita.
1.3. Personal data is any data about an identified or identifiable natural person.
1.4. Processing of personal data is any activity performed with regards to the data subject’s personal data. For example, the collection, saving, organisation, storage, alteration or disclosure of, provision of access to, querying or extraction, use, transfer, cross-use, linking, closure, deletion or destruction of personal data, or several of the above actions, regardless of the manner in which the actions are performed or the means used.
1.5. A customer is any natural or legal person who uses or has expressed a desire to use the services of Sacred Amrita.
1.6. A contract is a service or any other contract entered into between Sacred Amrita and a customer.
1.7. The website www.sacredamrita.ee is the website of Sacred Amrita.
1.8. A visitor is a person who uses the website of Sacred Amrita.
1.9. Services are any services and products provided by Sacred Amrita.
1.10. Cookies are data files that are sometimes stored on the device of a website visitor.
1.11. Sacred Amrita is the controller who applies the principles of personal data processing and whom the data subject can contact in the case of a complaint.
1.12. Sales channels are the communication methods employed by Sacred Amrita to communicate with data subjects, ie tools created for the sale of goods and provision of services. These channels include email, public and social media, various chat lines, personalised and interactive advertisements and other similar tools on websites and elsewhere.
1.13. The product portfolio is the various products and services of Sacred Amrita, the list of which is available on the website www.sacredamrita.ee
2. DATA PROCESSING AND ACCESS
2.1. We process personal data in accordance with the Privacy Policy and the Terms and Conditions of Sale.
2.2. The data can be accessed by Sacred Amrita, the payment intermediary and the postal service provider to deliver the parcel. For the delivery of goods, the customer’s full name, telephone number and parcel machine information are transmitted to the postal service provider. The payment intermediary processes personal data as part of its daily economic operations. As a controller, the payment service provider receives personal data directly from the data subject.
2.3. The privacy policy applies to the data subjects, and the rights and obligations set out in the privacy policy must be followed by all the employees and cooperation partners of Sacred Amrita who come into contact with the personal data held by Sacred Amrita.
2.4. To process the personal data of customers, Sacred Amrita may use third-party service providers who offer necessary software updates, marketing, payment and postal services to Sundari Invest OÜ.
3. PRINCIPLES
3.1. In the processing of personal data, Sacred Amrita always takes into account the interests, rights and freedoms of data subjects.
3.2. The objective of Sacred Amrita is to process personal data responsibly, based on the best practice, with the aim of always being prepared to demonstrate the compliance of personal data processing with the established goals.
3.3. All processes, guidelines, activities and actions of Sacred Amrita related to the processing of personal data are based on the following principles.
3.3.1. Legality. Submitted personal data are processed for the performance of the contract concluded with the customer. Submitted personal data are processed for the performance of legal obligations.
3.3.2. Fairness. Personal data are processed fairly, with the assumption that the data subject has access to information about how their personal data is processed.
3.3.3. Transparency. The processing of personal data is transparent for the data subject.
3.3.4. Purpose limitation. Personal data is collected for specified, explicit and legitimate purposes and it is are not processed in any manner which is incompatible with these purposes.
3.3.5. Accuracy. The personal data is accurate and, where necessary, kept up to date; all reasonable measures are taken to ensure that any personal data which is inaccurate with respect to the purpose of data processing is erased or rectified without delay.
3.3.6. Retention limitation. Personal data is retained in the format which enables to identify the data subject only until this is necessary for the achievement of the purpose for which the personal data is processed. This means that if Sacred Amrita wishes to retain personal data beyond the period necessary for the purpose of collection, Sacred Amrita must anonymise the data in a manner that renders the data subject unidentifiable. Sacred Amrita will retain data received through customer or similar relationships in accordance with best practices, and data processed on the basis of consent will be retained until the consent is withdrawn.
3.3.7. Reliability and integrity. Personal data is processed in a manner that ensures appropriate security thereof, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, by means of implementing appropriate technical or organisational measures.
4. CATEGORIES OF PERSONAL DATA
4.1. Among others, Sacred Amrita collects the following types of personal data:
4.1.1. personal data disclosed by the data subject to Sacred Amrita (name, email address, postal address, telephone number);
4.1.2. personal data generated in the course of regular communication between the data subject and Sacred Amrita;
4.1.3. personal data manifestly made public by the data subject (eg on social media);
4.1.4. personal data generated upon use of services (eg when making a purchase in the online store);
4.1.5. personal data generated as a result of visiting and using the website (eg time spent on the website);
4.1.6. personal data received from third parties;
4.1.7. personal data created and combined by Sacred Amrita (correspondence as part of the customer relationship or order history).
5. CATEGORIES OF PERSONAL DATA AND PURPOSES AND GROUNDS FOR PROCESSING
5.1. Sacred Amrita processes personal data exclusively on the basis of consent or the law.
5.2. On the basis of consent, Sacred Amrita processes personal data exactly within the limits, to the extent and for the purposes specified by the data subject. In the case of consent, Sacred Amrita acts based on the principle that each consent must be clearly distinguishable from other matters and be in a comprehensible and easily accessible form and use clear and simple language. Consent may be provided in writing, electronically or as an oral statement. A data subject provides their consent voluntarily, specifically, knowingly and unequivocally, for example, by ticking a box on the website.
5.3. Legitimate interest means the interest of Sacred Amrita in managing and controlling its own company to provide the best possible services on the market. On the basis of the law, Sacred Amrita processes personal data only after conducting a thorough assessment to establish that Sacred Amrita has a legitimate interest on the basis of which the processing of personal data is necessary and in line with the interests and rights of data subjects. In particular, personal data may be processed on the basis of legitimate interest for the following purposes:
5.3.1. to ensure a relationship of trust with its customers; for example, the processing of personal data which is strictly necessary for identifying actual beneficiaries or preventing fraud;
5.3.2. to manage and analyse its customer base to improve the availability, selection and quality of its products and services and to make better and more personalised offers to a customer upon their consent;
5.3.3. identifiers and personal data collected when the website and services are used. Sacred Amrita uses the collected data for web analysis or analysis of mobile and information society services, to ensure and improve their operation, to compile statistics, to analyse a customer’s behaviour and user experience, and to provide a better and more personalised service;
5.3.4. execution of campaigns, including the execution of personalised and targeted campaigns, execution of customer and visitor satisfaction surveys and measurement of the effectiveness of marketing activities performed;
5.3.5. to analyse customers’ and visitors’ behaviour in different sales channels;
5.3.6. to take measures for network, information and cyber security reasons, such as for combating piracy and ensuring the security of the website and for making and storing backups;
5.3.7. to establish, exercise or defend legal claims;
5.4. Sacred Amrita processes personal data to fulfil obligations imposed by law or to implement purposes permitted by law. For example, the law imposes obligations to processing payments or adhering to money laundering rules;
5.5. If the processing of personal data takes place for a purpose other than that for which the personal data were originally collected or is not based on the data subject’s consent, Sacred Amrita will carefully assess the admissibility of such new processing;
6. SAFETY OF THE PROCESSING OF PERSONAL DATA
6.1. Sacred Amrita retains personal data only for the minimum period strictly necessary. Personal data with an expired retention period will be destroyed using best practices and in accordance with the procedures established by Sacred Amrita.
6.2. In the event of any incident involving personal data, Sacred Amrita will take all necessary measures to mitigate the consequences and manage relevant risks in the future. Among other things, Sacred Amrita records all incidents and, where necessary, notifies both the Data Protection Inspectorate and the data subject directly.
7. RIGHTS OF THE DATA SUBJECT
7.1. Rights related to consent:
7.1.1. The data subject retains the right to inform Sacred Amrita at any time of their wish to withdraw their consent to the processing of personal data.
7.1.2. Withdrawing consent to receive the Sacred Amrita newsletter is possible by clicking on the link at the bottom of the newsletter.
7.2. in the processing of personal data, the data subject also has the following rights:
7.2.1. Right of information, ie the data subject’s right to receive information about the personal data that has been collected about them;
7.2.2. Right of access which includes, among others, the data subject’s right to receive a copy of the processed personal data;
7.2.3. Right to rectification of inaccurate personal data;
7.2.4. Right to erasure, ie in certain cases, the data subject has the right to request the erasure of personal data, for example, if the processing is only based on consent;
7.2.5. Right to request restriction of processing of personal data which arises, among other things, where the processing of personal data is not permitted on the basis of law or if a data subject objects to the accuracy of personal data. The data subject has the right to request the restriction of the processing of personal data so that the controller can verify the correctness of personal data or if the processing of personal data is unlawful, but the data subject does not request the erasure of personal data;
7.2.6. The right to have a supervisory authority assess whether the processing of the personal data of the data subject is lawful.
8. EXERCISE OF RIGHTS AND SUBMISSION OF COMPLAINTS
8.1. Exercise of rights:
8.1.1. The data subject has the right to contact Sacred Amrita by email at info@sacredamrita.ee if they have a question, request or complaint regarding the processing of personal data.
8.2. Filing of complaints:
8.2.1. The data subject has the right to file a complaint with Sacred Amrita, the Data Protection Inspectorate or a court if the data subject finds that their rights have been violated in the course of the processing of personal data.
9. COOKIES AND OTHER WEB TECHNOLOGIES
9.1. Sacred Amrita may collect and process data regarding the visitors of the website and other information society services by using cookies (ie small pieces of information stored by the visitor’s browser on their computer’s or device’s hard drive) or other similar technologies (eg IP address, device information, location information).
9.2. Sacred Amrita uses the collected data to provide a service according to the habits of the visitor or the customer; ensure the best quality of service; inform the visitor and the customer about the content and give recommendations; make ads more relevant and marketing more effective; facilitate login and data protection. The collected data is also used to count visitors and to record their habits when using the website.
9.3. Sacred Amrita uses session, persistent and advertising cookies. A session cookie is automatically deleted after each visit; persistent cookies remain after the repeated use of the website. Sacred Amrita’s partner websites use third-party cookies. Sacred Amrita does not control the generation of those cookies, therefore information on these cookies can be obtained from third parties.
9.4. Most web browsers allow cookies. Unless cookies are fully enabled, the functions of the website are not available to the visitor. The visitors can control the enabling or disabling of cookies and other similar technologies via the settings of the visitor’s own web browser, the settings of the information society service, and platforms for making such privacy more efficient.
10. OTHER TERMS
10.1. Sacred Amrita has the right to unilaterally change the Privacy Policy. Sacred Amrita notifies data subjects of any changes on the website www.sacredamrita.ee. We assume that by using the Sacred Amrita website www.sacredamrita.ee, you have read and agreed to the Privacy Policy.