Privacy policy

Updated: 2026-11-14

1. Controller

The controller is Netpc OÜ, registration number 12454539, address Viljandi, Tartu tn 37. Data protection requests: pood@netpc.ee.

2. Data and purposes

We process your name, email, phone, delivery address where needed, optional business details, ordered products, quantities, prices, payment status, delivery choice and order notes to prepare and perform the contract and communicate about it (GDPR Article 6(1)(b)). Required order details are necessary to fulfil the purchase; without them an order cannot be accepted. Do not include sensitive or unnecessary information in order notes. Orders are made as a guest; no customer account is created automatically.
Payment references, payment details and bank account details where needed are processed to verify or refund payments. Accounting and other legal obligations rely on Article 6(1)(c). Necessary technical logs and correspondence may be processed for security, abuse prevention and legal claims based on legitimate interests (Article 6(1)(f)), limited to what is necessary. Where processing relies on consent, consent may be withdrawn at any time without affecting earlier lawful processing.

3. Recipients and transfers

To the extent needed for their tasks, order data are available to authorised seller staff, delivery providers, accounting providers, and web hosting and email providers. Banks involved in a transfer also process payment data. Personal data are not sold to third parties.
Recipients receive only data needed for their tasks; appropriate contractual obligations apply. Competent authorities may receive data on a lawful basis.
Applicable data protection safeguards are used when processing personal data. Any transfer outside the European Economic Area must have a lawful basis, such as a European Commission adequacy decision or appropriate contractual safeguards. Information about the safeguards in use can be requested from the seller by email.

4. Retention

Order data are retained for performance of the contract and as needed to establish or defend claims, generally for up to three years after fulfilment. Correspondence and technical logs are retained only as long as needed for their purposes. A longer legal retention obligation or an ongoing dispute may require keeping only the necessary data for longer.
Accounting source documents are retained for the legally required period, generally seven years from the end of the financial year in which the transaction was recorded. This does not mean all shop data must be retained for that period. Data needed for disputes may be retained until settlement or expiry of the relevant claim. Data are deleted or anonymised when no lawful retention purpose remains.

5. Cookies and security

Necessary session cookies support the basket, secure session and ordering. Deleting browser cookies may clear the basket. Where optional analytics or marketing cookies are used on the website, separate consent is requested where required, and choices can be changed through the website cookie settings.
Sessions support the basket and orders. Keep private order links confidential: they provide access to order details. Access is limited by duties and organisational and technical measures are chosen to match the risks.

6. Rights

You may request access, correction, and where provided by law, deletion, restriction and portability. You may object to processing based on legitimate interests. Deletion does not override legal retention obligations. We may request information needed to verify your identity.
We normally respond within one month. Complex or numerous requests may require an extension of up to two further months as permitted by law; we explain the extension within the first month. Contact pood@netpc.ee. You may also complain to the Estonian Data Protection Inspectorate at https://www.aki.ee/ or seek judicial remedies. This notice is updated to reflect changes in actual processing.