Privacy Policy

This notice explains how OG klubi Ltd, trading online as Supplenivo, uses personal data when you visit the site, create an account, place an order, contact us or exercise your legal rights.

Effective: 12 August 2026 · Last reviewed: 11 November 2026 · Version: 2026-11-11.1

1. Who is the controller?

The controller for Supplenivo customer and website data is OG klubi OÜ (trading as OG klubi Ltd; Estonian private limited company / osaühing; registry code 14843593; VAT number EE102216022), Tiigi tn 9, Sauga alevik, 85008, Pärnu maakond, Estonia. Email orders@supplenivo.eu or telephone +372 5562 2534. The company record can be checked in the Estonian e-Business Register.

2. Data we receive and where it comes from

• Identity and contact data: name, billing and delivery address, email address, telephone number and account display name.
• Order and contract data: products, quantities, prices, VAT, delivery charge, order status, delivery instructions, online withdrawal submissions (name, order-identifying details, acknowledgement email, optional statement details and receipt date/time to handle withdrawal and legal rights), return, refund, complaint and product-safety records.
• Payment data: payment status, amount, currency, Stripe transaction reference and limited card details such as brand and last digits where Stripe returns them. Full card credentials are entered into Stripe’s payment service and are not stored in the Supplenivo WordPress database.
• Account and communications data: password hash, saved details, messages, evidence attached to a complaint, and public review name and content if you choose to submit a product review.
• Order follow-up email data: whether you declined order follow-up emails at checkout or on the order confirmation page, which wording you were shown and when, and for each review request or reorder reminder we send: the product, the language, the date and any unsubscribe.
• Technical and security data: IP address, browser/device data, timestamps, requested pages, error and security logs, session/cart identifiers and consent choice.
• Optional analytics data: page, product and checkout interactions and pseudonymous device/browser identifiers, but only after analytics consent.

Most data comes directly from you or from your use of the site. Stripe returns payment results. Our European logistics partners return fulfilment status and a carrier tracking reference; UPS processes the parcel’s delivery events in its own carrier systems and may make them visible through its tracking service. Please do not send health information or identity documents unless we specifically need them to resolve a legal or product-safety issue.

3. Why we use data and our legal bases

• Contract and steps requested before a contract (GDPR Article 6(1)(b)): operate the cart and account, take payment, accept and fulfil an order, arrange delivery, send transactional messages, answer order questions and handle withdrawal, returns and refunds.
• Legal obligations (Article 6(1)(c)): invoices, tax and accounting records, consumer-rights compliance, payment records, product traceability, safety notices, recalls and responses to lawful authorities.
• Legitimate interests (Article 6(1)(f)): keep the site and accounts secure, prevent fraud and misuse, diagnose errors, establish or defend legal claims, preserve evidence of what was agreed, and improve operations using data that does not require optional tracking. We balance these interests against your rights and you may object.
• Order follow-up emails (Article 6(1)(f) together with the national rules implementing Article 13(2) of the ePrivacy Directive 2002/58/EC): after an order we may email you once to ask for a review of a product you bought and once when it may be time to reorder it. You can decline at checkout or on the order confirmation page, and every such email has a free unsubscribe link.
• Consent (Article 6(1)(a)): optional Google Analytics and/or Microsoft Clarity (session heatmaps/recordings) when those tools are configured, and publication of a voluntary product review. You may withdraw consent without affecting earlier lawful processing.

We do not sell personal data. We do not run a newsletter or a general marketing-email list.

4. Who receives data?

We disclose only what is reasonably needed for the relevant service:

• Stripe: the applicable Stripe group entities process payment, refunds, authentication and fraud prevention. Stripe can act as our processor and as an independent controller for functions it determines under payment law. See Stripe’s privacy policy.
• European logistics / warehouse partners: receive the recipient’s name, delivery address, email, telephone number, ordered items and the identifiers needed to pick, pack and dispatch the parcel from European warehouses. They process that data as independent controllers or processors for fulfilment only.
• UPS: receives shipment contact and address data, parcel/tracking data and delivery events as the carrier and an independent controller. See the UPS privacy notice.
• Hetzner Online GmbH: hosts the production systems in Germany as an infrastructure processor. See Hetzner’s privacy information.
• Zone Media OÜ: provides the business email/domain infrastructure and acts as a processor for customer correspondence held there. See Zone’s privacy policy.
• Google Ireland Limited: receives analytics events only if a valid Google Analytics property is configured and you choose “Allow analytics”. Google Signals and advertising personalisation are disabled in our site configuration. See Google’s privacy policy and Analytics data safeguards.
• Microsoft Corporation / Microsoft Ireland Operations Limited: receives optional session analytics only if Microsoft Clarity is configured and you choose “Allow analytics”. Clarity may process page interaction data, device/browser data and a limited session recording for product and UX improvement. See Microsoft’s privacy statement and Clarity FAQ.
• Professional advisers and authorities: accountants, legal advisers, banks, payment networks, insurers, regulators, courts, tax or law-enforcement authorities where needed for their work or required by law.

5. International transfers

Our main hosting and email systems are in the European Economic Area. Some logistics, payment and analytics providers operate internationally and may use group companies or service providers outside the EEA (including, where relevant, the United Kingdom under the European Commission’s adequacy decision while it remains in force). Depending on the destination they use an adequacy decision, European Commission standard contractual clauses or another lawful GDPR transfer safeguard. Their notices above give current details. You may ask us for information about the safeguard relevant to your data.

6. How long do we keep data?

• Orders, invoices and accounting evidence: seven years from the end of the financial year in which the transaction was recorded, as required by the Estonian Accounting Act; longer only where a live claim, investigation or other law requires it.
• Account profile: while the account remains open. If you ask us to close it, we delete profile data that is not needed for the accounting, safety, fraud or claims purposes above.
• Cart/session and technical records: temporary cart/session records expire under the shop’s session settings. Security, delivery and error logs are kept only while reasonably needed to investigate an event, protect the service or support a claim, then deleted or anonymised. Web server access logs (IP address, time, requested page, browser user agent and referring page) are kept for up to 12 months to protect the service and to produce aggregate visit statistics, then deleted.
• Support, return and complaint records: until the matter is resolved and then for the period reasonably needed for follow-up and applicable legal claims.
• Order follow-up emails: your choice is stored with the order. The record of a review request or reorder reminder is deleted 13 months after it was sent. If you unsubscribe, we keep a coded (hashed) form of your email address on a suppression list so that we do not email you again; it is used for nothing else.
• Consent choice: the first-party supplenivo_consent record remains in your browser’s local storage until you clear it or a new consent version asks you again.
• Analytics: Google Analytics and Microsoft Clarity are optional and disabled unless a valid property/project is configured. When enabled with consent, GA4 user- and event-level data is retained under the property’s configured period (for a standard GA4 property no more than 14 months); Clarity session data is retained under Microsoft’s product retention settings (typically up to about 13 months for recordings). Aggregate reports may remain available after raw-event expiry while they remain useful for the stated improvement purpose.

7. Cookies and browser storage

Necessary WooCommerce cookies and server-side session identifiers keep your cart, checkout, login, security and market/VAT context working. The first-party supplenivo_country cookie stores the sale country inferred from your IP on a first visit, or a country you select in the header picker, for up to three days. These are used because the service you request cannot work reliably without them, not for advertising.

Optional analytics (Google Analytics and/or Microsoft Clarity, when configured) do not load before affirmative consent. If you allow analytics, Google may set _ga and related cookies and Microsoft Clarity may set first-party analytics cookies such as _clck / _clsk. Choosing “Necessary only” or later withdrawing analytics consent stops new analytics events and the site’s consent controller attempts to remove its common analytics cookies. You can reopen the choice through “Cookie settings” in the footer and can also clear site data in your browser. Bing Webmaster verification meta tags (if present) are not analytics cookies.

8. Your rights

Subject to the conditions in the GDPR, you may ask for access, correction, deletion, restriction, portability, or object to legitimate-interest processing. You may withdraw consent at any time. These rights are not absolute; for example, we must preserve legally required invoices even after account closure. Send a request to orders@supplenivo.eu. We may ask for proportionate information to verify that the request concerns you and normally respond within one month. You can stop review requests and reorder reminders at any time, free of charge, with the unsubscribe link in each email or by replying to it.

You may complain to the Estonian Data Protection Inspectorate, the authority in the EU country where you live or work, or where the alleged infringement occurred. The European Data Protection Board lists every national supervisory authority. We would appreciate the opportunity to address the issue first, but contacting us is not a condition of your right to complain.

9. Required data and automated checks

We need the checkout fields marked as required, a valid payment result and a deliverable address to enter into and perform an order. Without them we cannot accept or deliver it. Supplenivo does not make a decision with legal or similarly significant effects solely by its own automated profiling. Stripe and financial partners may run automated authentication or fraud checks under their own legal responsibilities; contact us if a payment outcome prevents an order and you want us to examine what we can.

10. Changes and contact

We will publish a newly dated version before a material new use of personal data starts. Changes do not retrospectively make an incompatible use lawful. Privacy questions and rights requests go to orders@supplenivo.eu or OG klubi Ltd at the registered address above. Customer support is available in English and Estonian.