This policy explains what personal data Supplenivo collects, why, and what rights you have under the EU General Data Protection Regulation (GDPR). The data controller is OG klubi OÜ, Estonia.
What data do we collect?
When you order, we collect the data needed to fulfil the purchase: name, delivery address, email, phone number and order contents. If you create an account, we store your order history and saved details. Support emails are kept with their correspondence. Payment card data is processed by the payment provider, never stored by us.
Why do we process it?
We process personal data to fulfil and deliver orders (contract), to meet accounting and consumer-law obligations (legal obligation), to answer support requests (legitimate interest), and to send marketing email only if you have explicitly opted in (consent). Analytics and marketing cookies are used only with your consent, managed through the cookie banner.
Who do we share data with?
Only with parties needed to deliver your order and run the store: the fulfilment and delivery partners who ship the parcel, the payment service provider who processes your payment, and IT service providers who host our systems under data processing agreements. The full, named list of processors will be published in this policy before the store opens. We never sell personal data.
How long do we keep it?
Order and invoice data is kept seven years, as Estonian accounting law requires. Account data is kept until you delete your account. Support correspondence is kept up to three years. Consent-based data is deleted when you withdraw consent.
What are your rights?
You can request access to your data, correction, deletion, transfer to another provider, restriction of processing, and you can object to processing based on legitimate interest. Write to dropshipping@oggym.ee — we respond within 30 days. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.
This policy will be finalised, with the named processor list and cookie details, before the store goes live.