Privacy Policy

1. Data controller

The data controller responsible for the personal data described in this Privacy Policy is the Seller identified in the Seller information box above. For any questions about this policy or your personal data, contact us at info@mytyre.eu.

2. What personal data we collect

We collect the following categories of personal data:

• Account data: your email address, and, if you provide them, your name and phone number.
• Order data: delivery address, items purchased, order history and communications about your order.
• Technical data: IP address and device or browser information, collected automatically for security and fraud-prevention purposes.
• Payment data: card or bank transfer details are collected and processed directly by our payment service providers; we do not store your full card number.

3. Purposes and legal bases

We process your personal data on the following legal bases under the GDPR:

• Performance of a contract (Article 6(1)(b)) — to create and manage your account, process and deliver your orders, and handle returns or warranty claims.
• Legal obligation (Article 6(1)(c)) — to issue and retain invoices and accounting records as required by the Estonian Accounting Act (Raamatupidamise seadus), which requires accounting source documents to be kept for 7 years.
• Legitimate interest (Article 6(1)(f)) — to prevent fraud, secure the Store against abuse, and maintain normal business records, weighed against your rights and freedoms.
• Consent (Article 6(1)(a)) — where applicable, for example for optional marketing communications. We do not currently send marketing communications; if we introduce them, we will ask for your prior consent and let you withdraw it at any time.

4. Recipients and processors

We share personal data only with recipients who need it to provide the Store's services, under appropriate data processing agreements:

• Payment service providers, to process card and bank transfer payments.
• Delivery and courier partners, to deliver your order.
• Our email delivery provider, to send magic-link sign-in emails and order-related communications.
• Our hosting provider, to operate the Store's infrastructure.
• Google, only if you choose to sign in with a Google account, acting as a processor for authentication purposes.

5. No sale of personal data

We do not sell your personal data to third parties.

6. International data transfers

Your personal data is generally processed within the European Economic Area (EEA). If you choose to sign in with Google, limited account data (such as your name and email address) may be processed by Google LLC in the United States. Such transfers are safeguarded by the European Commission's Standard Contractual Clauses and Google's own compliance certifications, and apply only if you use Google sign-in.

7. Retention periods

Account data is retained for as long as your account is active, and deleted or anonymised within a reasonable period after account closure, unless a longer retention period is required by law.

Invoices and related accounting records are retained for 7 years, as required by the Estonian Accounting Act.

Technical and security logs are retained only for as long as necessary to detect and investigate fraud or abuse, typically no longer than 12 months.

8. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Request erasure of your data, where applicable
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or with the supervisory authority in your country of residence

9. Children's data

The Store is not directed at children and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

10. Security measures

We use appropriate technical and organisational measures to protect your personal data, including encryption of data in transit (HTTPS), access controls limiting who can view personal data, and secure session management for account sign-in.

11. Changes to this policy and contact

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The current version is always available on this page, together with its last-updated date.

Questions about this Privacy Policy or your personal data can be sent to info@mytyre.eu.