Privacy policy

1. Who we are

The controller of personal data collected through the SM Market online shop is Black Bean Advertising Agency OÜ, registry code 17136809, Pirni 7/2, Tallinn, Eesti (“we”). For any data protection question write to info@smmarket.eu.

2. What data we process and why

• Orders: name, email, phone, delivery address or parcel locker, company name and registry code (if given), order contents, amounts and payment status. Purpose: to conclude and perform the sales contract, deliver goods, handle returns and warranty claims. Legal basis: performance of a contract (GDPR art. 6(1)(b)).
• Accounting: invoices and payment records. Legal basis: legal obligation (GDPR art. 6(1)(c)) under the Estonian Accounting Act.
• Enquiries: name, email and the content of messages sent via the contact form or email. Legal basis: our legitimate interest in answering you (GDPR art. 6(1)(f)) or steps before entering into a contract.
• Technical data: server logs (IP address, time, requested page) kept for security and error tracking. Legal basis: legitimate interest.

We do not use your data for automated decision-making or profiling. We send marketing emails only if you have separately agreed to it.

3. Payments and instalments

Payments, payment in three parts and hire purchase are provided by ESTO AS. When you choose an ESTO payment method, you are redirected to ESTO, which processes your data as an independent controller under its own privacy policy (including credit checks for instalment products). We receive from ESTO only the status of the payment, never your bank login or card details.

4. Who receives your data

• courier and parcel locker companies, to deliver your order;
• suppliers and manufacturers, only to the extent needed to fulfil the order or a warranty claim (usually without your contact details);
• our hosting and email service providers, who process data on our behalf under a data processing agreement;
• our accountant and, where required by law, public authorities.

Data is stored in the European Union. If a service provider processes data outside the EU/EEA, we make sure appropriate safeguards (such as the EU standard contractual clauses) are in place.

5. How long we keep data

Order and accounting documents are kept for 7 years from the end of the financial year, as required by the Accounting Act. Data needed for warranty and claims is kept for the duration of the claim period (at least 2 years from delivery). Enquiries are deleted within 2 years if no contract follows. Server logs are kept for up to 90 days.

6. Cookies and browser storage

Necessary data (your bag and your cookie choice) is stored in your browser (localStorage) and always works. Other cookies are used only with your consent, which you give or refuse in the cookie notice and can change any time via “Cookie settings” in the footer. We use Google Consent Mode v2: no analytics or advertising scripts are loaded before consent.

• Analytics – Google Analytics 4 and Google Tag Manager (Google Ireland Ltd): pages visited, device, approximate location and purchase events, to understand how the shop is used. Google does not store IP addresses. Retention 14 months. Cookies _ga, _ga_*.

Data may be transferred to the USA; Google participates in the EU–US Data Privacy Framework. Fonts are served from our own server.

7. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive your data in a portable format. Write to info@smmarket.eu and we will reply within one month. If you think we have violated your rights, you may contact the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

8. Changes

We may update this policy when our services or the law change. The current version is always published on this page.