This Privacy notice explains how European Foods OÜ (“ICONFIT”, “we”, “controller”) processes personal data when you use the ICONFIT online shop (iconfit.eu and our country domains) or contact us.

Controller: European Foods OÜ, registry code 12548039, Paemurru tee 3, Laabi 76922, Estonia.
Privacy contact: info@iconfit.eu (please put “Privacy” in the subject).
We have not appointed a Data Protection Officer because we are not required to under GDPR.

Sales, delivery, returns and guarantees are in the separate Terms of Sale. At checkout you confirm with one tick that you have read and agree to both documents. That tick is not consent to marketing or to optional cookies. Those need their own yes/no choices.

To exercise GDPR rights you can email us or use our data-request page.

1. What we collect

• Identity and contact: name, email, phone, billing and delivery address, company name if you give one.
• Order data: products, amounts, currency, payment status, invoices, returns, customer-service messages.
• Account data: login, order history, saved addresses, language and market preference, if you create an account.
• Technical data: IP address, device/browser, pages viewed, cookie identifiers, approximate location (country).
• Marketing preferences: newsletter opt-in/out, campaign engagement (opens/clicks) if you subscribe.
• Reviews and chat: text you send via reviews or live chat, and related metadata.

We do not ask for health data. Do not send medical information in free-text fields. Payment card numbers are handled by payment providers; we do not store full card details.

2. Why we process data (purpose, legal basis, how long)

Legal bases are GDPR Article 6(1): (a) consent, (b) contract, (c) legal obligation, (f) legitimate interests.

• Orders, delivery, returns, invoicing. Identity, contact, order and payment status. Basis: (b) contract. Kept for the life of the order, then for the accounting period below.
• Customer service (email, chat). Contact, order, message content. Basis: (b) contract and/or (f) handling enquiries. Kept up to 3 years after the last message, longer if a dispute is open.
• Accounts, tax, VAT (including EU OSS). Invoices, totals, delivery country. Basis: (c) legal obligation. Kept as Estonian accounting/tax law requires (typically 7 years from the end of the financial year).
• Fraud prevention and shop security. Technical data and order patterns. Basis: (f) security of the shop and customers. Kept up to 2 years, longer if an investigation is open.
• Running the shop (necessary cookies, hosting, logs). Technical data. Basis: (f) operating a secure webshop; necessary cookies also fall under ePrivacy “strictly necessary”. Session or short logs, usually under 13 months.
• Analytics / session replay (e.g. Hotjar). Device, usage, truncated IP. Basis: (a) consent via the cookie banner. Until you withdraw consent, and otherwise according to the tool (usually ≤ 13 months).
• Advertising / remarketing (e.g. Meta, Google). Cookie IDs and events such as view, cart, purchase. Basis: (a) consent via the cookie banner. Until you withdraw consent; ad platforms keep data per their own settings.
• Email/SMS news and offers. Email, name, language, country, engagement. Basis: (a) consent (ePrivacy / GDPR). Unsubscribe in every message. We then keep a suppression record so we do not email you again.
• Product reviews. Name or initials you publish, review text, order verification. Basis: (f) showing genuine reviews. Kept while the review is published, or until you ask us to remove it where we can.

We do not sell your personal data. We do not use solely automated decisions that produce legal or similarly significant effects (GDPR Article 22).

3. Who we share data with

We share only what is needed:

• Shop platform: Shopify (store, checkout, accounts).
• Payments: card and local-method providers used at checkout (for example Montonio / MakeCommerce and card acquirers, depending on country).
• Delivery: carriers and locker networks (for example DPD, Itella/SmartPOST, Omniva and others offered at checkout) and our warehouse/WMS and freight tools.
• Operations: our ERP/accounting and internal operations tools.
• Email marketing: Klaviyo or equivalent, only if you subscribe.
• Customer chat: Gorgias or equivalent.
• Reviews: Judge.me or equivalent.
• Analytics / ads (only with cookie consent): Hotjar, Google, Meta and similar.
• Authorities when the law requires it.

These parties act as processors on our instructions, or as independent controllers for their own legal duties (for example a bank). We do not authorise them to use your data for their own marketing.

4. Transfers outside the EEA

Some providers (notably Shopify, Google, Meta, Hotjar, Klaviyo, Judge.me) may process data in the United States or other countries outside the EEA. Where that happens we rely on an adequacy decision where one exists (including the EU–US Data Privacy Framework for certified organisations) and/or the European Commission’s Standard Contractual Clauses, plus extra safeguards the provider offers. Ask us if you want a copy of the relevant clauses.

5. Cookies

We use a cookie banner. Necessary cookies (cart, login, security, load balancing, your cookie choice) run always. Analytics and marketing cookies run only if you accept them. You can reject optional cookies, change your choice later via the banner/privacy widget, and also control cookies in your browser.

Hotjar (if you allow analytics) collects device type, browser, country, language, truncated IP and on-site behaviour so we can see how the shop is used.

6. Your rights

You have the rights in GDPR Articles 15–22, including: access; rectification; erasure (“right to be forgotten”); restriction; objection (including to direct marketing, which we will always honour); data portability; and withdrawal of consent at any time (this does not affect processing already done). We answer without undue delay and within one month (extendable by two months for complex requests).

How: email info@iconfit.eu or use iconfit.eu/pages/gdpr-compliance. We may need to verify it is you.

You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the supervisory authority in your EU/EEA country of residence.

7. Children

The shop is aimed at adults. We do not knowingly collect data from children for marketing. Food-supplement age limits on labels still apply.

8. Changes

We may update this notice and will change the date above. Material changes will be shown on this page. If we need a new consent, we will ask for it.