PRIVACY POLICY

This Privacy Policy explains how KBS Stuudio OÜ processes personal data in connection with viart.ee, online purchases, customer service, business customer relationships, marketing and Website use.

This Policy applies to customers and Website users in the markets served by VIART, including Estonia, Latvia and Lithuania. Personal data are processed in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and other applicable data protection and electronic communications
rules.

1. Data controller

The controller responsible for personal data processing is KBS Stuudio OÜ, registry code 14875104, VAT number EE102427688, registered address Kase tn 3-3, Alatskivi alevik, Peipsiääre vald, Tartu maakond, 60201, Estonia.
Privacy contact: info@viart.ee. Telephone: +372 53 04 16 16.

2. Categories of personal data

Depending on how you interact with us, we may process identification and contact data such as name, email address, telephone number, billing address and delivery address.

We may process order and transaction data such as ordered products, order number, order date, price, delivery method, payment status, invoices, returns, refunds, complaints and claim history.

For Business Customers, we may process company name, registry code, VAT number, company address, professional or salon details, contact person information and agreed commercial terms.

We may process payment-related information such as transaction identifier, payment method, amount and payment status. Payments are processed through Montonio and the customer's selected bank or payment method. For payment initiation, refunds and card-payment services, Montonio Finance UAB acts as an independent controller for its own payment-service processing. KBS Stuudio OÜ does not normally receive or store full payment card details or online banking authentication credentials.

If customer accounts are available, we may process account details, saved addresses, order history and preferences.

We may process communications sent to customer service, including e-mails, contact form messages, return requests and complaints.
Where you subscribe to marketing, we may process your marketing preferences, consent record, subscription status and unsubscribe information.
When you use the Website, we may process technical and usage information such as IP address, browser and device information, operating system, session data, pages visited, Website interactions, cookie identifiers and similar online identifiers.

3. Sources of personal data

We obtain personal data mainly from you when you place an order, create an account, contact us, subscribe to marketing or use the Website.
We may also receive information necessary to fulfil an order from Montonio, banks or other payment providers, delivery companies and other service providers involved in fulfilling your order. For B2B relationships, we may use publicly available business registers and company information sources where relevant.

4. Purposes and legal bases for processing

Order processing and contract performance: to accept and process orders, receive payment confirmation, deliver goods, issue invoices, communicate about the order, process returns and refunds, and administer customer accounts. Legal basis: performance of a contract or steps taken at your request before entering into a contract.
Legal and accounting obligations: to comply with accounting, tax, consumer protection and other legal requirements. Legal basis: compliance with a legal obligation.
Customer service, claims, fraud prevention and security: to answer enquiries, manage complaints and disputes, prevent misuse, protect the Website and establish, exercise or defend legal claims. Legal basis:
contract performance and/or our legitimate interests, depending on the circumstances. B2B relationship management: to manage professional customer relationships, quotations, account terms and business communications. Legal basis: contract performance and/or legitimate interests in managing
our commercial relationships.
Direct marketing: to send newsletters and promotional communications where you have consented or where another legal basis is expressly permitted by applicable electronic marketing law. Legal basis:
consent or another lawful basis permitted by applicable law. You can opt out at any time.
Analytics and non-essential cookies: where consent is legally required, analytics, advertising and other non-essential tracking technologies are used only after consent. Legal basis: consent.

5. Recipients and service providers

We disclose personal data only when necessary for the purposes described in this Policy or where required by law. Recipients may include Montonio, banks and other payment service providers, courier and parcel delivery companies, hosting and IT providers, Website maintenance providers, accounting and ERP providers, invoicing systems, customer relationship management providers, e-mail and newsletter providers, analytics and cookie technology providers, professional advisers and public authorities. Service providers processing data on our behalf are required to process personal data under appropriate data protection terms. We do not sell personal data.

6. International data transfers

We aim to use service providers that process personal data in the European Economic Area (EEA). If personal data are transferred outside the EEA, we use an appropriate GDPR transfer mechanism where required, such as an adequacy decision, Standard Contractual Clauses or another lawful safeguard.
Delivery of an order or sharing data with a service provider in Estonia, Latvia or Lithuania is not a transfer outside the EEA.

7. Retention periods

We keep personal data only for as long as necessary for the purpose for which it was collected or for the period required by law.
Accounting documents and transaction records that are subject to Estonian accounting retention rules are generally retained for seven years from the end of the relevant financial year. Order, contract, return and complaint information may be kept for the duration necessary to perform the contract and to cover applicable statutory claim and limitation periods, and longer where needed for an ongoing legal dispute.

Customer account data are generally kept while the account remains active, except for information that must be retained for legal, accounting, fraud-prevention or dispute purposes.
Marketing data based on consent are kept until consent is withdrawn or the subscription is terminated. We may keep limited suppression information to ensure that an opt-out request is respected. Technical logs and cookie data are retained according to their purpose, security needs and the retention
settings of the relevant technology. More specific cookie durations should be shown in the Website cookie settings where applicable.

8. Cookies and similar technologies

The Website may use cookies and similar technologies. Strictly necessary cookies may be used where they are required for functions such as the shopping cart, checkout, security, session management and remembering privacy choices.
Analytics, advertising and other non-essential cookies that require consent are activated only after the user has made the relevant choice. Consent must be capable of being refused and withdrawn as easily as it is given.
The Website cookie banner or cookie settings should provide information about the categories of cookies used, their purposes, duration and relevant third parties where required.

9. Marketing communications

Completing a purchase or accepting these Terms does not automatically constitute consent to unrelated marketing.
Where marketing consent is required, it is requested separately. Every electronic marketing communication will contain a simple way to unsubscribe or otherwise object to further direct marketing. You may also unsubscribe at any time by contacting info@viart.ee. Withdrawal of consent does not affect
processing that was lawful before the withdrawal.

10. Data security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure, destruction and misuse. Access is limited to persons and service providers who need the information for legitimate purposes.
No internet-based system can provide an absolute guarantee of security, but we review our safeguards in light of the nature of the data and the risks involved.

11. Your GDPR rights

Subject to the conditions and limitations in the GDPR, you have the right to obtain information about processing and access your personal data; request correction of inaccurate or incomplete data; request erasure where the legal conditions are met; request restriction of processing; receive certain data in a structured, commonly used and machine-readable format and request data portability; object to processing based on legitimate interests; and object to direct marketing at any time.
Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Some rights are not absolute. For example, we may need to retain data where a legal obligation requires retention or where the data are necessary for the establishment, exercise or defence of legal claims.

12. Exercising your rights

Requests concerning personal data may be sent to info@viart.ee. We may ask for information reasonably necessary to verify identity before fulfilling a request.
We respond within the time limits required by the GDPR and applicable law.

13. Complaints to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe your personal data have been processed unlawfully.
Because KBS Stuudio OÜ is established in Estonia, the Estonian supervisory authority is Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate). Depending on the circumstances, persons in Latvia may also contact Datu valsts inspekcija, and persons in Lithuania may contact Valstybinė duomenų apsaugos inspekcija.
We encourage you to contact us first at info@viart.ee so that we have the opportunity to address the issue directly.

14. Automated decision-making

Unless specifically stated in connection with a particular service, we do not use personal data for decisions based solely on automated processing that produce legal effects or similarly significant effects on
customers.

15. Third-party websites

The Website may contain links to independent third-party websites or services. Their privacy practices are governed by their own notices, and KBS Stuudio OÜ is not responsible for the privacy practices of
independent third parties.

16. Changes and contact

We may update this Privacy Policy to reflect changes in our services, technology, service providers or legal requirements. The current version is published on viart.ee together with the date of the latest update.
For privacy questions, contact KBS Stuudio OÜ at info@viart.ee or +372 53 04 16 16.