Privacy Policy
Effective from: 01.09.2026 Amended: 09.10.2026
This Privacy Policy describes how FiilGuud Brands OÜ processes the personal data of visitors and customers of the online shop fiilguud.com (the "Shop"). The Privacy Policy is reviewed periodically and may be updated. Any changes will be announced on the Shop website.
1. Controller
The controller of personal data is FiilGuud Brands OÜ (registry code 10810444, VAT number EE100724257), address Jõeääre tee 22, Loo alevik, Jõelähtme vald, 74201 Harju County, Estonia, e-mail inri@fiilguud.com, phone +372 503 6996 (the "Seller").
2. What data we collect
2.1. When you place an order: name, e-mail address, phone number; delivery address or selected parcel locker; billing details; order contents (products, quantities, prices); delivery country and Shop language; payment confirmation from Montonio. The Seller does not see or store payment card details.
2.2. Via the interest form ("Leave a request" and "Can't find your favourite?"): e-mail address, name (optional), requested product, requested quantity, message (optional) and Shop language.
We use data received through the interest form to send you an automatic confirmation that your request has been received and to contact you regarding ordering and availability of the requested product.
2.3. When you submit a HoReCa / B2B enquiry: contact person's name, company name, e-mail address, phone number and the content of the enquiry.
2.4. When you subscribe to the newsletter: e-mail address, language, and the time consent was given and confirmed (double opt-in).
2.5. When you leave a product review: name or abbreviated name, rating and review text.
2.6. When you contact the Seller: the content of e-mails and other correspondence.
2.7. Technical data: when you visit the Shop, the Shop's web hosting (server) provider processes technical data (e.g. IP address, browser type) necessary for the operation and security of the Shop. Your IP address may be used to determine your country for the initial selection of the Shop language and delivery country. The IP address is not stored for this purpose.
3. Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Fulfilling the order, arranging delivery and order-related communication | Performance of a contract (GDPR Art. 6(1)(b)) |
| Age verification for alcohol sales | Compliance with a legal obligation (GDPR Art. 6(1)(c)) |
| Issuing invoices and retaining accounting records | Compliance with a legal obligation (GDPR Art. 6(1)(c), Estonian Accounting Act) |
| Interest list: notifying you of product availability and agreeing a pre-order | Steps taken at the data subject's request prior to entering into a contract (GDPR Art. 6(1)(b)) |
| Responding to HoReCa / B2B enquiries | Pre-contractual steps (GDPR Art. 6(1)(b)) and legitimate interest (GDPR Art. 6(1)(f)) |
| Sending the newsletter | Consent (GDPR Art. 6(1)(a)) |
| Post-purchase request to leave a product review | Legitimate interest (GDPR Art. 6(1)(f)); every e-mail includes an option to opt out |
| Customer support, handling complaints and defending legal claims | Legitimate interest (GDPR Art. 6(1)(f)) |
| Technical operation and security of the Shop | Legitimate interest (GDPR Art. 6(1)(f)) |
| Usage analytics | Consent (GDPR Art. 6(1)(a)), see section 7 |
4. Obligation to provide data and automated decision-making
The data required when placing an order is necessary for concluding and performing the contract. Without it, the Seller cannot fulfil the order. Providing other data (newsletter, interest form, product review) is voluntary.
The Seller does not make automated decisions or carry out profiling based on personal data.
5. Data retention
- Accounting records (incl. invoices): 7 years under the Estonian Accounting Act.
- Other order-related data and correspondence: up to 3 years after the order is fulfilled, to resolve possible claims.
- Interest list: 24 months from the request or until the data subject asks for the data to be deleted.
- HoReCa / B2B enquiries: 24 months if no contractual relationship arises from the enquiry.
- Newsletter: until consent is withdrawn.
- Product reviews: until a request to delete the review.
- Technical logs: for a short period, in accordance with the web hosting provider's terms.
After the retention period ends, the data is deleted or anonymised.
6. Recipients and processors
We share personal data only to the extent necessary for the specific purpose:
- Lovable Labs Inc. (USA) and Cloudflare, Inc. (USA): web hosting and server-side operation of the Shop.
- Supabase, Inc. (USA): database storing data on orders, interest requests, enquiries and product reviews. The database is located in the European Union (Ireland).
- Montonio Finance OÜ (Estonia): payment processing and shipping integration (registering shipments, parcel locker selection and shipment tracking).
- Venipak, Unisend, SmartPosti, DPD, Omniva: for integrated delivery (orders to Estonia and orders of alcohol-free products to Latvia, Lithuania, Finland and Sweden). Data is shared only with the carrier selected by the Buyer at Checkout.
- Transport company chosen by the Buyer: for "distance purchase" orders (orders containing alcoholic products with a delivery address in Latvia, Lithuania, Finland or Sweden), the Buyer chooses the transport company and provides their data to it directly. The Seller does not pass the Buyer's data to the carrier in advance.
- Sendinblue SAS (Brevo) (France): sending order confirmations and notification e-mails, interest form confirmation e-mails, product review requests and the newsletter.
- Zone Media OÜ (Estonia): the Seller's e-mail service.
- Merit Tarkvara AS (Estonia): accounting and invoicing.
- Google Ireland Limited: usage analytics (Google Analytics 4) only if it is enabled and the Buyer has consented to analytics cookies (see section 7).
- Public authorities (e.g. the Estonian Tax and Customs Board, supervisory authorities): only where required by law.
Transfers outside the European Economic Area (EEA). Some service providers (Lovable, Cloudflare, Supabase, Google) are US companies or use sub-processors outside the EEA. In such cases, data is transferred only on the basis of safeguards compliant with the General Data Protection Regulation (GDPR), in particular the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Further information on the safeguards is available at inri@fiilguud.com.
7. Cookies and similar technologies
The Shop uses the following categories:
- Necessary cookies and browser storage: essential for the Shop's core functions (e.g. cart, Checkout, age confirmation, language and delivery country selection, remembering your cookie choice). No consent is requested for these, as the Shop cannot function without them (Estonian Electronic Communications Act).
- Analytics cookies: Google Analytics 4. Used only if the Buyer has given separate consent in the cookie banner. Analytics collects information about the use of the Shop (e.g. products viewed, items added to cart), and IP addresses are anonymised.
- Marketing cookies: used only with the Buyer's separate consent. The Shop currently has no active marketing tracking scripts.
Cookie consent is requested on your first visit through a banner where you can choose "Accept all", "Save selection" (by category) or "Reject all". Consent is not relied on until it has been given. You can withdraw your consent at any time by deleting the Shop's cookies in your browser settings, after which consent will be requested again.
8. Your rights
You have the right to:
- obtain information about the processing of your personal data and access your data;
- request the correction of inaccurate data;
- request the erasure of data where there is no basis for further processing;
- request the restriction of processing;
- receive the data you have provided in a structured, machine-readable format and transmit it to another controller (right to data portability);
- object to processing based on legitimate interest, including at any time to direct marketing;
- withdraw your consent at any time (e.g. unsubscribe from the newsletter). Withdrawal does not affect the lawfulness of prior processing;
- lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee) or the data protection supervisory authority of your country of residence.
To exercise your rights, please contact us at inri@fiilguud.com. We will respond within one month at the latest.
9. Data security
The Seller applies appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration and unauthorised access. Only persons who need the data to perform their duties have access to it.
10. Minors
The Shop does not sell alcoholic products to persons under 18 years of age and does not knowingly collect personal data of minors.
11. Language
This Privacy Policy has been drawn up in Estonian and translated into the other languages of the Shop. In the event of any discrepancy between the translations, the Estonian text shall prevail.
12. Contact
FiilGuud Brands OÜ Jõeääre tee 22, Loo alevik, Jõelähtme vald, 74201 Harju County, Estonia E-mail: inri@fiilguud.com Phone: +372 503 6996