The personal data controller for the online shop www.xlmotors.ee is KNK Group OÜ (company registration number 14073391), located at Sõpruse puiestee 209, Tallinn, Estonia, tel. +372 5380 1942, email info@xlmotors.ee. KNK Group OÜ is the personal data controller. For processing payments, KNK Group OÜ forwards the necessary personal data to the authorised processor Montonio Finance OÜ.

What personal data is processed

− name, telephone number and email address;
− delivery address;
− bank account number;
− cost of goods and services and payment-related data (purchase history);
− customer support data.

Purposes of processing personal data

Personal data is used to manage customer orders and to deliver goods.
Purchase history data (purchase date, goods, quantity, customer information) is used to prepare an overview of purchased goods and services and to analyse customer preferences. Bank account number is used to refund payments to customers.
Personal data such as email, telephone number and customer name are processed in order to resolve questions related to the provision of goods and services (customer support). The IP address or other network identifiers of online shop users are processed for the provision of the online shop as an information society service and for compiling web usage statistics.

Legal basis

Personal data is processed for the purpose of fulfilling the contract concluded with the customer.
Personal data is processed for the purpose of fulfilling a legal obligation (e.g. accounting and consumer dispute resolution).

Recipients to whom personal data is transferred

Personal data is forwarded to the online shop’s customer support for the management of purchases and purchase history and for resolving customer issues.
The name, telephone number and email address are forwarded to the transport service provider chosen by the customer. If the goods are delivered by courier, the customer’s address is also forwarded in addition to contact details.
If the online shop’s accounting is handled by a service provider, personal data is forwarded to the service provider for accounting operations. Personal data may be forwarded to IT service providers where necessary for ensuring the online shop’s functionality or data hosting.

Security and data access

Personal data is stored on veebimajutus.ee servers located in the territory of a European Union Member State or a country that is a member of the European Economic Area. Data may be transferred to countries whose data protection level has been assessed as adequate by the European Commission, and to U.S. companies that have joined the Privacy Shield framework. Access to personal data is available to employees of the online shop who may access personal data in order to resolve technical issues related to the use of the online shop and to provide customer support.
The online shop applies appropriate physical, organisational and IT security measures to protect personal data from accidental or unlawful destruction, loss, alteration or unauthorised access and disclosure.
The transfer of personal data to the online shop’s authorised processors (e.g. transport service providers and data hosting) takes place on the basis of contracts concluded between the online shop and the authorised processors. Authorised processors are required to ensure appropriate safeguards when processing personal data.

Access to and correction of personal data

Personal data can be accessed and corrected via the online shop’s user profile. If a purchase was made without a user account, personal data can be accessed via customer support.

Withdrawal of consent

If the processing of personal data is based on customer consent, the customer has the right to withdraw consent by notifying customer support by email.

Retention

When the online shop customer account is closed, personal data is deleted, unless such data needs to be retained for accounting purposes or for resolving consumer disputes.
If a purchase was made in the online shop without a customer account, the purchase history is retained for three years.
In the event of disputes related to payments and consumer disputes, personal data is retained until the claim is fulfilled or the limitation period expires.
Personal data required for accounting is retained for seven years.

Deletion

To delete personal data, please contact customer support by email. A deletion request is answered within one month at the latest, specifying the period for data deletion.

Transfer

A request to transfer personal data submitted by email is answered within one month at the latest. Customer support verifies the identity of the individual and notifies them about the personal data to be transferred.

Direct marketing communications

The email address and telephone number are used for sending direct marketing communications if the customer has given their consent. If the customer does not wish to receive direct marketing communications, they can select the corresponding link in the email footer or contact customer support.

Dispute resolution