Legal info
Privacy Policy
Effective: 14.07.2026 · Last updated: 14.07.2026
Krissu Kokkab OÜ (reg. code 16377178) respects your privacy and processes personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and Estonian personal data protection law.
1. Data controller
Krissu Kokkab OÜ
Reg. code: 16377178
Address: Sihva küla, Otepää vald, Valgamaa
E-mail: kristina.jaanikesing@gmail.com
Phone: +372 5622 4141
2. What data we collect
2.1 Order data
When placing an order we collect:
- First and last name
- Email address
- Phone number
- Delivery address or pickup preference
- Payment info (processed by our payment provider; card/account details do not reach our servers)
2.2 Contact form data
Messages sent via the contact/catering form (name, email, phone, message content) are used to respond to your enquiry.
2.3 Cart and local storage
The cart is stored in your device's localStorage — data does not leave your device until checkout. With your consent, we use Google Analytics 4 cookies (_ga, _ga_*) for statistics; without consent these are not set. We do not use advertising cookies. See also the cookie notice.
3. Purpose and legal basis
| Data category | Purpose | Legal basis (GDPR) |
|---|---|---|
| Order data | Order fulfilment, delivery, payment | Art 6(1)(b) — contract |
| Contact form data | Responding to enquiry | Art 6(1)(f) — legitimate interest |
| Email (confirmation) | Order confirmation | Art 6(1)(b) — contract |
| Web analytics (Google Analytics) | Anonymous usage statistics | Art 6(1)(a) — consent |
4. Data retention
Order and accounting data is retained for 7 years after fulfilment (legal accounting requirement). Contact form messages are retained for up to 1 year.
5. Sharing with third parties
We do not sell your data. We share only what is necessary with:
- Payment provider — for processing your payment (GDPR-compliant)
- Cloudflare — web hosting and security (GDPR DPA in place)
- Google (Google Ireland Limited) — web analytics only with your consent; data may be transferred outside the EEA under standard contractual clauses
6. Your rights
You have the right to:
- Access your personal data we process
- Rectify inaccurate data
- Erase your data ("right to be forgotten") where there is no legal basis for processing
- Restrict processing in case of dispute
- Object to processing based on legitimate interest
- Data portability — receive your data in structured form
- Lodge a complaint with the Data Protection Inspectorate (aki.ee)
To exercise your rights write to: kristina.jaanikesing@gmail.com. We will respond within 30 days.
7. Security
All data is transmitted over HTTPS. Data is protected by access controls. Only authorised persons have access to your data.
8. Google Analytics 4
With your consent, we use Google Analytics 4 (Google Ireland Limited) to anonymously understand how visitors use the shop. Analytics collects pseudonymous data: pages visited, session duration, approximate location, device type. Data is used only as aggregate statistics. We use Google Consent Mode v2 — analytics cookies are not set before consent, and advertising signals are disabled by default. You may withdraw consent at any time via the cookie banner or the footer link. Retention in Google Analytics: 14 months.
9. Contact for privacy questions
For privacy questions write to: kristina.jaanikesing@gmail.com