Privacy policy

Last updated: 05.11.2025
Website: https://meknit.com

1. GENERAL PROVISIONS

1.1. This privacy policy describes how ME KNIT OÜ (registry code 14385593, address Ujula tn 1A, 51008 Tartu, Estonia, email info.meknit@gmail.com) (the controller of personal data, hereinafter the Controller) collects, uses, transfers and stores personal data when a customer uses the Controller's online shop and other services at https://meknit.com (hereinafter the online shop).

1.2. For the purposes of this privacy policy, a data subject is a customer or any other natural person whose personal data the Controller processes.

1.3. For the purposes of this privacy policy, a customer is anyone who uses the Controller's website, creates an account, submits an enquiry or buys goods or services from the Controller's online shop.

1.4. When processing personal data, the Controller complies with the applicable legislation (including the General Data Protection Regulation of the European Union (GDPR) and Estonian law) and processes personal data lawfully, fairly and securely. The Controller is able to demonstrate that personal data are processed in accordance with the law.

2. COLLECTION, PROCESSING AND STORAGE OF PERSONAL DATA

2.1. The personal data that the Controller collects, processes and stores are collected electronically, mainly through the online shop (the Shopify platform) and by email. Where necessary, data may also be collected in other ways (e.g. source accounting documents on paper).

2.2. By submitting their personal data (e.g. when placing an order, creating an account, sending an enquiry or subscribing to the newsletter), the data subject gives the Controller the right to collect, organise, use and manage, for the purposes described in this privacy policy, the personal data that the data subject provides to the Controller directly or indirectly when buying goods or services in the online shop.

2.3. The data subject is responsible for ensuring that the data they provide are accurate, correct and complete. Knowingly providing false data is a breach of this privacy policy. The data subject must notify the Controller without delay of any change in the data provided.

2.4. The Controller is not liable for any damage caused to the data subject or to third parties as a result of the data subject providing false or incomplete data.

2.5. When the online shop is used, the Controller and/or its processors (including Shopify) also collect certain technical data and usage information by means of cookies and similar technologies (IP address, browser type, language settings, pages visited, clicks, etc.). Cookies are used to operate the online shop, to ensure security, to compile statistics and, where applicable, to tailor marketing. An overview of the use of cookies and the related choices may be described separately in the cookie notice.

3. PROCESSING OF CUSTOMERS' PERSONAL DATA

3.1. Categories of personal data processed

3.1. The Controller may process, among other things, the following personal data of the data subject:
– first name and surname;
– postal address and/or delivery address;
– telephone number;
– email address;
– information on purchases and orders (products ordered, prices, history, returns, exchanges);
– payment method information and transaction data (e.g. payment status, payment service provider used);
– customer account data (username, password, language or communication preferences), if the customer creates such an account;
– the content of customer support and other communications (enquiries, complaints, feedback);
– device and usage information (IP address, browser type and version, device, pages visited, logs).

The Controller itself does not store full payment card data. Card payments are processed securely by payment service providers (MONTONIO FINANCE OÜ), which act in accordance with their contracts and the law.

3.2. In addition to the above, the Controller has the right to collect data about the customer from public registers (e.g. to check the performance of payment obligations, where this is necessary for the performance of a contract or for compliance with obligations arising from legislation).

3.3. Legal basis for processing personal data

The legal basis for processing personal data is Article 6(1)(a), (b), (c) and (f) of the General Data Protection Regulation (GDPR):

a) the data subject has given consent to the processing of their personal data for one or more specific purposes (e.g. marketing, newsletters);
b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (e.g. the online shop purchase process, fulfilment of the order);
c) processing is necessary for compliance with a legal obligation of the Controller (e.g. accounting and tax reporting requirements);
f) processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party (e.g. fraud prevention, security of the online shop, establishing and defending claims), except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

3.4. Processing of personal data by purpose, and retention

3.4.1. Purpose of processing – safety and security
Data are used for the technical operation and security of the online shop, for logging and for fraud prevention.
Maximum retention period of personal data – generally up to 3 years, or in accordance with the time limits laid down by law where legislation requires longer retention.

3.4.2. Purpose of processing – processing orders and performing the contract
Data are used to receive and manage orders, process payments, dispatch goods and handle returns and exchanges.
Maximum retention period of personal data – up to 3 years from the end of the relevant transaction; source accounting documents (invoices, etc.) are retained for up to 7 years in accordance with the law.

3.4.3. Purpose of processing – ensuring the operation of the online shop's services
Data are used to provide and develop the functionality of the online shop and to analyse faults (e.g. visitor statistics, logs).
Maximum retention period of personal data – up to 2 years, unless the data are anonymised earlier.

3.4.4. Purpose of processing – customer management and communication
Data are used to maintain the customer relationship, for customer support, to send information related to purchase history and to resolve claims.
Maximum retention period of personal data – up to 3 years after the last active communication with the customer, unless legislation requires a longer period.

3.4.5. Purpose of processing – financial activities and accounting
Data are used to comply with obligations arising from accounting and tax legislation.
Maximum retention period of personal data – generally up to 7 years in accordance with the Accounting Act.

3.4.6. Purpose of processing – marketing and direct marketing
Data are used to send newsletters, campaigns and personalised offers, including profiling to a limited extent (e.g. recommendations based on purchase history and online behaviour).
Maximum retention period of personal data – until consent is withdrawn, or up to 3 years from the last marketing-related activity (e.g. opening an email, making a purchase), or until the data subject opts out.

3.5. Sharing of personal data with third parties

The Controller has the right to share customers' personal data with third parties to the extent necessary to achieve the purposes set out in this privacy policy and to comply with obligations arising from legislation. Such third parties may include, for example:
– accounting and financial service providers;
– IT and cloud service providers (servers, system maintenance);
– transport and courier companies (to deliver orders);
– payment service providers and banks (to process payments);
– marketing and analytics partners (e.g. email sending and advertising platforms), where the customer has given consent to this or it is permitted by law.

The Controller is the controller of the personal data and transfers the personal data necessary for making payments to MONTONIO FINANCE OÜ, acting as processor. MONTONIO FINANCE OÜ processes personal data in accordance with the requirements of its contracts and the law.

3.6. Use of the Shopify platform

The online shop meknit.com runs on the Shopify platform. Shopify group companies (including Shopify International Ltd, Shopify Inc. and others) provide the Controller with an e-commerce platform service and generally act as processors, processing personal data on behalf of the Controller and in accordance with its instructions (e.g. hosting the online shop, managing orders, connecting payment solutions, security and analytics services).

In certain cases, Shopify may also act as an independent controller (for example, when you use Shopify's own services such as Shop/Shop Pay or Shopify-related customer accounts, or when Shopify uses data to develop and improve its platform and for cross-merchant features). In those respects, Shopify itself is responsible for the processing of personal data in accordance with its own privacy policy. More detailed information is available at: https://privacy.shopify.com/

Shopify may process and store personal data outside the Republic of Estonia and the European Economic Area (EEA), for example in Canada or the United States. In such cases, appropriate legal bases for data protection are used (e.g. the European Commission's standard contractual clauses or adequacy decisions).

Shopify generally retains personal data for as long as is necessary for the operation of the online shop, the management of customer relationships and compliance with legal obligations. After a shop is closed or an account is terminated, Shopify may retain certain data on the basis of legitimate interest (e.g. dispute resolution, accounting) and because of legal requirements. The exact periods are set out in Shopify's privacy policy.

3.7. Security measures

When processing and storing the data subject's personal data, the Controller applies technical and organisational security measures designed to protect personal data against accidental or unlawful destruction, alteration, disclosure, unauthorised access and any other unlawful processing. Access to personal data is restricted to those employees and partners who need access to the data for their work.

3.8. General retention period

The Controller retains data subjects' personal data depending on the purpose of processing and at least for as long as is necessary to perform contractual obligations, to protect the Controller's rights or to comply with obligations arising from legislation. As a general rule, data are not retained for longer than 7 years from the end of the relevant relationship or transaction, unless the law requires a longer period or the data are anonymised.

4. RIGHTS OF THE DATA SUBJECT

4.1. The data subject has the right to access and review their personal data processed by the Controller.

4.2. The data subject has the right to receive information about which of their personal data are processed, on what legal basis and for what purposes, and to whom those data are disclosed.

4.3. The data subject has the right to request the rectification or completion of inaccurate or incomplete personal data.

4.4. Where the Controller processes personal data on the basis of the data subject's consent (e.g. marketing, newsletters), the data subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

4.5. In certain cases, the data subject has the right to request the erasure of their personal data (the “right to be forgotten”) or the restriction of processing, as well as the right to object to the processing of their personal data where the processing is based on legitimate interest.

4.6. The data subject has the right to receive their personal data in a structured, commonly used and machine-readable format and to transmit those data to another controller (data portability), where the processing is based on consent or a contract and is carried out by automated means.

4.7. To exercise their rights, the data subject may contact the Controller by email at info.meknit@gmail.com or by post at:

ME KNIT OÜ
Ujula tn 1A
51008 Tartu
Estonia

Where necessary, the data subject may also contact Shopify directly to exercise their rights, using the contact details given in Shopify's privacy policy.

4.8. To protect their rights, the data subject has the right to lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee) or with the supervisory authority of their place of residence in the European Economic Area.

5. FINAL PROVISIONS

5.1. This privacy policy has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation), the Personal Data Protection Act of the Republic of Estonia and other applicable Estonian and European Union legislation.

5.2. The Controller has the right to update and amend this privacy policy unilaterally in order to bring it into line with actual data processing, legislation or the recommendations of the supervisory authority. The current version of the privacy policy is always available in the Controller's online shop at https://meknit.com. Data subjects may additionally be notified of material changes by email or through another appropriate channel.