Privacy policy
1. General Provisions
1.1. This Privacy Policy sets out the principles for the collection, processing and storage of personal data in the Bibi Butiik OÜ online store at www.bibibutiik.ee.
1.2. The controller of personal data is Bibi Butiik OÜ, registry code 16261398, VAT number EE102387621, hereinafter referred to as the data controller.
1.3. For the purposes of this Privacy Policy, a data subject is a customer or any other natural person whose personal data is processed by the data controller.
1.4. For the purposes of this Privacy Policy, a customer is a person who purchases or wishes to purchase goods from the data controller’s online store or uses the website.
1.5. The data controller follows applicable laws when processing personal data and processes personal data lawfully, fairly and securely.
2. Collection, Processing and Storage of Personal Data
2.1. Personal data is collected mainly electronically through the online store, order placement, email and customer communication.
2.2. By submitting personal data, the data subject grants the data controller the right to collect, use and process the data provided when using the online store, placing an order or communicating with the data controller for the purposes described in this Privacy Policy.
2.3. The data subject is responsible for ensuring that the data submitted is correct, accurate and up to date. The data subject must inform the data controller of any changes to the submitted data as soon as possible.
2.4. The data controller is not responsible for any damage caused to the data subject or third parties due to incorrect or incomplete data submitted by the data subject.
3. Processing of Customers’ Personal Data
3.1. The data controller may process the following personal data:
3.1.1. first and last name;
3.1.2. phone number;
3.1.3. email address;
3.1.4. delivery address;
3.1.5. billing address, if different from the delivery address;
3.1.6. order details, including purchased products, quantities, prices and order history;
3.1.7. payment-related data, such as payment method, payment status and transaction information;
3.1.8. customer communication data, including inquiries, returns, complaints and other correspondence;
3.1.9. technical data related to website use, such as IP address, device information, browser type and data collected through cookies.
3.2. Bibi Butiik OÜ does not store customers’ full payment card details. Card payments and bank payments are processed through payment service providers.
3.3. The legal basis for processing personal data is Article 6(1)(a), (b), (c) and (f) of Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation:
a) the data subject has given consent to the processing of personal data for one or more specific purposes;
b) processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract;
c) processing is necessary for compliance with a legal obligation to which the data controller is subject;
f) processing is necessary for the purposes of the legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
3.4. Purposes of Processing and Retention of Personal Data
3.4.1. Processing and fulfilling orders
Personal data is used to receive, confirm, prepare and deliver orders, arrange returns and exchanges, and communicate with the customer.
Retention period: up to 7 years, where necessary for accounting or legal obligations.
3.4.2. Payment processing
Personal data is used to receive payments, verify payment status and confirm transactions.
Retention period: according to the retention periods required by accounting and tax laws.
3.4.3. Ensuring the functioning of the online store
Personal and technical data is used to ensure website functionality, security, shopping cart functionality and improvement of the user experience.
Retention period: as long as necessary for the relevant purpose or according to cookie settings.
3.4.4. Customer management and customer support
Personal data is used to respond to customer inquiries, resolve issues, and process returns and complaints.
Retention period: up to 3 years after the last communication, unless a legal obligation requires a longer retention period.
3.4.5. Accounting and compliance with legal obligations
Personal data is used for accounting, tax records and compliance with legal obligations.
Retention period: according to the retention periods required by law.
3.4.6. Marketing
If the customer has given consent, the data controller may use the customer’s email address to send newsletters, offers and marketing messages.
Retention period: until the consent is withdrawn.
3.5. The data controller has the right to share customers’ personal data with third parties only to the extent necessary for the functioning of the online store, fulfilment of orders and compliance with legal obligations.
Such third parties may include:
Shopify, which provides the online store platform;
Maksekeskus AS / MakeCommerce, which mediates online store payments;
transport and parcel service providers, including Omniva, Smartpost or other selected delivery partners;
an accountant or accounting service provider;
IT and web service providers;
public authorities, where data disclosure is required by law.
3.6. Personal data necessary for making payments is transferred to the authorised processor Maksekeskus AS / MakeCommerce.
Maksekeskus AS
Registry code: 12268475
Address: Liivalaia 45, 10145 Tallinn, Estonia
3.7. When processing and storing personal data, the data controller applies appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or any other unlawful processing.
3.8. The data controller stores personal data only for as long as necessary to fulfil the purpose for which the data was collected or to comply with legal obligations.
4. Rights of the Data Subject
4.1. The data subject has the right to receive information about which personal data the data controller processes.
4.2. The data subject has the right to access their personal data.
4.3. The data subject has the right to request correction of inaccurate or incomplete personal data.
4.4. The data subject has the right to request deletion of personal data if there is no legal basis for processing or if the storage of the data is no longer necessary.
4.5. The data subject has the right to request restriction of processing or to object to the processing of personal data, where provided by applicable law.
4.6. If personal data is processed on the basis of consent, the data subject has the right to withdraw consent at any time.
4.7. The data subject has the right to request the transfer of their personal data, where technically possible and applicable under law.
4.8. To exercise their rights, the data subject can contact Bibi Butiik OÜ by email:
4.9. The data subject has the right to lodge a complaint with the Estonian Data Protection Inspectorate if they believe that their personal data has been processed in violation of applicable law.
5. Cookies
5.1. The Bibi Butiik OÜ online store may use cookies and similar technologies to ensure the functioning of the website, improve user experience, analyse website use and provide relevant content or advertising.
5.2. The customer can manage the use of cookies in their browser settings. Disabling certain cookies may affect the functioning of the online store.
6. Contact Details
For questions related to the processing of personal data, please contact:
Bibi Butiik OÜ
Registry code: 16261398
VAT number: EE102387621
Email: bibibutiik@gmail.com
Phone: +372 5649 0343
Studio shop address: Keskväljak 8, 72713 Paide, Estonia
Registered address: Koila, Suurpalu, Paide, Estonia
7. Final Provisions
7.1. This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the Estonian Personal Data Protection Act and other applicable legal acts of the Republic of Estonia and the European Union.
7.2. Bibi Butiik OÜ has the right to amend this Privacy Policy. Changes will be announced via the website www.bibibutiik.ee.
7.3. This Privacy Policy is valid from 02.07.2026.