Privacy policy

Updated 11 August 2026

This privacy policy explains how KIFFT SHOP OÜ processes personal data when you use a KIFFT online store, place an order or contact us.

Data controller

KIFFT SHOP OÜ, registry code 16687507
Roosikrantsi 15, Tallinn 10115, Estonia
info@kifft.ee
+372 5808 8886

Data we process

When you place an order, we process the customer's name, email address, telephone number, delivery address and country, and company details when provided. We also process the cart and order contents, amounts, discount code, selected payment and delivery methods, parcel locker, payment and delivery status, invoice details and communications about the order.

Use of the website may generate technical and usage data such as an IP address, device and browser information, referring page, pages viewed and events related to products, the cart, checkout and purchases. When you email or call us, we process your contact details and the content of your message.

Bank or card credentials are entered in Montonio's payment environment and processed by Montonio. KIFFT stores the payment status and provider references with the order, not your bank login or full card details.

Why we use the data

One privacy window lets you choose analytics and advertising separately from email offers; neither choice is preselected. “Accept all” enables both, “Only necessary” and “Reject all” enable neither, and customisation allows either choice independently. With email consent we may send KIFFT news, product offers, personalised discounts and unfinished purchase reminders. Every marketing email includes an unsubscribe option, and after unsubscribing no new marketing emails are sent to that address. The footer privacy setting affects future orders in this browser; to withdraw email consent already stored with an order, use the email's unsubscribe link or contact info@kifft.ee. Essential order, payment and delivery messages are not marketing.

We use data to accept and fulfil orders, arrange payment and delivery, send invoices and order notifications, provide customer support, handle returns and claims, meet accounting and other legal duties, and improve the operation, security and usability of the online store. Depending on the activity, processing may be based on performance of a contract, a legal obligation, our legitimate interests or consent where it is requested.

Service providers and recipients

Where necessary for the service, we share data with Montonio for payment processing, SmartPosti for delivery and parcel locker fulfilment, and Resend or our email service provider for transactional emails. When the order-ledger integration is enabled, limited customer and paid-order data may be managed in Google Sheets within Google Workspace. Hosting and technical support providers, our accountant and legal advisers may also process data to the extent needed for their work.

Analytics, advertising technologies and cookies

During checkout we use a strictly necessary HttpOnly cookie to show the payment and order status securely in the same browser. JavaScript cannot read it, it is not used for advertising, and it expires after seven days.

Meta Pixel and, where configured, Google Tag Manager and Google Analytics 4 load only after your explicit opt-in. These tools help measure visits, product interactions, cart, checkout and purchase events, and advertising performance. You can give or withdraw consent at any time through the Privacy settings link in the page footer. After consent, Google and Meta may receive technical and usage data and use cookies or similar technologies under their own terms.

Some providers may process data outside the European Economic Area depending on their infrastructure and terms. The conditions for that processing are determined by the relevant provider and the data protection rules that apply to it.

How long we keep data

We keep order and customer communication data for as long as needed to fulfil the order, provide support, handle returns and claims, and comply with mandatory accounting and other legal retention periods. Retention of technical, analytics and advertising data also depends on the relevant provider's settings and terms. When data is no longer needed and there is no legal basis to retain it, it is deleted or anonymised.

Your rights

Depending on the circumstances, you may have the right to access your data, have it corrected or deleted, restrict or object to processing, receive data in a portable format and withdraw consent where processing is based on consent. Whether a right applies depends on the processing and the law. Send a request to info@kifft.ee. You may also complain to the Estonian Data Protection Inspectorate or a competent court.

Security and changes

We use appropriate technical and organisational measures to protect personal data, but no method of transmission over the internet or storage is entirely risk-free. If our services or data processing change, we will update this policy and publish the current version on this page.