Privacy Policy and Data Protection

This Privacy Policy explains how Bjuti Kaubandus OÜ (hereinafter "Bjuti", "we", "us" or "our") collects, processes, stores, and protects your personal data when you visit our website bjuti.ee, purchase products from our online shop, book salon appointments, and manage your customer account, in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Estonian Personal Data Protection Act.

1. Data Controller

The controller of your personal data is:
Bjuti Kaubandus OÜ
Registry code: 14690362
Address: Vabaõhukooli tee 4, Tallinn, 12013, Harjumaa, Estonia
Email: info@bjuti.ee
Phone: +372 514 3691
Website: bjuti.ee

2. Categories of Personal Data Processed

Bjuti processes the following categories of personal data:

• Identity and contact details: first and last name, email address, phone number, delivery address (parcel locker or courier delivery destination).
• Order and booking data: ordered goods and services, appointment dates and times, salon and professional information, order history, shopping cart items, and invoices.
• Payment information: transaction date, amount, selected payment method, and payer name on payment receipts. Please note: sensitive credit card details, CVC codes, and banking credentials are encrypted and processed directly by our licensed payment partners; Bjuti never accesses or stores credit card numbers.
• Technical data: IP address, device and browser specifications, session states, and cookie data.
• Customer communications: customer support inquiries, feedback, and email correspondence.

3. Purposes and Legal Bases for Processing

Personal data is processed strictly in accordance with Article 6 of the GDPR under the following legal bases:

• Performance of a contract: processing, assembling, and delivering orders; registering, updating, and confirming salon appointments (via SMS/email); creating and managing user accounts.
• Compliance with legal obligations: maintaining statutory accounting and financial records (invoices retained for 7 years under Estonian accounting law); resolving consumer claims.
• Consent: delivering direct marketing newsletters and deploying non-essential analytical cookies. Customers have the right to withdraw consent at any time.
• Legitimate interest: safeguarding website integrity, quality, and technical performance; fraud prevention; analyzing aggregated statistical data to improve the shopping experience.

4. Artificial Intelligence (AI) and Data Processing

Bjuti incorporates smart artificial intelligence (AI) tools (such as semantic product search, automated multilingual translations, and an AI booking assistant for discovering available slots) to enhance customer convenience and service speed.

Important privacy commitment: Customer personal data, purchase records, and salon bookings are NEVER used to train, fine-tune, or develop public foundational AI models. All AI queries are executed through isolated, contractual, enterprise-grade APIs where data retention for model training is strictly forbidden. Bjuti does not employ automated decision-making or profiling that produces legal or similarly significant effects on consumers.

5. Cookies and Tracking Technologies

The bjuti.ee platform utilizes cookies and comparable browser technologies:

• Strictly Necessary Cookies: vital for core functionality (language selection, secure sessions, CSRF token validation, shopping cart persistence, and login state).
• Analytical Cookies: gathering aggregated, anonymous website traffic statistics (e.g. Google Analytics) to improve navigation and user flows.

6. Data Processors and Third-Party Disclosures

Personal data is treated with confidentiality and is shared only with vetted third-party service providers to the extent necessary for service fulfilment:

• Payment processors: Montonio Finance UAB (secure bank links, card processing, and checkout payments).
• Logistics & carriers: Smartpost (Itella Estonia OÜ), DPD Eesti AS, and Venipak Eesti OÜ (shipping parcel locker and courier packages).
• Communications & notifications: Messente Communications OÜ and Twilio Inc. (dispatching SMS appointment confirmations, verification codes, and reminders).
• Hosting and cloud infrastructure: Hetzner Online GmbH (all servers located within the European Union).
• Public authorities: law enforcement and regulatory supervisory bodies solely when compelled by applicable legislation.

7. Data Security and Retention

All personal data is securely hosted on servers situated in European Union Member States. Bjuti applies robust technical and organizational security controls (including TLS encryption, network firewalls, and strict role-based access management) to protect information against unauthorized access, loss, or alteration.

Personal data is retained only as long as necessary to achieve its initial collection purpose:

• Accounting source documents and invoices are retained for 7 years pursuant to Estonian statutory requirements.
• Customer account information is retained for the active lifespan of the account or until an erasure request is submitted.
• Booking records and correspondence are retained until the expiration of applicable legal limitation periods.

8. Your Rights and the Right to Erasure ("Right to be Forgotten")

Under Chapter III of the GDPR, you have the following rights regarding your personal data:

• Right of access: obtain confirmation and copies of your personal data processed by us.
• Right to rectification: correct inaccurate or outdated information in your profile or via support.
• Right to erasure ("Right to be forgotten"): request deletion of your account and personal data. Exception: data that we are legally required to retain (e.g. 7-year accounting records) or data needed for the establishment, exercise, or defense of legal claims cannot be deleted prematurely and will be restricted exclusively to statutory purposes.
• Right to restriction of processing: restrict processing under certain conditions.
• Right to object: object to processing grounded in our legitimate interests.
• Right to data portability: obtain and transmit your data in a structured, machine-readable format.
• Right to withdraw consent: revoke marketing or cookie consent at any moment without affecting prior lawful processing.

9. Inquiries, Rights Execution, and Dispute Resolution

To exercise any of your rights or request account deletion, please email us at: info@bjuti.ee. We review and respond to requests within 30 days.

If you believe that your personal data processing infringes applicable regulations, you have the right to lodge a complaint with the supervisory authority:
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tatari 39, 10134 Tallinn, Estonia
Email: info@aki.ee
Website: www.aki.ee