The data controller for personal data on the Qilowatt.eu webshop and the app app.qilowatt.it is QWATT OÜ (registration code 16373039), located at Veski, Kudina village, Jõgeva Parish, Jõgeva County, 49210, Estonia, email: info@qilowatt.it.

The following personal data are processed:
• Name, phone number, and email address;
• Delivery address of goods;
• Bank account number;
• Cost of goods and services and payment-related information (purchase history);
• Customer support information.

What is the purpose of processing personal data?
• Personal data is used for managing customer orders and delivering goods.
• Purchase history data (purchase date, product, quantity, customer information) is used to compile an overview of purchased goods and services and to analyze customer preferences.
• The bank account number is used for refunding payments to the customer.
• Personal data such as email, phone number, and customer name are processed in order to resolve issues related to the provision of goods and services (customer support).
• The online store user’s IP address or other network identifiers are processed for the purpose of providing the online store as an information society service and for compiling website usage statistics.

Legal basis
The processing of personal data is carried out for the purpose of fulfilling the contract concluded with the customer.
The processing of personal data is carried out to comply with a legal obligation (e.g., accounting and resolution of consumer disputes).

Recipients to whom personal data is disclosed
• Personal data is shared with the online store’s customer support for managing purchases, purchase history, and resolving customer issues.
• The name, phone number, and email address are shared with the transport service provider selected by the customer. For goods delivered by courier, the customer’s address is also disclosed in addition to the contact information.
• If the online store’s accounting is handled by a service provider, personal data is disclosed to the service provider for the purpose of performing accounting operations.
• Personal data may be disclosed to information technology service providers if necessary to ensure the functionality of the online store or data hosting.

Security and Access to Data
• Personal data is stored on servers of Veebimajutus.ee and TransIP.eu, which are located within the territory of a European Union member state or a country associated with the European Economic Area.
• Data may be transferred to countries whose level of data protection has been deemed adequate by the European Commission, as well as to US companies that are part of the Privacy Shield framework.
• Access to personal data is granted to the web store employees who may view the data in order to resolve technical issues related to the use of the web store and to provide customer support services.
• The web store implements appropriate physical, organizational, and IT security measures to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorized access and disclosure.
• The transfer of personal data to the web store’s authorized processors (e.g., transport service providers and data hosting providers) is carried out based on agreements concluded between the web store and the authorized processors. Authorized processors are required to ensure appropriate protective measures when processing personal data.

Accessing and Correcting Personal Data
• Personal data can be accessed and corrected in the web store user profile. If the purchase was made without a user account, personal data can be accessed through customer support.

Withdrawal of Consent
• If the processing of personal data is based on the customer’s consent, the customer has the right to withdraw consent by notifying customer support via email.

Retention
• When a webshop customer account is closed, personal data is deleted, except when such data needs to be retained for accounting purposes or for resolving consumer disputes.
• If a purchase in the webshop was made without a customer account, the purchase history is retained for three years.
• In the case of disputes related to payments or consumer claims, personal data is retained until the claim is fulfilled or the limitation period expires.
• Personal data required for accounting purposes is retained for seven years.

Deletion
• To delete personal data, contact customer support via email.
• The deletion request will be processed within one month at the latest, specifying the timeframe for the data deletion.

Transfer
• Requests for the transfer of personal data submitted by email will be responded to within one month at the latest.
• Customer support will verify the identity of the requester and provide information about the personal data subject to transfer.

Direct Marketing Notifications
• Email addresses and phone numbers are used to send direct marketing notifications if the customer has given their consent. If the customer does not wish to receive direct marketing notifications, they should use the unsubscribe link in the email footer or contact customer support.
• If personal data is processed for direct marketing purposes (profiling), the customer has the right to object at any time to both the initial and any further processing of their personal data, including profile analysis related to direct marketing, by notifying customer support via email (this information must be provided clearly and separately from any other information).

Dispute Resolution
Disputes related to the processing of personal data are resolved through customer support (support@qilowatt.it). The supervisory authority is the Estonian Data Protection Inspectorate (info@aki.ee).
QWATT OÜ is the data controller. QWATT OÜ transfers the personal data necessary for payment processing to the authorized processor, Maksekeskus AS.