Privacy policy
Last updated 9 September 2026.
This page explains how Underwood Enterprise OÜ processes personal data on underwood.shop. It covers the webshop, customer support, delivery, payments, maintenance, rental and cookies. Purchase terms are on a separate page: Terms of purchase.
Contents
- Who is responsible
- What data we process
- Why and on what legal basis
- Who receives the data
- Cookies
- How long we keep data
- Transfers outside the EU
- Your rights
- Security
- Changes
- Contact
Who is responsible
The controller of personal data is:
Underwood Enterprise OÜ
Registry code 12814185
VAT EE101779913
Registered address: Vesiroosi tn 9, 76401 Laagri, Harju County, Estonia
Email: info@underwood.ee
Phone: +372 585 012 99
The warehouse is at Kuuse põik 30, warehouse 5, 76401 Laagri. By appointment you can also collect goods from the showroom in Tallinn, Kesk-Sõjamäe 10a, building 6 (3rd floor).
We have not appointed a data protection officer. Send questions about personal data to info@underwood.ee.
What data we process
This depends on what you do on the site or with us.
Orders and account
Name, email, phone, delivery and billing address, cart contents, order number, payment method and status, order comments. For company purchases, also the business name and VAT number.
Payment
Bank links, cards, instalments and pay-later are handled by ESTO. We usually see the payment status, not the full card number. For a bank transfer we see the incoming payment on our account. Cash is accepted only by prior agreement.
Delivery
Delivery address, phone and parcel locker location. These go to Omniva, Itella or a courier. When you collect goods we may ask for an identity document, as stated in the terms of purchase.
Support, rental and maintenance
Emails, phone calls and appointment times for the showroom or warehouse.
Website
IP address, browser and device data, cookies, pages visited. Statistics and marketing cookies run only if you accept them in the banner. We use Google reCAPTCHA against spam.
We do not ask for a personal identification code or special-category data (health, political views and similar). The shop is not intended for anyone under 18.
Why and on what legal basis
- Fulfilling an order, delivery, warranty, returns, rental and maintenance — performance of a contract (GDPR Art. 6(1)(b)).
- Invoices, bookkeeping and consumer-law duties — legal obligation (Art. 6(1)(c)).
- Fraud prevention, site security and answering business enquiries — legitimate interest (Art. 6(1)(f)).
- Statistics and marketing cookies, and ads on Facebook, Instagram and Google — consent (Art. 6(1)(a)). You can withdraw consent in the banner at any time.
If you do not give the data needed for an order, we cannot complete the purchase or send the goods.
Who receives the data
Data goes only to those needed to provide the service. We do not sell personal data.
- ESTO — bank link, card, instalments and pay later. ESTO may take credit decisions as its own controller, under its own terms.
- Omniva — parcel lockers in Estonia, Latvia and Lithuania.
- Itella SmartPOST — parcel lockers in Estonia and Finland.
- Courier providers for delivery to the door or to the building.
- Google — analytics and advertising if you accepted statistics or marketing cookies; reCAPTCHA against spam.
- Meta — Facebook and Instagram pixel and ads if you accepted marketing cookies.
- Accounting and IT providers who process data on our instructions.
- Public authorities where the law requires it.
Cookies
We ask for consent with the Complianz banner. The categories match the banner:
- Functional — cart, language, login, remembering consent. These are needed for the site to work.
- Preferences — settings that are not strictly necessary.
- Statistics — measuring visits (Google).
- Marketing — measuring and targeting ads (Meta, Google).
You can change this with the “Manage consent” button on the banner, or by deleting cookies in your browser.
How long we keep data
- Orders and invoices: the statutory accounting period, in Estonia generally 7 years.
- Customer account: until the account is deleted, or for as long as it is needed for orders.
- Support correspondence: usually up to 3 years, unless the law requires longer.
- Cookies: for the period shown in the banner. Complianz consent is stored for up to 12 months.
Transfers outside the EU
Google and Meta may process data in the United States. If you accepted the related cookies, the transfer is based on the contracts in force, including the European Commission’s standard contractual clauses. ESTO, Omniva and Itella process data mainly in the EU.
Your rights
You may access your data, ask for correction, ask for erasure where the law allows, restrict processing, receive the data in a machine-readable form, object to processing based on legitimate interest, and withdraw consent at any time. Withdrawal does not affect processing that already took place.
Send the request to info@underwood.ee. We reply within 30 days as a rule. We may ask you to confirm your identity.
You may lodge a complaint with the Estonian Data Protection Inspectorate, Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee. Residents of Latvia may also contact Datu valsts inspekcija; residents of Lithuania may contact Valstybinė duomenų apsaugos inspekcija.
Security
The site uses HTTPS. Access to data is limited to staff who need it for their work. We do not store card numbers on our server.
Changes
If this policy changes, we update the date on this page. For larger changes we may notify you by email or a notice on the site.