Privacy notice

Who uses your data?

The controller of personal data connected with enquiries and purchases is Talforce OÜ, registry code 12009549, Vana-Aaviku tee 11/2, Aaviku, 75305, Estonia. For privacy questions, email kiilto@kiilto.eu.

Orders and enquiries

When you order, we process your name, email, phone number, company details, delivery method and address, ordered products, amount and payment status. We store these data in the shop’s order database to accept payment, fulfil the order, send confirmation and handle returns or complaints. The company name is optional; the phone number is needed for delivery and order-related contact.

To initiate a bank payment, we send MakeCommerce the order amount and reference, your email and the technically necessary IP address. Payment is confirmed in the bank’s environment; Talforce does not receive your online banking passwords or other authentication details. We use Resend to deliver order confirmation emails.

We use information submitted in an advice form to answer your question. Processing is based on taking pre-contractual steps at your request or performing a sales contract. Accounting data are processed to meet a legal obligation. In a dispute, retaining data may be based on a legitimate interest in establishing or defending claims.

Product ratings and reviews

When you submit a rating, we store the selected product and package, public name or nickname, email, star rating, optional title and review text, and submission time. We publish the public name, rating and text with your agreement after review. Your email and any order number entered are not published. We use the email to prevent repeated ratings, check a possible purchase and resolve questions about your review.

An order number is optional and is used only at submission to check a match between a paid order, product and email. We store the verification result with the review, not the order number. “Verified purchase” means that these details matched a paid order. Without that label, the purchase has not been verified.

To limit spam, we store a hash derived from the IP address using a secret key. We also publish critical feedback; moderation removes spam, abuse, personal data and content unrelated to the product. A low numerical rating alone is not a reason to withhold publication.

We retain reviews and related data for management and publication until removal or resolution of a justified deletion request. To withdraw publication consent, change or remove a review, write from the same email address to kiilto@kiilto.eu. Publishing a review does not mean agreeing to advertising. Reviews are hosted and stored in the shop’s Sites database.

Basket and technical data

Basket product codes and quantities are stored in your browser’s local storage under “kiilto-cart” so your selection can persist for a later visit. Contact details are not added to the basket. Empty the basket using its button or clear the website’s data in your browser settings.

For bank transfer orders, we limit spam and repeat orders using the email and a hash derived from the IP address with a secret value. The hash is saved with the order; the IP address itself is not stored in the order for this purpose. The hash is used for security limits only, not advertising.

Hosting and access services may process technical data, such as IP addresses and request logs, for reliability and security. The website uses Sites hosting and is publicly accessible. You do not need to sign in to shop. The service’s data use is described in the OpenAI privacy policy.

Website analytics and your choice

We use Google Analytics 4 only if you choose “Allow analytics”. Analytics helps us measure page views, navigation, outgoing links and shop usage to improve content and the shopping experience. We do not use this choice to personalise advertising.

Your choice is saved in browser local storage under “kiilto-analytics-consent”. If you choose necessary functionality only, the Google Analytics code is not loaded. You can change your choice at any time using “Cookie preferences” at the bottom of the page. If consent is withdrawn, we remove Google Analytics cookies that can be accessed through this website.

When analytics is used, Google receives information about your device, browser, approximate location and website usage. The provider is Google Ireland Limited. Read more in Google’s privacy policy. Processing is based on your consent.

Recipients and retention

Data are processed by authorised Talforce staff and, where necessary, MakeCommerce AS, Resend, website hosting and IT providers, carriers, goods dispatchers including the Kiilto warehouse, and the accounting provider. Each recipient receives only the data needed for its task. We do not sell your data.

We retain unfinished and unpaid order data for up to 12 months to prevent duplicate orders and resolve payment questions, then delete them. Data about completed orders and possible disputes are retained for the period needed to meet the obligation and the applicable limitation period. Accounting source documents are retained for seven years from the end of the relevant financial year.

Where a service processes data outside the European Economic Area, legally required safeguards must be in place. Ask us by email for information about the services, retention and safeguards used for a particular order.

Your rights

You may request access to and a copy of your data, correction of inaccurate data and, where the law provides, deletion, restriction and portability. You may object to processing based on legitimate interest. Documents subject to a statutory retention obligation cannot always be deleted immediately.

Email kiilto@kiilto.eu. We generally respond within one month and may verify your identity where necessary. You may lodge a complaint with the Estonian Data Protection Inspectorate. Sending an enquiry does not mean agreeing to marketing emails.