Expresstime OÜ Data Protection Terms

<sub><sup>General
1. Our data protection terms are based on the General Data Protection Regulation 2016/679 (GDPR) and the concepts outlined therein. The data protection terms are available at the bottom left of the homepage of expresstime.ee. We confirm that we process personal data responsibly and comply with the applicable legal framework, primarily the General Data Protection Regulation and the Personal Data Protection Act.
2. Our data protection terms apply to all users of the expresstime.ee website and customers.
3. If you have any questions, please contact us via email at info@megateh.eu. If your question relates to your personal data, please submit a digitally signed request for identification purposes.
4. The data controller is Expresstime OÜ (registration code 11506464), located at P. Pinna 8, Tallinn, email: info@megateh.eu.

Data Subject Rights
5. Right to access and obtain information, including the right to receive a copy of your personal data. You have the right to confirm whether your personal data is being processed and, if so, to request a copy. You also have the right to know what data we have collected, the purpose of collection, whether and to whom it is disclosed, and how long it is retained.
6. Right to rectify inaccurate personal data. If your personal data is incorrect, you can request correction by sending a signed request to info@megateh.eu.
7. Right to erasure and/or restriction of processing. In certain cases, you may request the deletion of your personal data, such as when processing is based solely on consent and you withdraw it. You may also request a restriction on data processing if it is unlawful or while disputing its accuracy. However, restricting or deleting data may affect our ability to provide services (e.g., fulfilling an order, responding to inquiries).
8. Right to data portability. You have the right to receive personal data concerning you in a structured, commonly used, and machine-readable format and request its transfer to another controller, unless this is technically infeasible or infringes on the rights and freedoms of others.
9. Rights related to automated processing and profiling allow you to object at any time to the processing of your personal data based on automated decisions or profiling and to request human intervention. You may also request an explanation of the logic behind automated decision-making. We do not use automated processing or profiling with a significant impact on you or your rights.
10. Right to object or file a complaint with the Data Protection Inspectorate (AKI). If you believe we have violated data protection requirements or your rights, notify us immediately via email at info@megateh.eu. You also have the right to file a complaint with the Estonian Data Protection Inspectorate at info@aki.ee or Tatari 39, Tallinn 10314. You may also take legal action.
11. Right to compensation if you suffer damage due to the processing of your personal data.
12. You can exercise some of your rights regarding personal data by using your customer account.
13. Further information about your rights can be found in the General Data Protection Regulation.

Personal Data Processing
14. The primary purposes of personal data processing include keeping you informed about offers (marketing purposes), fulfilling contractual obligations (contractual purposes), ensuring the security of our IT system (security purposes), detecting legal violations (security and legal protection purposes), and complying with obligations to third parties (legal compliance).
15. We collect the following types of personal data:

• Personal data provided by the data subject;
• Personal data generated through interactions between the data subject and us;
• Personal data generated from service usage (e.g., loyalty account);
• Personal data collected from website and e-store visits;
• Personal data created and combined by us (e.g., correspondence in the customer relationship or order history).

16. Personal data processing is based on your consent, defining the scope and purpose of processing. Consent can be given by checking a box on our website, creating an account, or making a request to be contacted.
17. In the course of contract conclusion and execution, we process personal data to provide the requested service, verify identity, enter into and fulfill contracts, and assert contractual claims.
18. For our legitimate interest, we collect personal data to offer the best possible goods and services. We analyze our customer base, website, and social media pages, conduct direct marketing, optimize campaigns, and measure marketing effectiveness. We also process personal data for cybersecurity, network security, and to protect legal claims.
19. Primary activities involving the collection and processing of personal data:

• Newsletter subscription: If you subscribe to our newsletter, we will inform you monthly about our activities and best offers. We collect and process your email address along with any voluntarily provided details like name and address.
• Website visits: When you visit our website, our servers automatically log certain data, including the name and address of requested files, access date and time, your operating system and browser, country, time zone, access status/HTTP status code, data volume transferred, previous website visited, browser settings, and active plugins. These logs are temporarily stored to optimize content and ads, provide information for legal proceedings in case of cyberattacks, and collect statistical data.
• Placing an order: To fulfill an order, we require personal data such as name, email, payment details, and selected product details. If using a delivery service, you must provide billing and delivery addresses. Your email is needed for order confirmation and communication. If you create a loyalty account, your data will be stored for future purchases.
• Using installment payments: If paying in installments, you must provide payment details and financial information to the selected service provider, who is responsible for processing.
• Loyalty account: If you create a loyalty account, you gain password-protected access to your stored data, order invoices, and the ability to manage personal data.
• Contractual obligations: We process data to fulfill our contractual obligations, including transmitting necessary data to logistics providers for order fulfillment.
• Warranty and service support: We transmit necessary personal data to service providers for warranty and repair services.
• Marketing and campaigns: We use personal data to improve customer experience and tailor offers. Campaigns have specific participation terms available before joining.

Data Sharing
20. We collaborate with third parties to whom we may disclose personal data as part of business cooperation. Such third parties include advertising and marketing partners, debt collection agencies, IT service providers, and invoicing service providers.
21. When placing an order, our service providers (suppliers, logistics partners) receive necessary data to process the order. This includes your name, personal ID or birth date, email, and phone number for delivery coordination. Data is shared only under legal and contractual obligations.
22. Generally, we do not transfer personal data outside the European Economic Area (EEA). If we do, we comply with data protection laws, such as ensuring the recipient country has an adequate protection level or implementing standard data protection clauses.

Data Retention and Security
23. Personal data is retained only as long as necessary for its purpose but no longer than statutory limitation periods. Key retention periods include:

• Correspondence regarding claims: 3 years;
• Debt-related data: 3 years (if no legal action) or 10 years (if legally enforced);
• Contract-related data: 7 years for accounting purposes, 3 years for claim-related correspondence, and potentially longer for warranties;
• Network logs: 14 months;
• Loyalty account data: Until account deletion;
• Warranty-related data: Retained per warranty duration.

24. Security measures include organizational and technical safeguards. Employees access personal data only when necessary, and authorized processors handle data per contractual agreements. We use software solutions ensuring compliance with security standards.

Children’s Data
25. Our services are not directed at children. We do not knowingly collect data from individuals under 13 years old. If we become aware of such collection, we will cease processing immediately.</sup></sub>