Privacy policy

This Privacy Policy explains how 1STEP4WARD OÜ collects, uses, stores and shares personal data when you visit the Every Step Forward online store at everystepforward.eu, place an order or contact us.

1. Data controller

1.1 The controller of personal data processed through the Every Step Forward online store (the Online Store) is 1STEP4WARD OÜ, registry code 17596190, address Madara 20/4, 10613 Tallinn, Estonia, email hello@everystepforward.eu.

2. Personal data processed

2.1 Depending on how you use the Online Store, we may process the following personal data:

contact details, such as your name, email address, telephone number, delivery address and billing address;
order details, such as the products purchased, personalised engraving text, price, delivery method, selected parcel locker, purchase history, returns and refunds;
payment-related information, such as the payment method, amount, payment status and transaction reference; the Online Store does not see online banking passwords or full payment card details;
customer communications, such as questions, requests and feedback submitted through the contact form, email or social media;
technical data, such as your IP address, device and browser information, and information collected through cookies or similar technologies;
marketing consent and communication preferences where you subscribe to a newsletter or otherwise consent to marketing.

3. Sources of personal data

3.1 We collect personal data:

directly from you when you place an order, use the Online Store, contact us or consent to marketing;
automatically through cookies and similar technologies when you use the Online Store;
from service providers such as Shopify, payment service providers and delivery partners where necessary to process an order, confirm payment or provide the requested service.

4. Purposes and legal bases

4.1 Order fulfilment and customer service. We use personal data to process orders, verify payments, personalise products, deliver parcels, send order-related communications, arrange returns and refunds, and respond to customer enquiries. The legal basis is the performance of a contract or taking steps at your request before entering into a contract.

4.2 Legal obligations. We process order and payment information to comply with accounting, tax, consumer protection and other legal obligations. The legal basis is compliance with a legal obligation.

4.3 Store security and fraud prevention. We process data to protect the Online Store, payments and customers, prevent misuse and fraud, and establish, exercise or defend legal claims. The legal basis is our legitimate interests.

4.4 Newsletter and direct marketing. We send newsletters and marketing offers where you have given consent. You may withdraw your consent at any time. The legal basis is consent.

4.5 Analytics and marketing cookies. We use optional analytics and marketing cookies to measure Online Store use and advertising performance only where you have consented. The legal basis is consent.

4.6 Necessary cookies. Necessary cookies enable the cart, checkout, security, language selection and other core functions of the Online Store. Their use is based on the performance of a contract and our legitimate interest in operating a secure and functional online store.

5. Recipients

5.1 Service providers may process personal data only to the extent necessary to provide their services. Recipients may include:

Shopify, which provides the Online Store platform, hosting and technical infrastructure;
Maksekeskus AS, Shopify Payments and the bank, card or digital-wallet payment provider selected by the customer;
Maksekeskus Tarne+ and the delivery partner selected by the customer, including SmartPosti, Unisend, Venipak, DPD or Omniva;
accounting, IT, analytics, email, marketing, customer support and legal service providers;
public authorities or other authorised persons where disclosure is required by law or necessary to protect our legal rights.

5.2 We do not sell personal data.

6. Relationship with Shopify and international transfers

6.1 The Online Store is hosted on the Shopify platform. Shopify processes personal data relating to the use of the Online Store to provide, secure and improve its services. Information submitted through the Online Store may be processed by Shopify and its service providers.

6.2 More information about how Shopify processes personal data is available in the Shopify Consumer Privacy Policy and through the Shopify Privacy Portal.

6.3 Shopify or other service providers may process personal data outside the European Economic Area. Where this occurs, appropriate legal safeguards are used, such as an adequacy decision by the European Commission, Standard Contractual Clauses or another valid transfer mechanism.

7. Retention

7.1 Personal data is retained only for as long as necessary for the purpose for which it was collected or as required by law. In general:

accounting source documents and related order and payment data are retained for seven years after the end of the relevant financial year;
order fulfilment, customer service, return and complaint data is generally retained for up to three years after the order has been fulfilled or the communication has ended, unless longer retention is required for a legal claim or legal obligation;
newsletter and other marketing data is retained until consent is withdrawn or the marketing purpose ends;
cookie data is retained according to the purpose of the cookie and the period shown in the Online Store's cookie settings.

7.2 After the applicable retention period, personal data is deleted or anonymised.

8. Newsletter and cookies

8.1 The Online Store sends newsletters and marketing offers only with consent. Consent may be withdrawn at any time by using the unsubscribe link in the message or by emailing hello@everystepforward.eu. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

8.2 Necessary cookies cannot be disabled without affecting the operation of the Online Store. Analytics and marketing cookies are used only if they have been enabled and the visitor has consented.

8.3 Visitors may change or withdraw their consent to optional cookies through the cookie settings available in the Online Store.

9. Data subject rights

9.1 Subject to applicable law, you have the right to:

receive information about the processing of your personal data and request access to it;
request the correction or deletion of your personal data;
request restriction of processing;
object to processing based on legitimate interests;
withdraw consent at any time;
receive personal data you have provided in a structured, commonly used and machine-readable format where the right to data portability applies;
lodge a complaint with a competent supervisory authority.

9.2 To exercise your rights, email hello@everystepforward.eu. We may request information necessary to verify your identity before responding. We generally respond within one month.

10. Security and automated processing

10.1 We apply reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. However, no method of transmission or storage is completely risk-free.

10.2 We do not make decisions based solely on automated processing that produce legal or similarly significant effects for customers. Payment and fraud-prevention systems may automatically assess or flag transactions for review.

11. Complaints and contact

11.1 For questions about this Privacy Policy or the processing of your personal data, email hello@everystepforward.eu.

11.2 If you believe that your personal data has been processed unlawfully, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, email info@aki.ee, website www.aki.ee. If you live in another European Economic Area country, you may also contact the supervisory authority in your country of residence.

12. Changes to this Privacy Policy

12.1 We may update this Privacy Policy if our services, data-processing practices or applicable laws change. The current version will be published in the Online Store together with its effective date.

13. Contact details

Data controller: 1STEP4WARD OÜ
Registry code: 17596190
Address: Madara 20/4, 10613 Tallinn, Estonia
Email: hello@everystepforward.eu