Skip to content

Privacy policy

This privacy policy describes how the Max24 online shop (max24.ee) collects, uses and protects personal data. The privacy policy is effective from 13.10.2026.

1. Data controller

The data controller for personal data is T24 OÜ (hereinafter the data processor), registry code 17553281, address Pargi tn 6, Rakvere city, Lääne-Viru County, 44306, e-mail [email protected], telephone +372 5230788.

The data processor processes personal data lawfully, fairly and transparently, only for specified purposes and to the extent necessary to achieve those purposes.

2. What data we collect

  • Order: first and last name, e-mail address, telephone number, delivery address or selected parcel locker, products ordered, payment method and payment status; in the case of a business customer, the company name, registry code and VAT number.
  • Contact form and e-mails: name, e-mail address and message content.
  • Newsletter: e-mail address and time of consent.
  • Withdrawal statement and complaint: name, contact details, order number, returned goods and attached photos.
  • Website use: shopping cart contents, cookie preferences and technical data (such as IP address and browser type) required for the secure operation of the website.

We do not see or retain bank card details: payment takes place in the secure environment of the bank or payment service provider.

3. Why and on what legal basis we use data

  • Performance of a contract (Article 6(1)(b) of the General Data Protection Regulation): accepting and fulfilling orders, delivering goods, processing payments, communicating with customers, handling returns and complaints.
  • Legal obligation (Article 6(1)(c)): accounting and retaining invoices, fulfilling obligations arising from consumer rights.
  • Consent (Article 6(1)(a)): sending newsletters and marketing communications, and cookies for measuring usage. Consent can be withdrawn at any time.
  • Legitimate interest (Article 6(1)(f)): ensuring the security of the online shop, preventing fraud and misuse, and improving the service.

4. Who we share data with

We share data only to the extent necessary for fulfilling the specific purpose:

  • payment service provider (Montonio Finance UAB) and banks for making payments;
  • carriers and parcel locker service providers (such as Omniva, SmartPost, DPD) and shipment intermediaries for delivering goods;
  • suppliers, if the ordered goods are shipped directly from the supplier's warehouse, only to the extent necessary for delivery;
  • IT and hosting service providers that ensure the operation of the online shop, e-mail and servers;
  • accounting service provider and public authorities where required by law.

Data processors process data only according to our instructions and are required to protect it. Personal data is not sold. If data is transferred outside the European Economic Area, we ensure the safeguards required by law.

5. Cookies

We use cookies necessary for the operation of the online shop, which remember, for example, your shopping cart, language and cookie preferences. We use cookies for measuring usage and marketing only with your consent, which you can give or withdraw in the cookie settings.

6. How long we retain data

  • We retain data related to orders and invoices for 7 years in accordance with the Accounting Act.
  • We retain data related to complaints and withdrawal statements until the claims become time-barred, generally for 3 years.
  • We retain newsletter data until consent is withdrawn.
  • We retain contact form and e-mail data for as long as necessary to respond to the enquiry, but no longer than 2 years.

7. Your rights

You have the right to:

  • access your personal data and obtain information about its processing;
  • request the correction of inaccurate data;
  • request the deletion of data where there is no longer a basis for processing it;
  • request restriction of data processing and object to processing;
  • receive your data in a machine-readable format (data portability);
  • withdraw consent given, which does not affect the lawfulness of processing carried out previously.

To exercise your rights, write to [email protected]. We generally respond within 30 days. If you believe that your rights have been violated, you can contact the Data Protection Inspectorate (www.aki.ee).

8. Data protection

We implement organisational and technical measures that protect personal data against accidental or unlawful destruction, alteration, disclosure and other unlawful processing. Access to data is limited to employees and partners who need it to perform their work.

9. Final provisions

The privacy policy has been prepared in accordance with the General Data Protection Regulation (EU) 2016/679, the Estonian Personal Data Protection Act and other applicable legislation. The data processor has the right to amend the privacy policy; the current version is published on the website max24.ee.