Privacy Policy — personal data processing and GDPR rights

Personal Data Processing

The controller of personal data collected on the website cybermarket.ee and through the CyberMarket mobile application is LONG MARKET OÜ (registry code 17296134, Зкшшыду еуу 16-6, Tallinn, Estonia).

The contact person responsible for data protection can be reached at [email protected] or by phone at +372 612 22 22.

Mobile Application

The CyberMarket mobile application for iOS is a native shell that displays the cybermarket.ee website inside an embedded browser view (WKWebView). All data processing described in this policy applies equally to the mobile application.

• Login sessions, cookies, and shopping cart data are shared between the website and the mobile application — they are not duplicated or stored separately.

• The mobile application identifies itself in server logs with a custom User-Agent (CyberMarket-iOS/<version>) and appends UTM parameters (utm_source=ios_app) to URLs it generates. This is used solely for internal traffic attribution.

• The mobile application does not collect, store, or transmit any data outside of what the website itself collects.

• The mobile application does not access the device's camera, microphone, contacts, location, photos, or any other native iOS APIs requiring user permission.

• Apple may collect standard diagnostics and crash data via App Store Connect (controlled by the user's iOS privacy settings, not by us).

Personal Data Collected

The personal data processed may include:

• Name, phone number, and email address;

• Delivery address;

• Bank account information;

• Details of purchased products and services (purchase history);

• Data necessary for providing customer support, including chat transcripts.

Purpose of Processing

Personal data is used for managing customer orders and delivering products.

Purchase information (date, products, quantity, client data) is used to analyze customer preferences and improve the product range.

Bank account information may be used for processing refunds.

Contact information (name, email, phone) is used to resolve issues related to products or services.

IP addresses and other network identifiers are processed to provide the e-commerce service and for usage statistics.

Cookies and Analytics

The website and mobile application use cookies and similar technologies to enable shopping cart functionality, remember user preferences, and collect anonymous usage statistics.

Analytics and tracking services that may be active on the website include Google Analytics and Google Tag Manager. These services may set cookies and collect aggregated, anonymized data about visitor behaviour.

Users may disable non-essential cookies through their browser or device settings. Disabling essential cookies may prevent the application from functioning correctly (for example, the shopping cart will not work).

Legal Basis

The processing of personal data is carried out to fulfill the contract concluded with the customer and to meet legal obligations, such as accounting and resolving consumer disputes.

Data Sharing with Third Parties

Personal data may be shared with:

• Customer support to manage orders and resolve issues;

• Delivery service providers, including the client's contact information and delivery address;

• Accounting and IT service providers if required for the operation or data storage of the e-commerce platform;

• Payment processors, when a customer initiates a payment;

• Bitrix24 (Bitrix Inc.) — customer support communications via the in-site chat widget are processed by Bitrix24. Chat transcripts, contact details provided in chat, and session metadata are stored on Bitrix24 servers. Their privacy policy is available at https://www.bitrix24.com/about/privacy.php;

• Google LLC, in connection with the analytics services described above.

Advertising via Meta (Facebook) Pixel

The website cybermarket.ee includes the Meta Pixel (provided by Meta Platforms Ireland Limited / Meta Platforms, Inc.). The Meta Pixel records anonymised events such as page views, products added to the cart and completed purchases, and transmits them to Meta for the purpose of measuring advertising performance and showing personalised CyberMarket offers to you on Facebook, Instagram and other Meta properties (remarketing).

The legal basis for this processing is your consent, which you may withdraw at any time.

• On the website you can manage your consent through the cookie banner and through the cookie settings in your browser.

• In the CyberMarket iOS mobile application, the system displays Apple's App Tracking Transparency prompt on the first launch. If you choose "Ask App Not to Track", the application disables the Meta Pixel for your session and no advertising events are sent to Meta. You can review and change this setting at any time in Settings → Privacy & Security → Tracking → CyberMarket.

Meta's privacy policy is available at https://www.facebook.com/policy.php.

Data Security and Access

Data is stored on Infonet DC OÜ servers located within EU or EFTA member countries. Where data is transferred outside the EU/EEA, the transfer is governed by Standard Contractual Clauses approved by the European Commission, or by the EU-U.S. Data Privacy Framework where applicable.

Access to personal data is limited to authorized personnel who need it for technical support and customer service.

The e-commerce platform implements physical, organizational, and IT security measures to protect personal data from accidental or unlawful destruction, loss, alteration, or unauthorized access or disclosure.

Data transfers to authorized processors (e.g., delivery or data storage providers) are conducted under contractual agreements that ensure adequate protection.

Access, Correction, and Consent Withdrawal

Customers can view and correct their data via their account profile. Purchases made without an account can be managed by contacting customer support.

If processing is based on consent, the customer can withdraw it at any time by notifying customer support via email.

Your Rights Under the GDPR

Under the General Data Protection Regulation (Regulation (EU) 2016/679), you have the following rights regarding your personal data:

• The right to access your personal data (Article 15);

• The right to rectify inaccurate or incomplete data (Article 16);

• The right to erasure of your data — "right to be forgotten" (Article 17);

• The right to restrict processing (Article 18);

• The right to data portability — receive your data in a structured, commonly used format (Article 20);

• The right to object to processing, including profiling (Article 21);

• The right not to be subject to a decision based solely on automated processing (Article 22);

• The right to lodge a complaint with the supervisory authority (see Dispute Resolution below).

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You may also delete your account directly from your account profile or from the mobile application.

Retention

Upon closing a customer account, personal data is deleted unless retention is required for accounting or dispute resolution.

Purchase history for non-account orders is retained for three years.

In case of disputes regarding payments or consumer claims, personal data is stored until the matter is resolved or the statute of limitations expires.

Data required for accounting purposes is retained for seven years.

Requests for data deletion are processed within one month.

Requests for data transfer are handled within one month after verifying the identity of the requester.

Direct Marketing

Email addresses and phone numbers may be used for direct marketing if consent has been given. Opt-out is available via the link in the email or through customer support.

If personal data is processed for profiling in direct marketing, customers may object at any time by contacting customer support.

Dispute Resolution

For questions or complaints regarding the processing of personal data, contact [email protected].

Supervisory Authority:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)

Email: [email protected]
Website: [www.aki.ee](https://www.aki.ee)

Data controller

LONG MARKET OÜ (reg. code 17296134, Priisle tee 16-6, Tallinn). Data protection contact: [email protected], phone +372 612 22 22.

Frequently asked questions (FAQ)

What personal data does CyberMarket collect?

Name, phone, email, delivery address, bank account details, purchase history and customer-support data (including chat recordings).

What are my rights under GDPR?

Access, rectification, erasure ("right to be forgotten"), restriction, data portability, objection, and the right not to be subject to automated decisions. To exercise them, write to [email protected]; we reply within 30 days.

How do I withdraw consent or opt out of marketing?

Via the unsubscribe link in emails or through customer support. Cookie consent via the cookie banner and browser settings; in the iOS app via the App Tracking Transparency dialog.

How do I delete my data or account?

Delete your account directly in your profile or the mobile app, or write to [email protected]. Complaints: [email protected] or the Data Protection Inspectorate ([email protected]).

Last updated: 2026-07-17