Privacy policy
Last updated: 6 October 2026
This privacy policy explains how the H Market online store (“H Market”, “we”) collects, uses and protects your personal data. We process data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Estonian Personal Data Protection Act.
1. Controller
| Company | Black Bean Advertising Agency OÜ |
|---|---|
| Registry code | 17136809 |
| Address | Pirni 7/2, Tallinn, Estonia |
| info@hmarket.ee |
2. What data we collect
- Order data: first and last name, email, phone number, delivery address or chosen parcel locker, products ordered, amount, payment method and order history.
- Payment data: payment status and transaction reference. We never see or store card or bank account details — payments are processed by ESTO.
- Communication: emails and product enquiries (name, email, phone, message) you send us. Enquiries are kept in our customer management system for up to 24 months.
- Technical data: server logs (IP address, browser type, time of visit) kept briefly for security purposes.
3. Why and on what basis we process data
| Purpose | Legal basis |
|---|---|
| Accepting, fulfilling and delivering orders; customer communication | Performance of a contract (GDPR Art. 6(1)(b)) |
| Processing payments and offering hire purchase / pay in 3 | Performance of a contract (Art. 6(1)(b)) |
| Accounting and keeping invoices | Legal obligation (Art. 6(1)(c), Estonian Accounting Act) |
| Handling warranty, returns and complaints | Contract and legal obligation (Law of Obligations Act) |
| Website security and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
We do not use your data for automated decision-making and we never sell it. We only send marketing newsletters with your separate consent.
4. Who we share data with
- ESTO AS — payment provider (bank link, pay in 3, hire purchase, pay later). For hire purchase and instalments ESTO makes the credit decision as an independent controller under its own privacy terms (esto.ee).
- Banks — for bank link payments.
- Couriers and parcel locker operators (e.g. Omniva, DPD) — name, phone, email and address to deliver your order.
- Suppliers and manufacturers — where needed to fulfil the order or handle a warranty claim.
- IT service providers — hosting and email, processing data on our instructions.
- Authorities — where required by law.
Data is processed within the European Economic Area. If a provider is located outside the EEA, we safeguard your data with the European Commission’s standard contractual clauses.
5. How long we keep data
- Order and invoice data — 7 years (Accounting Act).
- Warranty and complaint data — until claims expire (generally 3 years).
- Server logs — up to 90 days.
6. Cookies and browser storage
H Market does not use advertising or tracking cookies. We only use your browser’s local storage (localStorage) to remember your bag, recently viewed products and, if you choose, your checkout contact details. This data stays on your device and you can delete it in your browser settings at any time. We also collect anonymous visit statistics (page and product view counts, traffic source) without cookies or personal data — it is never linked to any individual.
7. Your rights
You have the right to access your data; to have inaccurate data corrected; to have your data erased (unless we are legally required to keep it); to restrict processing; to object to processing based on legitimate interest; to data portability; and to withdraw consent at any time.
To exercise your rights, email info@hmarket.ee. We will respond within one month.
If you believe your rights have been violated, you may contact the Estonian Data Protection Inspectorate (www.aki.ee, Tatari 39, Tallinn).
8. Security
The website uses an encrypted HTTPS connection. Order data is accessible only to authorised persons through a password-protected admin area.
9. Changes
We may update this policy. The current version is always on this page with the date of the last update.