Effective from 08.10.2026.
Controller
KanEd OÜ, registry code 14542199, Kooli põik 1-6, 20104 Narva, Estonia, [email protected], phone +372 5586766. We process personal data in line with the GDPR and the Estonian Personal Data Protection Act.
Data we process
Contact and order data (name, e-mail, phone, delivery/billing address, company and VAT number for B2B, order history); payment data (amount, time, status and method; for PayPal payments also the PayPal transaction ID and payer e-mail reported by PayPal – PayPal account and online-banking data stay with PayPal or your bank); vehicle/technical data where needed for compatibility, licence activation or services (e.g. make, model, engine, VIN, ECU data); account data; correspondence; technical data (IP address, browser/device data, cookies).
Purposes and legal bases
Order processing, delivery, customer service, complaints and withdrawals — contract (Art. 6(1)(b)); accounting — legal obligation (6(1)(c)); security, fraud prevention, legal claims — legitimate interest (6(1)(f)); newsletter and non-essential cookies — consent (6(1)(a)).
Recipients
Carriers AS Eesti Post (Omniva), DPD Eesti AS, Smartpost Eesti AS (SmartPosti), depending on the delivery method; payment providers: our bank (bank transfer), and – if you choose PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, which receives the order amount, order number and your contact and delivery details to process the payment and acts as an independent controller under its own privacy statement; hosting: FREAKHOSTING LTD (server in Frankfurt, Germany, EU); e-mail: Cloudflare, Inc. (inbound e-mail routing) and SMTP2GO (outbound e-mail delivery); accounting service provider and accounting software; manufacturers/licensors where needed for device registration, licence activation or warranty claims; authorities where required by law. Transfers outside the EEA take place only with appropriate safeguards (adequacy decision, e.g. the EU-US Data Privacy Framework for Cloudflare, Inc., or standard contractual clauses).
Retention
Accounting records 7 years from the end of the financial year; order and customer correspondence until claims expire, generally 3 years; account data until the account is deleted; marketing consent until withdrawn; server logs up to 30 days.
Your rights
Access, rectification, erasure, restriction, objection, data portability and withdrawal of consent. Write to [email protected] — we reply within one month. You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, https://www.aki.ee, [email protected]).
Cookies
We use necessary cookies for the cart, checkout, login and language choice (WooCommerce, WordPress). WooCommerce order-attribution tracking (sbjs_* cookies) is switched off and these cookies are not used. No analytics or marketing cookies are used at present; if added, we will ask for consent first.
Other
No automated decision-making or profiling with legal effects. We use HTTPS, access controls, backups and regular updates. This policy may be updated; the current version is always published here.