Privacy Policy
1. General Provisions
This Privacy Policy explains how SM Online Group OÜ ("we," "us," "our"), operating the online store Cloud & Cottage (the "Store"), collects, uses, discloses, and protects the personal data of individuals who visit our website or purchase our products, in accordance with the EU General Data Protection Regulation (GDPR) and applicable Estonian law.
Data Controller:
SM Online Group OÜ
Registry number: 14498423
Address: Rähni tee 4, Kloogaranna, Estonia
Email: info@cloudandcottage.com
Phone: +372 56807724
2. What Personal Data We Collect
Depending on how you interact with our Store, we may collect:
When you place an order:
- Full name
- Delivery and billing address
- Email address
- Phone number
- Order details and purchase history
- Payment information (processed by our payment provider — we do not store full card details)
When you contact us:
- Name, email address, and the content of your message
Automatically, when you browse our website:
- IP address
- Browser and device information
- Pages visited, time spent, and click behaviour (via cookies/analytics tools)
If you subscribe to our newsletter:
- Email address, and name if provided
3. Purpose and Legal Basis for Processing
We process your personal data for the following purposes:
| Purpose | Legal Basis |
|---|---|
| Processing and fulfilling your order | Performance of a contract (Art. 6(1)(b) GDPR) |
| Issuing invoices and accounting records | Legal obligation (Art. 6(1)(c) GDPR) |
| Responding to customer inquiries | Legitimate interest / contract |
| Sending marketing emails or newsletters | Consent (Art. 6(1)(a) GDPR) |
| Website analytics and improving our Store | Legitimate interest / consent (for cookies) |
| Preventing fraud and ensuring security | Legitimate interest (Art. 6(1)(f) GDPR) |
4. Who We Share Your Data With
We share personal data only with trusted third parties who help us operate the Store, including:
- Payment provider: Montonio
- Delivery/courier partner: Omniva / DPD / SmartPosti
- Email/marketing platform: Mailchimp
- Analytics tools: Google Analytics / Meta Pixel
We do not sell your personal data to third parties. Some of these providers may process data outside the EU/EEA; in such cases we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses).
5. How Long We Keep Your Data
- Order and invoice data: retained for 7 years, as required by Estonian accounting law.
- Account data: retained for as long as your account is active, or until you request deletion.
- Marketing consent/newsletter data: retained until you unsubscribe.
- Website analytics data: retained according to the relevant tool's default retention settings (typically 14–26 months).
6. Cookies
Our website uses cookies to ensure core functionality, remember your preferences, and understand how visitors use our Store.
Types of cookies we use:
- Necessary cookies — required for the website and shopping cart to function
- Analytics cookies — help us understand visitor behaviour (e.g. Google Analytics)
- Marketing cookies — used for advertising purposes, if applicable
You can manage or withdraw your cookie consent at any time via the cookie banner on our website or through your browser settings.
7. Your Rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten"), where applicable
- Restrict processing of your data
- Object to processing based on legitimate interest or direct marketing
- Data portability — receive your data in a structured, machine-readable format
- Withdraw consent at any time, where processing is based on consent
To exercise any of these rights, contact us at info@cloudandcottage.com. We will respond within one month, as required by law.
You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at www.aki.ee if you believe your data has been processed unlawfully.
8. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, or alteration, including secure (HTTPS) connections, restricted access to personal data, and secure payment processing through certified third-party providers.
9. Children's Privacy
Our Store is not directed at children under the age of 16. We do not knowingly collect personal data from children.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.
11. Contact Us
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
SM Online Group OÜ
Rähni tee 4, Kloogaranna, Estonia
Email: info@cloudandcottage.com