Privacy Policy and Data Protection Estonia
This Privacy Policy describes how Zeppik, available at zeppik.ee, collects, processes, and protects personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Estonian data protection laws.
1. Data Controller
Controller: Kosmetoloog OÜ, registration number 12374007. For data and consent withdrawal enquiries, use Support chat. You may also complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon (aki.ee).
2. Categories of Personal Data
2.1 Data Provided by Users
- First and last name
- Email address
- Phone number
- Profile information
- Listing content
- Store information
- User messages
- Payment information (via payment providers)
2.2 Automatically Collected Data
- IP address
- Device type
- Browser information
- Operating system
- Location data (IP-based)
- Log files
- Cookies
3. Purpose of Processing
- Account registration and management
- Publishing listings
- Secure transaction processing
- Payment handling
- Fraud prevention
- Platform improvement
- Legal compliance
4. Legal Basis (GDPR Article 6)
- Performance of a contract
- User consent
- Legitimate interest
- Legal obligation
5. Data Sharing
Personal data may be shared with:
- Payment providers
- Hosting providers
- IT service partners
- Public authorities where legally required
We do not sell personal data to third parties.
6. International Data Transfers
Transferring personal data outside the EEA requires a basis and safeguards provided by the GDPR. Cookie consent does not replace these requirements. Request information about recipients, processing countries and applicable safeguards via Support chat. Do not send personal data through the AI generator.
7. Data Retention
Personal data is retained:
- While the account remains active
- As required by applicable law
- For legitimate interests such as fraud prevention
8. Data Subject Rights
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction
- Right to data portability
- Right to lodge a complaint with the Estonian Data Protection Inspectorate
9. Security Measures
We implement appropriate technical and organizational measures including:
- SSL/TLS encryption
- Access control restrictions
- Security monitoring
- Fraud prevention systems
10. Automated Decision-Making
Listing recommendations use category, region, publication order and paid promotion; they are not credit decisions. The credit calculator displays a calculation; the lender makes the decision. Contact support to request a review or make a complaint.
11. Cookies
Cookies and AI use
Choices last 180 days. We ask again when connected services change materially. Continuing to browse does not mean consent.
Controller: Kosmetoloog OÜ, registration number 12374007. For data and consent withdrawal enquiries, use Support chat. You may also complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon (aki.ee).
What is stored
PHPSESSID — until the browser closes; user-session-id — up to 30 days for the basket and request checks; geo — 30 days for the chosen region; token-auth / dashboard-token-auth — for the sign-in period. Temporary sessionStorage may hold the return address after sign-in.
zeppik.viewed.v1.* and zeppik_recent_* — history for up to 180 days with personalization enabled; zeppik.favorites.historyAfter.v1.* and zeppik_history_clear_* — history hiding preferences. Plyr stores player preferences only with personalization enabled.
zeppik_consent_v1 — signed choices and a receipt number for 180 days. A record of the choice, not linked to an account and without IP address, query text or browser fingerprint, is kept on the server for up to 13 months to demonstrate consent.
Connected external trackers
No external analytics or advertising trackers are currently configured.
Maps, payments and delivery contact their providers when you use the relevant feature. Rejecting optional cookies does not prevent processing necessary for a service you request. Service information and terms are shown in the relevant interface.
Withdrawal stops new requests and removes optional cookies accessible to this site. If an external tracker has already loaded, the page will reload — save completed forms first.
Use of AI
The description generator uses GigaChat (Sber, Russia). Clicking generate sends your input text to that provider. Do not enter personal data, correspondence, documents or trade secrets. AI can make mistakes: check facts, prices, specifications and content rights before use. Cookie consent is not consent to send text to AI.
Listing recommendations use category, region, publication order and paid promotion; they are not credit decisions. The credit calculator displays a calculation; the lender makes the decision. Contact support to request a review or make a complaint.
12. Policy Updates
This policy may be updated when services or legislation change. Continuing to use the site does not mean consent. If optional processing changes, we will ask for a new choice.
You can withdraw consent in cookie settings as easily as you grant it. Withdrawal does not affect the lawfulness of earlier processing. For access, correction, deletion, restriction, objection or data portability, use Support chat.