Last updated: 11 June 2026
This Privacy Policy explains how Mervantis OÜ (“we”, “us”), operator of sumeos.com, processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and the UK GDPR.
1. Data controller
| Store | Sumeos — sumeos.com |
|---|---|
| Operated by | Mervantis OÜ |
| Registry code | 14412321 (Estonian Business Register) |
| VAT number | EE102319631 |
| Registered office | Asuvere tee 7-4, Tihemetsa alevik, 86201 Saarde vald, Pärnu maakond, Estonia |
| [email protected] | |
| Phone | Available on request via email (anti-spam policy) |
For any privacy matter, contact [email protected].
2. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, delivery address, email, phone (optional) | Processing and delivering your order; returns and warranty service | Contract (Art. 6(1)(b)) | While your account/orders are active; accounting source documents 7 years (Estonian Accounting Act) |
| Order history, payment status (never full card numbers) | Order management, fraud prevention | Contract; legitimate interest (Art. 6(1)(f)) | As above |
| Account credentials | Operating your customer account | Contract | Until account deletion |
| Email address (newsletter) | Sending our newsletter | Consent (Art. 6(1)(a)) — withdraw any time via the unsubscribe link | Until you unsubscribe |
| Support correspondence | Answering questions, handling complaints | Contract; legitimate interest | 3 years after the case closes |
| Cookies / usage data (analytics, marketing) | Statistics, advertising measurement | Consent — collected only after you opt in via the cookie banner | See Cookie Policy |
3. Who receives your data
We share personal data only as needed to run the Store:
- Fulfilment: Hertwill OÜ (Estonia) — our fulfilment partner — receives your name, delivery address, email/phone and ordered items strictly to pack and ship your order, together with the carriers they use (DPD, DHL, Omniva, PostNord, Posti, UPS, FedEx among others).
- Payments: Stripe Payments Europe Ltd, PayPal (Europe) S.à r.l. et Cie S.C.A., and our bank for SEPA transfers. They process your payment data as independent controllers under their own privacy policies.
- IT & security: our servers are located in the EU; Cloudflare, Inc. provides CDN/security services (EU‑US Data Privacy Framework and SCCs apply to any transfer).
- Marketing & analytics (only with your consent): Google Ireland Ltd (Analytics 4, Ads) and Meta Platforms Ireland Ltd (Meta Pixel). Where data leaves the EEA, transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
- Authorities, where the law requires (e.g. tax authorities).
We never sell personal data.
4. International transfers
Data is stored in the European Union. Where a processor transfers data outside the EEA/UK (e.g. Google, Meta, Cloudflare), the transfer is protected by an adequacy decision (EU–US Data Privacy Framework) or Standard Contractual Clauses with supplementary measures.
5. Your rights
You may at any time request: access to your data; rectification; erasure; restriction of processing; portability; and you may object to processing based on legitimate interest, including direct marketing. Where processing is based on consent, you may withdraw it at any time without affecting prior processing. Write to [email protected] — we answer within 30 days.
You also have the right to lodge a complaint with a supervisory authority: in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee); in the UK, the Information Commissioner’s Office (ico.org.uk); or the authority of your home country.
6. Security
All traffic is encrypted (TLS). Access to order data is restricted and logged; payment card data never touches our servers. We apply the principle of data minimisation throughout.
7. Children
The Store is not directed at children under 16 and we do not knowingly collect their data.
8. Automated decision-making
We do not use automated decision-making or profiling producing legal effects. Anti-fraud screening by payment providers may apply under their own policies.
9. Changes
We will publish any changes to this policy on this page; material changes will be highlighted in the Store or by email where appropriate.