1. General Provisions

1.1. This Privacy Policy governs the principles governing the collection, processing, and storage of personal data. Personal data is collected, processed, and stored by the data controller, BFL COMPANY OÜ (hereinafter referred to as the “Data Controller”).

1.2. For the purposes of this Privacy Policy, a data subject is a customer or other natural person whose personal data is processed by the data controller.

1.3. For the purposes of this Privacy Policy, a “Customer” means any person who purchases goods or services from the Data Controller’s online store.

1.4. The data processor processes personal data lawfully, fairly, and securely in accordance with applicable laws and regulations.

2. Collection, Processing, and Storage of Personal Data

2.1. Personal data is collected electronically, primarily through the website and email.

2.2. By providing their data, the data subject grants the data controller the right to collect, use, and manage such data in accordance with the purposes set forth in this policy.

2.3. The data subject is responsible for the accuracy of the data provided and is required to notify the data controller of any changes to such data.

2.4. The data processor shall not be liable for any damages resulting from the provision of false information.

3. Processing of Customers' Personal Data

3.1. Personal data processed:

• First name and last name

• Phone number

• Email address

• Shipping address

3.2. The data processor may also use information available in public registers.

3.3. Legal basis: Article 6(1)(a), (b), (c), and (f) of the GDPR.

3.4. Purposes of processing and retention periods:

• Safety and Security – in accordance with the law

• Order processing – up to 10 years

• Marketing – up to 10 years

3.5. Data may be disclosed to third parties (e.g., accountants, couriers, payment service providers). Data necessary for processing payments is disclosed to an authorized processor (e.g., Maksekeskus AS).

3.6. Organizational and technical measures are used to protect personal data.

3.7. Personal data will be retained for up to 10 years or until the deadline specified by law.

4. Rights of the data subject

4.1. The right to access your personal data.

4.2. The right to obtain information regarding the processing of personal data.

4.3. The right to correct inaccurate data.

4.4. The right to withdraw consent when processing is based on consent.

4.5. To exercise your rights, please contact us by email: info@battleforlife.ee

4.6. Right to File a Complaint to the Data Protection Inspectorate.

5. Final Provisions

5.1. These Terms and Conditions comply with the EU General Data Protection Regulation (GDPR) and Estonian law.

5.2. The data controller reserves the right to amend this privacy policy. Any changes will be posted on the website www.battleforlife.ee.