General Provisions

This privacy policy governs the principles for the collection, processing, and storage of personal data. Personal data is collected, processed, and stored by the data controller, Masina 20 Kohvimaja OÜ (hereinafter, the data processor).

A data subject, within the meaning of this privacy policy, is a customer or other natural person whose personal data is processed by the data processor.

A customer, within the meaning of this privacy policy, is anyone who purchases goods or services from the data processor's website.

The data processor complies with the data processing principles set out in legislation, and among other things processes personal data lawfully, fairly, and securely. The data processor is able to confirm that personal data has been processed in accordance with the applicable legislation.

Collection, Processing, and Storage of Personal Data

EU, EEA, UK & Switzerland:

No data is collected until the data subject consents to cookies. If the data subject declines or does not confirm cookies, no data is collected, except where the data subject has submitted an order or attempted to submit an order, in which case the order information entered by the data subject is retained (name, address, payment card details, email address, and phone number).

The personal data collected, processed, and stored by the data processor is collected electronically, primarily via the website and email.

By sharing their personal data, the data subject grants the data processor the right to collect, organize, use, and manage, for the purposes defined in this privacy policy, the personal data that the data subject shares with the data processor directly or indirectly when purchasing goods or services on the website.

The data subject is responsible for ensuring that the data they provide is accurate, correct, and complete. Knowingly providing false information is considered a violation of this privacy policy. The data subject is obligated to promptly notify the data processor of any changes to the data provided.

The data processor is not liable for any damage caused to the data subject or third parties as a result of the data subject providing false information.

When visiting the website, the data processor collects information about the device, browser type, IP address, time zone, and certain cookies previously downloaded to the device. In addition, the data processor collects information about browsing on the website, products viewed, search terms used, and other information about website usage. This information is categorized as "Device Information."

The data processor collects Device Information in the following ways:

"Cookies" are data files placed on your device or computer, which often contain an anonymous unique identifier. For more information about cookies and how to disable them, visit http://www.allaboutcookies.org.

"Log files" track actions occurring on the website and collect data, including IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.

When the data subject submits an order on the website, or attempts to submit an order, the data processor collects the information entered by the data subject: name, address, payment card details, email address, and phone number. This information is categorized as "Order Information."

In this privacy policy, both "Device Information" and "Order Information" are referred to as "Personal Data."

Cookies and Analytics

The data processor uses the following analytics and marketing tools on the website, which require the data subject's consent in accordance with the preferences selected in the cookie banner:

Google Analytics — used to analyze website usage statistics and traffic. More information: https://policies.google.com/privacy

Google Ads — used to measure advertising performance and display targeted advertising. More information: https://policies.google.com/privacy

Meta Ads (Facebook/Instagram) — the online store is synced with the Meta product catalog, and a Meta pixel is used to track website visits, viewed products, and purchases in order to display targeted advertising. More information: https://www.facebook.com/privacy/policy/

These tools are used only if the data subject has given consent via the cookie banner.

Processing and Sharing of Customers' Personal Data

The data processor may process the following personal data of the data subject:

First and last name;

Date of birth;

Phone number;

Email address;

Delivery address;

Bank account number;

Payment card details;

In addition to the above, the data processor has the right to collect data about the customer that is available in public registers.

The legal basis for processing personal data is Article 6(1)(a), (b), (c), and (f) of the General Data Protection Regulation:

a) the data subject has given consent to the processing of their personal data for one or more specific purposes;

b) the processing of personal data is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;

c) the processing of personal data is necessary for compliance with a legal obligation to which the data controller is subject;

f) the processing of personal data is necessary for the purposes of the legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Processing of personal data according to the purpose of processing:

Purpose of processing – security and safety

Maximum storage period for personal data – in accordance with the deadlines specified by law

Purpose of processing – order processing

Maximum storage period for personal data – 10 years

Purpose of processing – ensuring the functioning of e-shop services

Maximum storage period for personal data – 10 years

Purpose of processing – customer management

Maximum storage period for personal data – 10 years

Purpose of processing – financial activities, accounting

Maximum storage period for personal data – in accordance with the deadlines specified by law

Purpose of processing – marketing

Maximum storage period for personal data – 10 years

The data processor has the right to share customers' personal data with third parties, such as authorized data processors, accountants, transport and courier companies, and payment service providers. The data processor is the controller of personal data. The data processor transmits the personal data necessary for processing payments to the authorized processor Montonio Finance OÜ.

When processing and storing the data subject's personal data, the data processor applies organizational and technical measures that ensure the protection of personal data against accidental or unlawful destruction, alteration, disclosure, and any other unlawful processing.

The data processor stores data subjects' data depending on the purpose of processing, but for no longer than 10 years.

The data processor shares the data subject's data with the following third parties:

Shopify, the e-shop platform – more information on how Shopify processes personal data: https://www.shopify.com/legal/privacy.

Montonio, payment and delivery services platform — facilitates payments and delivery options. The data subject's data is shared when placing an order and arranging delivery. Data shared: first and last name; phone number; email address; delivery address; payment card/bank account details. More information: https://montonio.com/privacy-policy

Omniva, DPD, Smartpost — courier services used if the data subject chooses one of these delivery partners via Montonio or directly. Data shared: first and last name; phone number; email address; delivery/parcel locker address.

Omniva: https://www.omniva.ee/era/privaatsustingimused

DPD: https://www.dpd.com/ee/et/privaatsuspoliitika/

Smartpost (Itella/SmartPOST): https://smartpost.ee/privaatsustingimused/

FORSBERG+two (Order Printer Pro), invoicing platform — data shared: first and last name; phone number; email address; delivery address; bank account number. More information: https://www.forsbergplustwo.com/pages/privacy-policy

Klaviyo, marketing and newsletters — data shared: first and last name; phone number; email address; delivery address; order history; device information. More information: https://www.klaviyo.com/legal/privacy-policy

Google (Analytics, Ads) — data shared: device information, website usage statistics. More information: https://policies.google.com/privacy

Meta (Facebook/Instagram) — data shared: device information, product views, purchase data (via pixel), product catalog. More information: https://www.facebook.com/privacy/policy/

Pulsev (Parcely), courier services platform — the data subject's data is shared only when placing an order. Data shared: first and last name; phone number; email address; delivery address. More information on how Parcely processes personal data: https://www.parcely.app/privacy-policy/.

FORSBERG+two (Order Printer Pro), invoicing platform, data shared: first and last name; phone number; email address; delivery address; bank account number — more information on how Order Printer Pro processes personal data: https://www.forsbergplustwo.com/pages/privacy-policy.

The data processor uses the payment processing provider Montonio Finance OÜ. More information on how Montonio processes personal data: https://www.montonio.com/legal/privacy-policy.

Finally, we may also share the data subject's personal data in order to comply with applicable laws and regulations, respond to a subpoena, search warrant, or other lawful request for information, or otherwise protect our rights.

Direct Marketing

When a data subject signs up for the newsletter, device information and order information is shared with the newsletter platform, Klaviyo. Klaviyo's privacy policy: https://www.klaviyo.com/legal/privacy-policy.

The newsletter is sent only to customers who have given consent to receive it, in such a way that with each marketing communication it is possible to unsubscribe via a link in the newsletter email by clicking "Unsubscribe." You can unsubscribe from the newsletter at any time in the following ways:

Klaviyo – by clicking "Unsubscribe" at the end of a marketing email

By writing to the email address info@papermill.coffee

By sending a letter to the address:

Paper Mill, Masina 20 Kohvimaja OÜ

Masina 20, 10144 Tallinn, Estonia

Rights of the Data Subject

The data subject has the right to access and review their personal data.

The data subject has the right to receive information about the processing of their personal data.

The data subject has the right to supplement or correct inaccurate data.

If the data processor processes the data subject's personal data on the basis of consent, the data subject has the right to withdraw that consent at any time.

To exercise their rights, the data subject can contact the e-shop's customer support at info@papermill.coffee.

The data subject has the right to lodge a complaint with the Estonian Data Protection Inspectorate to protect their rights.

Final Provisions

These data protection terms have been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the Personal Data Protection Act of the Republic of Estonia, and the legislation of the Republic of Estonia and the European Union.

The data processor has the right to amend the data protection terms in part or in full, notifying data subjects of any changes via the website http://papermill.coffee/.

Masina 20 Kohvimaja OÜ is the controller of personal data. Masina 20 Kohvimaja OÜ transmits the personal data necessary for processing payments to the authorized processor Montonio Finance OÜ.

Contact

For questions or complaints, please contact us by email:

Info@papermill.coffee

Or by mail:

Paper Mill, Masina 20 Kohvimaja OÜ

Masina 20, 10144 Tallinn, Estonia

Last updated 07.09.2026