🔒 PRIVACY POLICY
Centralsun OÜ (registration number 14887461, Pärnu mnt 102, 11312 Tallinn, Estonia) is the data controller of personal data processed through this website.
We are committed to protecting the privacy of our customers and website users and process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Estonian and European Union laws.
1. Collection of Personal Data
We may collect personal data in the following situations:
When you place an order in our online store
When you create a customer account
When you contact us
When you subscribe to our newsletter
Through the use of cookies on our website
The personal data collected may include:
First and last name
Email address
Phone number
Shipping address
Billing address
IP address
Order and payment information
2. Use of Personal Data
Personal data is used for the following purposes:
Processing and delivering orders
Processing payments
Providing customer support
Fulfilling legal and accounting obligations
Sending marketing communications (only with your consent)
3. Payment Providers and Data Sharing
To process payments, we use third-party payment service providers, including:
Stripe
PayPal
Klarna
Montonio (if applicable)
When making a payment, the necessary personal data is transferred to the respective payment provider for the purpose of completing the transaction. Payment processing is carried out via secure and encrypted connections.
4. Cookies, Analytics and Advertising Measurement
We use strictly necessary cookies to operate the website. Analytics and advertising measurement are used only in accordance with the choices you make in Cookie Settings. You can change or withdraw your consent at any time using the Cookie Settings control on this website. Withdrawal applies to future processing and does not affect processing carried out before withdrawal.
Google Analytics 4
With analytics consent, we use Google Analytics 4, provided by Google Ireland Limited, to understand website traffic, interactions and ecommerce performance. Google may receive online and device identifiers, browser and device information, page and referrer URLs, timestamps, approximate location derived from the IP address, and analytics or ecommerce events. Confirmed purchase events may also be sent securely from our server to improve measurement reliability. Our GA4 event-data retention setting is 14 months. When Google Consent Mode is used, limited cookieless technical signals may be sent while analytics or advertising consent is denied; analytics cookies and full measurement remain disabled until the relevant consent is granted.
Meta advertising measurement
With advertising consent, we use the Meta Pixel and Meta Conversions API, provided by Meta Platforms Ireland Limited, to measure advertising performance and attribute website actions such as product views, cart activity, checkout and purchases. Depending on the event, Meta may receive page and event information, product or order details, value and currency, Meta click or browser identifiers (_fbc and _fbp), a browser user-agent and a shared event ID used to prevent double counting between browser and server events. Our integration does not send names, email addresses or phone numbers to Meta, and sending the visitor’s IP address through the server integration is disabled.
OpenAI Ads conversion measurement
With advertising consent, we use the OpenAI Ads Conversions API to measure whether a confirmed purchase occurs after an interaction with an advertisement in ChatGPT and to evaluate campaign performance. This integration is server-side only; we do not load the OpenAI Ads browser Pixel. Depending on the event, OpenAI may receive the event type, time and unique event ID, a clean order-confirmation source URL, purchase value and currency, and the original OpenAI click reference (oppref) when it is available. Our integration does not send names, email addresses, phone numbers, IP addresses or browser user-agents to OpenAI.
Consent-linked advertising identifiers retained by our measurement bridge are deleted when delivery has reached a final state and in any event no later than eight days after the relevant paid order or consent capture. Google, Meta and OpenAI may process data through affiliates and service providers outside the European Economic Area using applicable safeguards. Further details about individual cookies, providers, purposes and durations are available through Cookie Settings.
5. Data Retention
Personal data is retained only for as long as necessary:
To fulfill orders
To comply with accounting and legal obligations
To resolve disputes
6. Your Rights
Under GDPR, you have the right to:
Access your personal data
Request correction of inaccurate data
Request deletion of your data
Restrict processing
Object to processing
Lodge a complaint with a supervisory authority
7. Data Security
We implement appropriate administrative, technical, and physical security measures to protect personal data against unauthorized access, disclosure, alteration, or destruction.
8. Changes to This Policy
We reserve the right to update this Privacy Policy when necessary. The latest version will always be published on this website.
9. Contact
If you have any questions regarding this Privacy Policy or the processing of personal data, please contact us at:
