Privacy Policy

This Privacy Policy describes how Orbivex OÜ, the operator of www.truviek.com, collects, uses, shares, stores, and protects personal information when you visit the Site, place or manage an order, communicate with customer support, or otherwise interact with our online services. For personal data for which we determine the purposes and means of processing, Orbivex OÜ generally acts as the data controller.

1. Who is responsible for your information

Orbivex OÜ is the company responsible for operating www.truviek.com. Our registered address is Narva mnt 7-557, Kesklinna linnaosa, Tallinn, Harju maakond, 10117, Estonia. For most personal information collected directly through the Site, we act as the controller under applicable data-protection law. You can contact us about privacy matters at support@truviek.com.

2. Categories of personal information we may collect

The information we collect depends on how you use the Site and which services you request. It may include:

• your name and contact information, including email address and telephone number;

• billing details and the address provided for delivery or fulfilment;

• order information, selected products, transaction references, account history, returns, complaints, and customer-support records;

• payment confirmation or transaction-status information received from payment processors, without us intentionally storing complete card credentials on our website systems;

• technical information such as IP address, browser type, device characteristics, approximate location, log information, and data about how the Site is used;

• marketing preferences, subscription choices, consent records, and cookie or tracking preferences; and

• information you choose to provide in web forms, emails, attachments, complaints, reviews, or messages to customer support.

3. Purposes for which we use personal information

We may process personal information where reasonably necessary for the operation of the store and our relationship with customers. Typical purposes include:

• receiving, verifying, processing, confirming, fulfilling, and delivering orders;

• providing customer assistance and responding to questions, requests, complaints, or other communications;

• handling cancellations, returns, refunds, replacement requests, warranty-related issues, and disputes;

• detecting, investigating, and preventing fraud, payment abuse, security incidents, unauthorised activity, or misuse of the Site;

• maintaining the security, availability, reliability, and performance of the Site and improving the customer experience;

• meeting legal, tax, accounting, record-keeping, consumer-protection, and other regulatory obligations; and

• sending marketing communications when permitted by law, including where consent is required and has been provided.

4. Legal bases for processing under the GDPR

Where Regulation (EU) 2016/679 (GDPR) applies, the legal basis depends on the particular activity. We may process data because it is necessary to perform a contract or take steps requested before a contract, because we must comply with a legal obligation, because we or another party have a legitimate interest that is not overridden by your rights, or because you have given consent. For example, order fulfilment generally relies on contractual necessity; accounting records may be retained to meet legal obligations; fraud prevention and Site security may rely on legitimate interests; and optional marketing or non-essential cookies may rely on consent where consent is required.

5. Service providers and other recipients

We may provide personal information to carefully selected service providers where they need the information to perform services for us or support a transaction. Depending on the order and the systems we use, recipients can include payment processors, banks or payment partners, product suppliers, shipping and fulfilment companies, couriers, postal operators, hosting providers, analytics services, email platforms, customer-support systems, IT providers, tax advisers, accountants, legal advisers, and other professional advisers. We aim to limit the information shared to what is reasonably necessary for the relevant purpose and to use appropriate contractual or legal protections where required.

6. International transfers

Some suppliers, service providers, technology vendors, or fulfilment partners may process personal information outside Estonia or outside the European Economic Area (EEA). Where data-protection law requires safeguards for an international transfer, we will use an appropriate mechanism, which may include adequacy decisions, standard contractual clauses, or other recognised contractual and organisational protections. The safeguards used can depend on the recipient, destination country, and nature of the processing.

7. Cookies and similar technologies

The Site may use cookies and comparable technologies for purposes such as keeping essential functions working, remembering user preferences, measuring performance, understanding how visitors navigate the Site, supporting analytics, and enabling advertising or marketing activities. Where the law requires prior permission for a non-essential cookie or similar technology, we will request consent before using it. You may also be able to manage certain preferences through the Site’s cookie controls or your browser settings.

8. Retention of personal information

We keep personal information only for as long as reasonably needed for the purpose for which it was collected and for any related legal or legitimate requirement. Relevant purposes can include order fulfilment, customer support, returns, complaints, accounting, tax compliance, fraud prevention, security, dispute resolution, and establishing or defending legal claims. Different categories of records may therefore have different retention periods, and a statutory retention obligation may require some information to be kept longer than ordinary customer-service records.

9. Your privacy and data-protection rights

Depending on your location and the law that applies, you may have rights to request access to personal data, correction of inaccurate information, deletion, restriction of processing, objection to certain processing, and data portability. Where processing is based on consent, you may also be able to withdraw that consent without affecting the lawfulness of earlier processing. You may have the right to complain to a competent data-protection authority. To make a request to us, contact support@truviek.com. We may need to verify your identity before completing a request where verification is reasonably necessary to protect personal information.

10. Marketing messages

If you receive promotional or marketing email from us, you can use the unsubscribe mechanism included in the message or contact us to change your preference. Opting out of marketing does not necessarily stop operational communications that are required for an existing transaction or account, such as messages about an order, payment, delivery, return, refund, security issue, or other service-related matter.

11. Information security

We use reasonable technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, misuse, alteration, or disclosure. The measures used may vary according to the system and the sensitivity of the information. Despite these efforts, no website, payment network, internet transmission, or electronic storage method can be guaranteed to be completely secure, so we cannot promise absolute security.

12. Children

The Site is not intended for children under the age of sixteen (16), and we do not knowingly seek to collect personal information from children in that age group. If you believe that a child has submitted personal information to us in circumstances where it should not have been collected, contact us so that we can review the matter and take appropriate action.

13. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, suppliers, legal obligations, or privacy practices. The most current version will be published on the Site, and an updated date may be displayed when material revisions are made. We encourage users to review the Policy periodically if they want to understand our current privacy practices.

14. Supervisory authority

For matters within its competence, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) is Estonia’s national data-protection supervisory authority. Information for individuals, including information on making a complaint, is available at https://www.aki.ee/en. Depending on the GDPR rules that apply to your situation, you may also be entitled to approach the supervisory authority in another relevant EEA country.

Contact details