1. Nebeas OÜ as a personal data controller

1.1 The personal data controller is Nebeas OÜ, address Tornimäe 7, Tallinn, Estonia, registry code 16892868, e-mail: [email protected].

2. On what legal grounds does Nebeas process your personal data?

2.1 With your consent

• This means that you have given Nebeas your consent to process your personal data. You can withdraw your consent at any time, but the withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. You can withdraw consent for cookies in the cookie settings on the website.

2.2 Under contract

• This means that processing is necessary for the performance of a contract between you and Nebeas, or for taking steps at your request prior to entering into a contract, within the scope of the rights and obligations arising from that contract.

2.3 By law

• This means that Nebeas processes personal data to fulfill legal obligations (e.g., age verification based on identity documents, responding to requests from public authorities to the extent and in cases permitted by law).

2.4 Legitimate interest

• This means that Nebeas processes personal data for its legitimate interests, notably for protecting its property and persons, promoting its business activities, offering better products and services to customers, developing and improving its services, ensuring the security of its data and information, and defending itself in legal disputes. Nebeas processes personal data on this basis only if such processing does not override the interests, rights, and freedoms of the data subject that require protection.

3. From which sources does Nebeas obtain your personal data?

3.1 Your interactions with Nebeas

• Nebeas collects personal data primarily from you through applications, forms, correspondence, calls, video calls, screen sharing, etc.

3.2 Additional sources

• Data also arise when you make payments, visit Nebeas's websites, use services, enter into contracts, follow Nebeas on social media and comment on published content, contact Nebeas's customer service, etc.

3.3 Cookies and tracking technologies

• A cookie is a small text file that, when connected to a website, is stored in your browser. When we refer to cookies in this policy, other similar technologies and tools that collect and store information in your browser are included and, in some cases, they transfer such information to third parties. Examples include pixels, local storage, session storage and fingerprinting.

• We use the following categories of cookies: essential cookies, which are necessary for core website functionality such as session management; analytics cookies, which collect anonymous usage data to help us improve site performance and user experience; marketing cookies, which track visits across websites to tailor advertising content to your interests; and third-party cookies, which are placed by our partners, such as analytics or advertising service providers, and are subject to their own privacy policies.

• Data collected may include device identifiers, IP address, browser and operating system, pages visited, time stamps, click paths, etc.

• Retention periods vary by category: session cookies expire when you close your browser; persistent cookies last up to 24 months but may be renewed if you revisit the site.

• If you disable all cookies in your browser settings, the operation and functionality of our website may be disrupted for you, since certain site features depend on the use of cookies. Therefore, blocking cookies may cause errors in our website's services and some essential functions may not work.

• The legal basis for essential cookies is Nebeas's legitimate interest in ensuring core website functionality, whereas analytics and marketing cookies rely on your prior, informed consent, which you may grant or withdraw at any time via your browser's privacy settings or developer tools (e.g., by disabling cookies in the browser's inspect or network settings).

• To manage or withdraw consent, adjust your browser's cookie preferences or developer settings (e.g., disable cookies via the browser's inspect or network tools).

4. What data does Nebeas process and for what purposes?

4.1 Principle

• Nebeas applies the principle of data minimisation, meaning we process only the data and to the extent necessary to achieve the specific purpose.

4.2 The processing purposes are as follows:

• offering discounts and benefits;

• processing payments;

• maintaining purchase history;

• identifying individuals for service provision and for interactions with Nebeas's websites and services;

• customer communications and complaint resolution;

• providing personalized services and similar products (profiling and automated processing);

• protecting Nebeas's property (debt management, prevention and investigation of theft, fraud and other violations or accidents, handling legal claims);

• improving and developing Nebeas's business activities.

5. How long does Nebeas process your personal data?

5.1 Duration of processing

• Nebeas processes your personal data from the start and throughout the customer relationship, principally when you visit Nebeas websites. We process your data as long as necessary to fulfill the customer relationship or similar relationship between you and Nebeas, or until you withdraw consent, or for legal purposes until statutory deadlines expire.

6. Profiling

6.1 Profiling of your data

• Nebeas may use personal data (e.g., gender, residence, age) and statistical data on your use of services and websites (e.g., location, technical device information, visit frequency, preferred payment method) to conduct profile analysis, better understand your expectations, and offer you suitable goods and services (best offers, discounts, personalized offers based on your past choices, etc.).

7. Recipients of your data

7.1 In certain cases, Nebeas must transfer your personal data to third parties. Service providers processing data on behalf of Nebeas may use your personal data only to the extent necessary to provide the agreed service. Such partners include, among others:

• various subcontractors;

• ICT service providers (including software maintenance and support);

• debt collection service providers;

• accounting service providers.

7.2 Public authorities and supervisory bodies to whom Nebeas discloses your personal data only when required by law, are for example the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), courts, etc.

7.3 Transfer of data outside the European Economic Area

• Nebeas does not transfer your personal data outside of Estonia, the European Union, or the European Economic Area, nor to any third country or international organization whose level of data protection has not been deemed adequate by the European Commission. If such a transfer becomes necessary, it will only take place on an appropriate legal basis, and Nebeas will implement suitable safeguards.

8. Your rights regarding the processing of your personal data

8.1 Right of access

• You have the right to know if your personal data is being processed, the purposes of processing, the categories of data concerned, to whom the data are disclosed (specifically categories of recipients under this privacy policy), how long the data are retained, and your rights regarding correction, erasure, and restriction of processing.

8.2 Right to rectification

• You have the right to request correction of your personal data if it is inaccurate or incomplete.

8.3 Right to erasure

• In certain cases, you have the right to request that we delete your personal data, for example if you withdraw consent and there is no other legal basis for processing.

8.4 Right to restriction of processing

• In certain cases, you have the right to restrict processing of your personal data for a period (e.g., if you have objected to processing).

8.5 Right to object

• You have the right to object to processing based on Nebeas's legitimate interest. Upon objection, Nebeas must cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

8.6 Exercise of rights

• Nebeas will respond to your request within 30 days of receipt. Nebeas may refuse your request if your identity cannot be verified, or if requests are manifestly unfounded, excessive (especially repetitive), or vague. Nebeas may refuse requests for restriction or erasure if processing is required by a valid contract, law, or for legal claims or protection of persons and property. In case of refusal, Nebeas will inform you of the reasons within 30 days. All requests must be sent to [email protected].