+37257431807info@digilema.com
Cart(0)

Privacy policy

Last updated: 16 October 2026

This Privacy policy explains how we process personal data when you visit digilema.de, contact us or place an order. It applies to the German and English versions of our shop.

1. Controller and contact details

Gelardo OÜ
Jõe tn 9, 10151 Tallinn, Estonia
Email: info@digilema.com
Telephone: +372 5743 1807

You can also use these contact details for privacy questions and to exercise your rights.

2. Visiting the shop, hosting and security

When you access the shop, we process technically necessary data, including your IP address, date and time, requested page or file, response status and information sent by your browser about the browser, operating system and referring page. We use these data to deliver the shop, resolve technical faults and protect against misuse. Recipients are our hosting, data-centre and technical operations providers to the extent that they need the data to operate and secure the service.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is a secure and functioning online shop. Web-server logs are regularly rotated and normally retained for approximately 15 days. Relevant entries may be retained longer when necessary to investigate a security incident or specific fault, or to establish, exercise or defend legal claims.

3. Enquiries and communication

If you contact us, we process your contact details, message and any relevant order information. Forms using an email function open your email application; the message is only sent when you send it there. We use email and communication providers, including Google Workspace, which may process message content and technical communication data.

For enquiries about a purchase or order, the legal basis is Article 6(1)(b) GDPR. Other enquiries are handled under Article 6(1)(f) GDPR on the basis of our legitimate interest in answering messages. We retain correspondence while it is needed to handle and document the matter or address outstanding claims. Statutory retention requirements remain applicable.

4. Customer accounts, orders and legal obligations

For orders, we process your name, billing and delivery addresses, email address, contact details you provide, ordered items, quantities, prices, taxes, payment method, payment status, and order and shipment references. An optional customer account is used to manage login details, addresses and orders; passwords are not stored in plain text.

We process data to prepare and perform the sales contract and provide a requested customer account under Article 6(1)(b) GDPR. We fulfil tax and accounting duties under Article 6(1)(c) GDPR. Article 6(1)(f) GDPR may also apply to handling complaints, preventing misuse, and establishing, exercising or defending claims; our legitimate interest is proper transaction handling and protecting legitimate claims.

Order fields marked as required are needed for the contract, payment or delivery. Without them, we cannot properly fulfil the order. A customer account and consent to optional statistics or comfort functions are not required to shop with us.

5. Shipping, delivery and returns

To fulfil your chosen delivery, we share the necessary data with parcel and courier services and operators of the selected parcel shops, lockers and collection points. These data include your name, delivery address or selected collection point, shipment references, and email address or telephone number where needed for delivery, necessary contact or agreed shipment notifications. For returns, we process the information needed to identify and handle the returned order.

The legal basis is Article 6(1)(b) GDPR. The service carrying your shipment is identified by the chosen shipping method or the shipment information for your order. Data are not shared with every available delivery company simply because that company is offered as a shipping option.

6. Payments and payment services

Depending on your selected payment method, banks, payment processors and, where applicable, wallet providers process the information required for payment. This may include the order reference, amount, currency, contact and billing details, payment data and technical data for secure processing and fraud prevention. Our shop uses a Revolut payment integration for cards and supported digital wallets. For bank transfers, the banks involved process the transfer data.

Card details are processed through the payment provider’s input fields. We receive payment status and payment references, rather than your full card details or card security code for storage in the shop. Apple Pay and Google Pay are also subject to the relevant wallet provider’s information.

Technical libraries from Revolut and Google Pay may load on product pages to make available payment options accessible. The respective provider then receives technical connection data such as your IP address and browser information. For the technical availability and security of the offered payment methods, we rely on Article 6(1)(f) GDPR; for processing the payment you select, we rely on Article 6(1)(b) GDPR. Where a provider pursues its own purposes or requires additional consent, its separate information and choices apply. Payment providers may act as controllers, in particular for their own statutory checks.

Any displayed offer to register with a payment provider is not a condition of buying from our shop. If you use such an offer, the provider’s displayed terms and privacy information apply.

Information about using Revolut’s own services is also available in the Revolut Privacy Notice.

7. Cookies and similar storage technologies

We distinguish necessary functions from optional statistics and comfort functions. Storage of or access to information on your device is based on section 25(2) TDDDG for necessary functions and on your consent under section 25(1) TDDDG for optional functions. Related processing of personal data is based, depending on the purpose, on Article 6(1)(b) or (f) GDPR or on your consent under Article 6(1)(a) GDPR.

  • Necessary: cart and session functions, language, secure ordering and remembering your cookie choices. Examples include WooCommerce session cookies, pll_language and dgst_consent. Cart and session cookies last for the session or normally up to two days; the language preference lasts up to one year. Your cookie choice is saved in your browser for 180 days, restarting when you make a new choice.
  • Comfort, only with consent: dg_recent_products stores up to twelve recently viewed product IDs in your browser for 30 days from the last update.
  • Statistics, only with consent: Google Analytics cookies such as _ga and _ga_* are set for up to 180 days. WooCommerce/SourceBuster cookies beginning with sbjs_ record the source and course of a visit. The session duration is set to 30 minutes; other cookies in this group are short-lived or last for the browser session. An entry in the browser’s session storage may also prevent duplicate order-related statistics messages within the same session.

You can reject optional functions, select them separately, and change or withdraw consent at any time for the future through “Cookie settings” in the footer. Withdrawal stops further optional collection and removes the related cookies managed by us. It does not affect the lawfulness of processing before withdrawal. Data already lawfully collected by recipients do not automatically disappear; please contact us to exercise other data-protection rights. You can also block or delete cookies in your browser, although this may limit necessary shop functions.

8. Google Analytics and order attribution

If you consent to statistics, we use Google Analytics 4, provided by Google Ireland Limited, Ireland, to analyse use of and improve our shop. Data may include pseudonymous browser and session identifiers, technical connection and browser data, visited pages, language, referring pages and events relating to product views, cart, checkout and orders. Order events may contain a transaction reference, items, quantities, amounts, taxes, shipping costs and currency.

Our own Analytics integration does not send names, email addresses or delivery addresses. It removes query parameters and fragments from the page and referrer URLs it sends. Google Signals, advertising personalisation and the user-provided data feature are disabled for this integration. We do not use it to combine activity with a customer account held with us.

After your statistics consent, WooCommerce may also associate source and campaign information, the entry page, visit time and activity, and browser information with an order. This helps us understand which sources lead to orders. These details may be stored in our order administration, rather than only in browser cookies.

The legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Without statistics consent, our Google Analytics code is not loaded and this optional source tracking is not enabled. Google Analytics event and user data retention is set to two months, with extension on new activity disabled. This setting does not apply to already aggregated reports. Source information in our order administration is retained according to the statistics purpose and your consent; it is distinct from invoice data that must be retained by law.

Google also processes data through affiliated companies and may process them outside the European Economic Area, particularly in the USA. Further information: Google Privacy Policy and Google international data transfers.

9. Other recipients and international transfers

Within our business, access is limited to people who need the data for their tasks. In addition to the providers described above, accounting, tax-advisory and legal service providers and competent authorities may receive data where necessary for legal obligations or a specific matter. Depending on their role, providers process data on our instructions or as controllers in their own right, for example when banks and transport companies fulfil their own legal duties.

Google services, including Google Workspace and Google Analytics, may involve processing in countries outside the EEA. For transfers to Google companies in the USA certified under the EU-US Data Privacy Framework, the European Commission’s adequacy decision under Article 45 GDPR may apply. Google also describes the use of standard contractual clauses under Article 46 GDPR for transfers covered by those safeguards. These mechanisms apply only within their respective scope; they do not mean that every country outside the EEA has an adequate level of protection. You can request information about the safeguards relevant to a specific transfer using our contact details. Google’s transfer information is linked above.

Selecting a payment service or wallet may involve additional recipients and international processing. The providers involved explain this in connection with their payment function. We share order data with these providers only to the extent needed for the chosen service and its secure processing.

10. Retention and deletion

We retain data only while needed for their purpose or required by a legal obligation or outstanding claim. They are then deleted or anonymised so that they can no longer be linked to a person.

  • Estonian accounting law generally requires accounting source documents and records needed to reconstruct transactions to be kept for seven years from the end of the relevant financial year. For certain continuing rights and obligations, the relevant period starts after those rights or obligations end.
  • Where transactions are declared under the VAT One Stop Shop (OSS) scheme, the records required for that scheme must be retained for ten years from 31 December of the year of the transaction. This is not a blanket ten-year retention period for all visitor and account data.
  • Customer account data are needed to provide the account. After closure or a valid erasure request, we retain only data independently needed for orders, legal obligations or outstanding claims.
  • Communication, technical logs, cookies and analytics data follow the purposes, periods and criteria described above. A specific dispute may require further purpose-limited retention until it is resolved.

11. Your rights

Subject to the legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time for the future.

If we process data on the basis of legitimate interests under Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. For processing for direct marketing, you may object without giving such grounds. To exercise your rights, contact us using the details above. Where necessary to identify the request securely, we may ask for proportionate confirmation of your identity.

You may also complain to a data-protection supervisory authority, particularly in the Member State of your habitual residence, place of work or the alleged infringement. The Estonian supervisory authority is the Andmekaitse Inspektsioon.

12. Automated decisions

We do not make solely automated decisions within the shop that produce legal or similarly significant effects within the meaning of Article 22 GDPR. Payment providers’ own security and payment checks are governed by their privacy information.

13. Changes to this policy

We update this policy when data processing or relevant requirements change.

Privacy policy