Privacy statement

Who is responsible

KuldneCommerce OÜ, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia, Registry code 17574834, is the controller for the processing described here. You can reach us at [email protected].

We have not appointed a data protection officer. We are not required to: we do not monitor people on a large scale and we do not process special categories of data.

What this website collects

This website has no contact form, no accounts, no shopping basket and no newsletter. It sets no cookies of its own and loads no analytics, no advertising scripts and no social media widgets. There is nothing here to consent to, which is why you are not asked.

Our web server keeps a standard access log of every request: the IP address, the date and time, the page requested, the HTTP status and the browser's user-agent string. We need this to keep the site running and to see abuse and attacks for what they are. The legal basis is our legitimate interest in a secure and working website, Article 6(1)(f) GDPR. These logs are deleted after fourteen days.

When you write to us

If you send us an e-mail we process your address, your name if you give it, and whatever you write. We use it to answer you and nothing else. The legal basis is Article 6(1)(b) GDPR where your message concerns a contract or the steps before one, and Article 6(1)(f) GDPR otherwise, our interest being to answer people who approach us.

We keep correspondence for as long as it is useful for the matter it concerns. Enquiries that lead nowhere are deleted within twelve months. Correspondence that belongs to an order or a contract is kept for seven years, because Estonian accounting law requires it.

Who else sees your data

Our website and our e-mail run on servers inside the European Union. We use the following processors, each under a data processing agreement:

• our hosting provider, for the server the website and its logs sit on;
• our e-mail provider, for sending and receiving business correspondence;
• our accountant, where correspondence forms part of the bookkeeping.

We do not sell personal data, we do not trade it, and we do not use it for profiling or automated decisions. We transfer nothing outside the European Economic Area for this website.

Our store

Buying from our store is a separate matter with its own processing: an order, an address, a payment. The store publishes its own privacy statement, and that is the one that applies to your purchase.

• Privacy statement for Urban Cloth Hub

Your rights

Under the GDPR you may ask us for a copy of the personal data we hold about you (Article 15), to correct it (Article 16), to erase it (Article 17), to restrict what we do with it (Article 18), to receive it in a portable form (Article 20), and to object to processing based on our legitimate interest (Article 21).

Write to [email protected]. We answer within one month. If your request is complicated we may take two months longer, and we will tell you inside the first month if that happens. We may ask you to prove who you are, so that we do not hand your data to somebody else.

Complaints to a supervisory authority

If you think we handle your data wrongly, please tell us first — it is usually the quickest way to fix it. You also have the right to lodge a complaint with a supervisory authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee. You may also complain to the authority in the country where you live.

Changes to this statement

If the way we work changes, this statement changes with it. The date below tells you which version you are reading.

Last updated on 8 September 2026.