This privacy policy explains how we process the personal data of visitors to and customers of the online shop wyra.eu, in accordance with the General Data Protection Regulation (GDPR) and Estonian law.
1. Data controller
SVSA OÜ
Registry code: 17598361
Address: Pille tn 11/2, 15029 Tallinn, Eesti
Email: info@wyra.eu
2. Health data
This web shop does not process health data. The data measured by the ring (sleep, heart rate, HRV, SpO₂, body temperature, steps) stays on your phone in the WYRA app — the app needs no account and does not send data to a server. The only exception is the app advisor’s optional cloud mode, which the app clearly tells you about when it is used. If you wish, you can share some data with Apple Health yourself. In the shop, we only handle the data needed to fulfil your order, as described below.
3. What data we collect
- Order data: name, email address, phone number, delivery address or chosen parcel locker, products ordered, amount and order status;
- Payment data: payment status and the payment provider’s transaction reference. We never see or store your card details;
- Correspondence: your enquiries, returns and complaints;
- Newsletter: your email address and the time of consent, if you have subscribed;
- Technical data: server logs (e.g. IP address, browser type) needed to keep the shop secure and running.
The shop has no user accounts — every purchase is made as a guest.
4. Purposes and legal bases
- fulfilling your order, payment, delivery, returns and customer support — performance of a contract (GDPR Art. 6(1)(b));
- accounting and consumer protection obligations — legal obligation (Art. 6(1)(c));
- shop security, fraud prevention, anonymous visit statistics and reminders about unfinished purchases — legitimate interest (Art. 6(1)(f));
- newsletter, analytics and marketing cookies and Meta conversion tracking — consent (Art. 6(1)(a)), which you can withdraw at any time.
5. Who we share data with
We do not sell personal data. We share it only with service providers who help us run the shop, and only to the extent necessary:
- Montonio — payments (bank links, card payments) and shipping;
- parcel carriers (e.g. Omniva, DPD, Smartpost, Venipak) — the details needed to deliver your parcel: name, phone, email and parcel locker;
- hosting — Veebimajutus.ee, servers in Estonia;
- email delivery provider — order confirmations and other notifications;
- Meta Platforms — only with your consent (see section 6);
- our accounting service provider and, where required by law, public authorities.
Where data is transferred outside the European Economic Area (e.g. to the United States in the case of Meta), this is based on a European Commission adequacy decision (the EU–US Data Privacy Framework) or standard contractual clauses.
6. Cookies, analytics and Meta
Without your consent, we only use cookies that are necessary for the shop to work (shopping cart, security and your cookie choice).
Analytics and marketing cookies are activated only after you give consent, which you can give or withdraw in the cookie banner and later via the “Cookie settings” link in the footer.
- Google Analytics (statistics, if enabled) — an overview of how the shop is used, with anonymised IP addresses;
- Meta Pixel (marketing) — helps measure the performance of Facebook and Instagram ads and show more relevant ads;
- Meta Conversions API (marketing) — if you have consented to marketing cookies, our server sends Meta the purchase event together with your hashed (irreversibly encoded) email address and phone number. Without your consent, this data is never sent to Meta.
7. Cookie-free visit statistics
To improve the shop, we count page views without cookies or personal identifiers. IP addresses are not stored: the server calculates a one-way hash from the IP address, browser type and a random key that changes daily, which can only link page views within a single day. We store the pages viewed, the referring site’s domain, device type and shop language. This data is deleted after 90 days.
8. Retention
- order and payment data (accounting source documents) — 7 years, as required by the Estonian Accounting Act;
- correspondence — as long as needed to resolve an enquiry, complaint or potential dispute;
- newsletter data — until you withdraw your consent;
- visit statistics — 90 days.
9. Your rights
You have the right to:
- be informed about and access the data we process about you;
- have inaccurate data corrected;
- have your data erased where there are grounds to do so;
- restrict or object to processing;
- receive your data in a machine-readable format;
- withdraw your consent at any time;
- lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee) or the data protection authority in your country of residence.
To exercise your rights, email info@wyra.eu. We will respond within one month at the latest.
10. Security
We protect your data with encrypted connections (HTTPS), restricted access and other technical and organisational measures.
11. Changes
We may update this privacy policy. The version published on this page always applies.
