Last updated:
Privacy policy
Hambake OÜ (iSmile.ee) is committed to protecting the privacy of its customers and users. This privacy policy explains how we collect, use, disclose, transfer and store customer data. Our activity online complies with the relevant laws of the European Union and the Republic of Estonia. Please take a moment to read it.
Collecting and using personal data
Personal data is data that can be linked to you as an individual, directly or indirectly. iSmile.ee collects and processes it to perform a contract with you, to contact you and to meet its legal obligations. We may collect personal data in the following ways:
- when you enter contact details (including your name, postal address, phone number, e-mail address and preferred contact method) on our website;
- from your account details or through cookies when you use the website;
- when you make a purchase or place an order and we store your contact details or purchase preferences. iSmile.ee may ask you to provide personal details voluntarily in certain areas of the website. These may include your name, address, postal code, e-mail address, phone number and other details.
If you sign in with a Google or Apple account, that provider shares your name and e-mail address with us. We use them only to create your account and to sign you in.
Other data we collect
We also collect non-personal data, which cannot be directly linked to any one person (sex, age, language preference, location).
We may also collect data about what customers do on our website. We combine this data and use it to send customers more useful information and to learn which parts of the website, products and services interest people most. This privacy policy treats combined data as non-personal data.
How we use and store personal data
We use the personal data we collect to tell customers about iSmile.ee product news, campaigns and upcoming events. If you do not want to be on our newsletter list or receive notifications about products that may interest you, you can remove yourself from the list at any time.
We also use personal data to deliver products and to meet our obligations to the customer.
By accepting this privacy policy, the customer agrees that iSmile.ee may process their data automatically. You can withdraw this consent at any time through our website or by sending a request in a form that can be reproduced in writing, such as an e-mail. A request or withdrawal has no retroactive effect.
iSmile.ee keeps customers’ personal data until the customer asks for it to be deleted. We keep customer account data until the account is deleted. We keep accounting records for 7 years, as the Estonian Accounting Act requires. Any other data that iSmile.ee must keep by law is kept for the period the law sets.
Who receives your data
iSmile.ee is the controller of your personal data. To serve customers better, iSmile.ee may share information about individual users with third parties that provide services to iSmile.ee and are bound by contract to keep it confidential. These third parties are:
- Omniva, DPD, Smartpost/Itella and Unisend deliver orders. They receive what they need to do so: your name, contact details and delivery address or parcel locker.
- Montonio handles payments. We send Montonio the personal data needed to process a payment. Montonio processes payment data as an independent controller.
- Meta Platforms Ireland Ltd: the Meta Pixel and a server-side Purchase event. Meta receives your e-mail address and phone number hashed with SHA-256, your IP address, browser details, and the products and value of your order.
- Google Ireland Ltd: the Google Ads tag and server-side conversion uploads with your hashed e-mail address and phone number; Google Analytics (GA4); reCAPTCHA v3 on sign-in, registration, password reset and comments; embedded YouTube videos.
- OpenAI Ireland Ltd: the ChatGPT ads pixel. OpenAI receives data on product views, the basket, checkout and orders. The pixel uses the cookies
__oppref(30 days) and__obref(365 days). Our server also sends OpenAI a purchase event for each order, with your hashed e-mail address and phone number, IP address, browser data, and the order’s products and value. - Automattic: Jetpack and WooCommerce statistics.
- Mailchimp (Intuit): the newsletter, basket reminders and order data. Mailchimp sets
mailchimp_*cookies.
Cookies, statistics and marketing
Statistics and marketing tools run from your first visit until you decline them. A banner on the site offers three choices: “Allow all”, “Reject” and “Settings”. “Reject” stops the statistics and marketing tools, as well as the server-side purchase events to Meta, Google and OpenAI. You can change your choice at any time with the “Cookie settings” link at the bottom of every page.
Your cookie choice does not stop reCAPTCHA, which protects our forms, or Mailchimp’s order data and basket reminders. To stop newsletters and reminders, use the unsubscribe link at the end of the e-mail. Every cookie is listed in our cookie policy.
How we protect personal data
iSmile.ee takes all precautions (including administrative, technical and physical measures) to protect customers’ personal data. Only authorised people can access and process the data.
If you suspect that your personal data has been handled in a way that goes against this privacy policy, or that it may have leaked to unauthorised people, tell us immediately. That is the only way we can keep any harm as small as possible.
You have the right to demand that we stop processing your data, to receive information about how it is used, and to have it transferred to you or to a third party in a commonly used format. To make a request, write to info@ismile.ee. We do not require a digital signature. To prevent misuse of customer data and rights, we may verify your identity before we respond. We have the right to respond to such requests within 30 days.
Security
All customer personal data that becomes known to us when you visit the ismile.ee e-shop and make purchases is treated as confidential. An encrypted connection to the banks protects the buyer’s personal and bank details. The e-shop runs on the WooCommerce e-commerce platform.
Terms and changes to this policy
By starting to use our website, you confirm that you have read and agree to these principles and terms. We reserve the right to change the general terms of this privacy policy when necessary and will inform all customers. We will do our best to keep it up to date and available to you on our website.
If you have any questions or concerns about this policy or how we process data, contact us at info@ismile.ee
You always have the right to turn to the Estonian Data Protection Inspectorate to protect your data. It is a state authority that can also be contacted for advice or help on personal data protection.
The iSmile app
This section applies to the iSmile mobile app. The rest of this privacy policy also applies to the app, except the parts on website cookies and the tools that run on the website (including Meta, Google Ads, Google Analytics and OpenAI). App orders are not sent to Meta or Google Ads.
What the app needs to work. For the basket, sign-in, orders, payment and security we process your account and order data and a random identifier for your installation of the app. The identifier ties the basket to that installation and helps prevent abuse. No separate consent is asked for this. Payment takes place on Montonio’s page; your card and bank details never reach the app.
Statistics (only with your consent). We use PostHog (data held in the EU) to understand how the app is used: screens viewed, taps, searches, purchases, performance and error codes. After sign-in the data is linked to a pseudonymous customer code, not your name or e-mail address.
Marketing (only with your consent). We keep which ad or link brought you to the app, and use that information for further optimisation.
Notifications. If you allow notifications, we use two services and a device notification token to send them.
Camera and location. The camera is used only to scan barcodes, and the frames stay on your phone. Your location is used only on your phone, to sort the nearest parcel lockers when you tap “Nearest”; it is not sent to us.
Crash reports. We use Sentry to find faults in the app, without adding personal data.
Your choices. You can change your consent at any time under “Privacy choices” in the app’s settings. After you withdraw it no new statistics are collected; events collected just before may still be sent. You can delete your account in the app or at https://ismile.ee/en/delete-account/. We keep order records for accounting, without your account, for 7 years.