1. Controller and contact
The controller for personal data related to the website www.luuna.ee and the “Luuna” service is:
- EVENUX OÜ (Luuna)
- Location: Tallinn, Estonia
- Email: [email protected]
- Phone: +372 5781 1818
Registry code: 16380743, VAT number: EE102954960
2. What data we process
We may process the following categories, depending on how you use the service:
- Identity and contact: name, email address, and phone number, when you provide them (for example a contact form, an order, or a support request).
- Account and service use: account identifiers, roles, activity logs, and device or technical information needed to provide the service and keep it secure.
- Payment data: payment details are passed through the payment provider. We do not store full card numbers unless that is separately necessary and lawful for providing the service.
- Communication: messages you send us by email or through forms.
- Cookies and similar technologies: see the separate description on the Cookie settings page.
3. Purposes and legal bases (GDPR Art. 6)
- Performance of a contract, or steps before a contract — creating an account, processing an order or a demo request, and providing the service.
- Legitimate interest — IT security, fraud prevention, analysing and improving the service (if you use optional analytics cookies after consent), and customer communication.
- Legal obligation — accounting, tax, or other mandatory requirements.
- Consent — marketing messages, non-essential cookies, and other optional processing where the law requires consent.
4. Retention
We keep personal data only as long as needed for the purpose, to continue the contract, or to meet statutory retention periods. When retention can no longer be justified, we delete or anonymise the data.
5. Disclosure and processors
We do not sell your personal data. We disclose data only when needed: (i) to provide the service (for example hosting, email, payments, and analytics after consent); (ii) to meet legal requirements; (iii) to protect rights. Where needed, we sign data processing agreements with processors (GDPR Art. 28).
6. Transfers outside the EU/EEA
If we use providers outside the EU/EEA, we put appropriate safeguards in place, including European Commission adequacy decisions or contractual clauses under GDPR Art. 46.
7. Your rights
You have the right to:
- access your personal data;
- correct inaccurate data;
- erase data (“the right to be forgotten”), where it applies;
- restrict processing or object to it;
- receive data in a structured form and transmit it to another controller, where that is technically possible;
- withdraw consent for processing that is based on consent, without affecting the lawfulness of processing before the withdrawal;
- lodge a complaint with the Estonian Data Protection Inspectorate (Estonia).
Requests: [email protected]. We reply within a reasonable time and, as a rule, within 30 days, unless the law requires otherwise.
8. Security
We use organisational and technical measures (including access control, encryption where feasible, and security updates) to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorised access.
9. Children
The service is not directed at children under 16, or under the age set by local law. If you know we have collected data from a minor without a parent’s consent, please tell us at [email protected].
10. Changes
We may update this policy from time to time. The updated version is published on this page together with a “Last updated” date.