PRIVACY POLICY

This policy explains what personal data Plastik Records OÜ collects when you use this webshop, why, who we share it with, how long we keep it, and your rights.

Last updated: 26 October 2026

1. Who We Are

Plastik Records OÜ is responsible for your personal data.

Pärnu mnt. 4, 10148 Tallinn, Estonia

hello@plastikrecords.ee: write to us with any question or request about your data.

2. What We Collect

When you check out: your name, email address, phone number, billing address, delivery address if it is different (or that you pick up in the store), company name and VAT or tax number if you add them, and what is in your cart. When you press "Proceed to Payment", we send these details to our payment provider, Stripe, and keep a copy, even if you then do not pay. If you are signed in, your name and billing address are also saved to your account, and the order is linked to it.

When you pay: you choose how to pay in Stripe's payment form and enter your payment details there, not on our site. Depending on where you are and your device, it offers a card, Apple Pay, Google Pay, PayPal, Link (Stripe's service that saves your payment details under your email address), Klarna, Bancontact or EPS. With PayPal you approve the payment on PayPal's own website. We never see your full card number or security code. Stripe tells us which method you used and, for a card, its type, whether it is credit or debit, the last four digits, the expiry date, the issuing country and an identifier that recognises the same card again. Apple Pay and Google Pay pay with a card from your wallet, so the same applies, and Stripe also tells us which wallet you used. For PayPal it tells us your PayPal email address, name and country and PayPal's references for you and for the payment. For other methods it tells us what that method shares, such as your email address, country or the account holder's name. For every payment it also tells us the country and postcode you entered in its form, the results of its security checks and the fraud-risk rating it gives the payment; if a payment fails, the reason; and if a payment is disputed, the dispute and its outcome.

When you create an account: your name, email address, a securely hashed version of your password (never the password itself), and the contact and address details you save. If you sign in with Google, Google shares your name, email address, profile picture and Google account ID with us, and we store the sign-in tokens Google issues. If you are signed in, your cart is saved with your account. Orders placed without signing in are not linked to an account. Before July 2026 they could be linked to the account with the same email address, or to a new customer record with your name and email address.

When you email us (hello@plastikrecords.ee, or support@plastikrecords.com, which our order emails mention): your email address and what you write.

Technical data: our server logs record events such as orders, emails sent and sign-ins, which can include your email address, and keep a copy of each order. During checkout, and if a page fails, your browser sends us short reports: the step reached or the error (for a declined payment, the reason given), the page address and the page you came from, your browser and device type, a random reference and the payment reference of your checkout. Stripe's payment notifications can include the IP address and browser used to approve a payment. Our hosting provider's web server logs record IP addresses, the pages requested and browser type.

3. Why We Use It

  • To process and deliver your order, and to handle payments, returns and your questions. This is needed to fulfil our contract with you (GDPR Article 6(1)(b)).
  • To keep accounting records, as Estonian law requires (Article 6(1)(c)).
  • To run your account, if you create one (Article 6(1)(b)).
  • To keep the shop working and secure, prevent fraud and fix errors. This is our legitimate interest (Article 6(1)(f)).

We do not send marketing emails, sell your data, or use it for advertising, and we do not profile you or make automated decisions about you. Stripe, however, automatically screens every payment for fraud and may refuse one it rates as too risky; you will then see that the payment was declined. If that happens, contact us.

4. Who We Share It With

  • Stripe (Stripe Payments Europe, Limited, Ireland) processes payments. It receives the checkout details described above when you press "Proceed to Payment", and your payment details when you pay. Its script loads when you open the checkout page, to prevent fraud. If a payment is disputed, we send Stripe evidence such as your order and delivery details. See Stripe's privacy policy.
  • Klarna (Klarna Bank AB, Sweden), only if you pay with Klarna: it receives your name, contact and billing details and the amount through Stripe, may check your identity and credit, and handles your data under its own privacy notice.
  • PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), only if you pay with PayPal: you sign in to PayPal and approve the payment there, and PayPal receives the payment details from Stripe. It handles your data under its own privacy statement.
  • Apple (Apple Distribution International Limited, Ireland), only if you pay with Apple Pay: you approve the payment in Apple Pay, which receives the amount and our shop's name. Apple handles this under its own privacy policy.
  • Carriers, Itella SmartPost in Estonia and FedEx for deliveries abroad, receive what they need to deliver your order: your name, delivery address or parcel locker, phone number and email address.
  • Resend delivers the emails our website sends: your order confirmation, password-reset emails, and the new-order notice we receive for each order. It handles everything those emails contain.
  • Google: we receive our new-order notices in a Gmail inbox, so Google stores the order details in them (your name, contact and address details, and what you ordered). Google also receives data if you sign in with Google, pay with Google Pay (it receives the amount and our shop's name), or play a YouTube video on a record page. When the payment step opens, Stripe's payment form may also check with Google whether Google Pay is available in your browser, whichever way you then pay; Google then receives your IP address and browser details. See Google's privacy policy.
  • Zone Media OÜ (zone.ee) hosts the website, our database and the hello@plastikrecords.ee mailbox, in the EU.
  • GoDaddy hosts the support@plastikrecords.com mailbox.
  • Anthropic provides Claude, the AI assistant we use to maintain the website and its server. While it works on the server, it can see order details and our server logs.

We do not share your data with anyone else, unless the law requires us to.

5. Transfers Outside the EU

Some of these providers (Stripe, PayPal, Apple, Resend, Google, FedEx, GoDaddy and Anthropic) may process data outside the European Economic Area, for example in the United States. They protect it with the safeguards the GDPR requires, such as the European Commission's Standard Contractual Clauses.

For a delivery outside the EU, the carrier passes your delivery details to the destination country as needed for delivery and customs.

6. How Long We Keep It

  • Orders, with the customer details that belong to them, our copy of each order and the emails about it: 7 years, as the Estonian Accounting Act requires.
  • Stripe's payment notifications, including the details of checkouts that were not paid and the payment details described above: 90 days.
  • Your account: until you ask us to delete it. We then keep your orders for the period above.
  • A saved cart: until you empty it or your account is deleted.
  • Other emails: as long as we need them to answer you.
  • Our server logs and the reports your browser sends: 12 months.
  • Database backups: about one week.
  • Our hosting provider's web server logs: about one week; its error logs, which also record IP addresses, can be kept for a few weeks. Our hosting provider also makes monthly visitor statistics from them, which list the most active IP addresses and are kept until deleted.
  • Some older copies are kept until we delete them: a 2025 backup of the website's files, the server's own system logs, and working copies made while maintaining the site.

7. Cookies and Browser Storage

We only store what the shop needs to work and to fix checkout problems, so we do not ask for cookie consent. We do not use analytics, advertising or tracking cookies.

  • Sign-in cookies keep you signed in and protect the sign-in form.
  • Your browser's storage keeps your cart, your light or dark theme, and the details you last entered at checkout, also if you are not signed in (they fill in the form when you next check out signed in, or when you come back to the checkout after a payment that did not go through). It also keeps a few technical entries: timestamps, the payment reference and amount of your latest checkout, and the random reference that links the reports your browser sends us. All of this stays in your browser until you clear its storage in your browser settings.
  • Stripe sets cookies on the checkout page to prevent fraud.
  • PayPal: if you pay with PayPal, you continue on PayPal's website, where its own cookies and privacy statement apply.
  • YouTube: nothing loads from YouTube until you press play on a video. From then on, YouTube's own cookies and privacy policy apply.

8. Your Rights

You can ask us for a copy of your data, ask us to correct it, to delete it (unless the law requires us to keep it), to restrict or object to how we use it, or to send it to you in a machine-readable format.

Email hello@plastikrecords.ee. We reply within one month. If you signed in with Google, you can also remove our access in your Google Account settings.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

9. Changes

We update this policy when the way we handle data changes. The date at the top shows the current version. Our Terms and Conditions apply to orders.

If you have any questions, please contact us at hello@plastikrecords.ee.