C&C | Privacy Policy

PRIVACY POLICY

C&C EE is committed to protecting the privacy of clients and users. Based on this, we have developed these privacy policy principles, which address the collection, use, disclosure, transfer, and storage of personal data. Our online activities comply with all relevant activities and applicable European Union legislation and Estonian laws. Take a moment to familiarize yourself with our privacy principles.

The data controller responsible for the processing operations described in these privacy terms is C&C EE OÜ (reg. code 10390835).

Collection and composition of personal data

We collect the following types of personal data:

Personal data disclosed by you to us. For example, when providing contact details (including your name, personal identification code, bank account number, postal address, phone number, email address, preferred method of contact) on our website or elsewhere (e.g., stores).

Personal data resulting from ordinary communication (e.g., personal data transmitted through correspondence or the website communication application Askly).

Personal data you have obviously disclosed (e.g., in C&C's social media);

Personal data arising from the use of services (e.g., when using our self-service or, for example, when making a purchase or order in our store or e-shop concerning personal contact data or purchase preferences (C&C may ask you to voluntarily provide personal data and personal information in certain areas of the website. Required personal data may include name, address, postal code, email address, phone number, and other data) when submitting a credit application. We also collect personal data when registering for maintenance work at our representative(s) or in the web environment.

Personal data resulting from visiting and using the website. For example, data allowed through the client's account information or cookies when using the website.

Personal data received from third parties.

To better serve clients, iDeal may disclose information about individual persons to third parties who provide services to iDeal. A third party may include our partner responsible for transporting goods sold in the e-shop or providing hire-purchase services, advertising and marketing partners, a partner providing payment services, recruitment-related service providers, companies conducting customer satisfaction surveys, debt collection service providers, credit bureaus, ICT partners providing various technical services, invoice forwarding service providers. The transfer is only made under the condition that the purpose of the transfer is legal and that the third party processes the data based on a contract obliging the third party to keep the shared information confidential.

In connection with your maintenance work, iDeal processes personal data also through a web environment managed by a third party (maintenance base), whose data storing server is located in the European Union.

As a general rule, we do not transfer personal data outside the European Economic Area. If we transfer personal data outside the European Union, we only do so in compliance with data protection legislation requirements, if the European Commission has decided that there is an adequate level of protection in that country, or, in the absence of such a decision, we have taken appropriate protective measures (e.g., binding corporate rules or standard data protection clauses).

Collection of other data

We also collect non-personal data when the client has given consent in the cookies modal - data that cannot be directly linked to a specific individual (gender, age, language preference, location). We may also collect data on aggregated customer activities in our stores and website. This aggregated data is used to provide more useful information to customers and understand which parts of the website, products, and services are of greatest interest. Aggregated data is treated as non-personal data in this privacy policy.

The purpose and legal basis for using collected personal data

We use the following legal bases for processing personal data as required by law:

We process personal data based on consent in order to inform clients about C&C's product news, campaigns, and upcoming events. Clients who do not wish to be part of our newsletter list or receive notifications about products that may interest them can be removed from the target list at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

We use the collected personal data to fulfill contractual obligations: to take measures prior to entering into a contract; to identify the client as required by duty of care; to fulfill obligations to the client regarding service delivery (e.g., for goods delivery); for communication with the client and ensuring the fulfillment of the client's payment obligations.

Note that the purpose of personal data processing may be further stipulated in the specific Contract concluded with you.

For the conclusion of an employment contract based on contract and legitimate interest, the processing of personal data for a job applicant includes:

processing of data provided to us by the job applicant for the purpose of concluding an employment contract;

processing of data received from a person mentioned as a referee by the job applicant or, in the absence of a referee, from a previous employer;

processing of personal data collected from public (social) media.

In the event that the job applicant is not selected, we retain the personal data collected for an employment contract for offering a job to the applicant in case a suitable position becomes available, but no longer than 36 months

Legitimate interest means Our interest in managing or directing our business to offer the best possible Services on the market. We process your personal data for legitimate interest purposes including:

ensuring a trustworthy client relationship, which includes processing personal data to prevent fraud;

managing and analyzing the client base to improve service availability, selection, quality, and to make the best and most personalized offers to the client with consent;

identifiers and personal data collected during the use of the website, our social media pages, and services. We use collected data for web analysis or info society services analysis, to ensure, improve, make statistics, analyze your behavior and usage experience, and provide better and more personal service;

for organizing campaigns, including personalized and targeted campaigns, conducting client satisfaction surveys, and measuring the effectiveness of conducted marketing activities;

making recordings. We may record messages and orders given both on our premises and via communications channels (email, phone, etc.), as well as information and other actions taken by us, and use these recordings, if necessary, to prove orders or other actions;

for network, information, and cybersecurity considerations, such as combating piracy and ensuring website security, as well as making and storing backups;

for organizational goals, mainly for financial management and for the purpose of sharing personal data within the group for internal administrative purposes, including processing personal data of clients or employees;

we may share personal data when we make a business transaction or negotiate a business transaction that involves selling or transferring all or part of our business or assets. Such transactions may involve any merger, financing, acquisition, or bankruptcy transaction or proceeding;

for preparing, presenting, or defending legal claims;

when necessary, we also use data to send you exceptional notices regarding safety factors or recall programs issued by the manufacturer.

We use surveillance cameras in our stores. The purpose of using and processing recordings is to protect the property of C&C EE OÜ, employees, and visitors; ensure security; protect and present claims; resolve complaints, and use recordings as educational material. Recordings are deleted no later than 3 months after the recording space is filled.

We also process your personal data to fulfill legal obligations arising from the law. For instance, obligations related to payment processing or compliance with anti-money laundering rules. Additionally, we may be obliged to process video recordings legally for the investigative body specified in the law.

If personal data is processed for a purpose other than for which it was collected, we analyze the possibility of such processing in accordance with data protection legislation (General Data Protection Regulation, 2016/679, article 6(4)).

Disclosure and/or transfer of personal data to third parties

To better serve clients, C&C may disclose information about individual persons to third parties who provide services to C&C. Third parties may include our partner responsible for transporting goods sold in the e-shop or providing hire-purchase services, buyback service providers, advertising and marketing partners, a partner providing payment services, recruitment-related service providers, companies conducting customer satisfaction surveys, debt collection service providers, credit bureaus, ICT partners providing various technical services, invoice forwarding service providers. The transfer is only made under the condition that the purpose of the transfer is legal and that the third party processes the data based on a contract obligating the third party to keep the shared information confidential.

In connection with your maintenance work, C&C processes personal data also through a web environment managed by a third party (maintenance base), whose data storing server is located within the European Union.

Modifying collected personal data and your rights

As a data subject, you have the following rights under personal data processing:

You have the right to receive information about the personal data collected about you.
You have the right to access data which includes your right to a copy of processed personal data.
You have the right to rectify incorrect personal data.
You may have the right to data deletion, meaning you have the right to request, under certain circumstances, that personal data be deleted, for example, if processing relies solely on consent. Personal benefits granted to you will also end with data deletion.
The right to request the restriction of personal data processing.
You have the right to data portability, meaning you have the right to receive personal data in a machine-readable format in certain cases, or have it transferred to another data controller.
You have the right to a supervisory authority's assessment of whether the processing of your personal data is lawful.
You have the right to compensation for damages if personal data processing causes damage.
Rights relating to automated processing mean that a data subject has the right, based on a specific situation, to oppose processing of personal data concerning them based on automated decisions. You{

C&C EE has committed to protecting the privacy of customers and users. Accordingly, we have prepared these privacy policy principles, which address the collection, usage, disclosure, transfer, and storage of personal data. Our online activity complies with all relevant activities and applicable European Union legislation and Estonian Republic laws. Take some time to familiarize yourself with our privacy principles.

The data processing described in these privacy conditions is managed by C&C EE OÜ (reg. code 10390835).

Collection and Composition of Personal Data

We collect the following types of personal data:

Personal data disclosed by you to us. For example, submitting contact information (including your name, personal identification number, bank account number, postal address, phone number, email address, preferred contact method) on our website or elsewhere (e.g., stores).

Personal data arising from ordinary communication (e.g., personal data transmitted via correspondence or the website's communication application Askly)

Personal data you have clearly disclosed (e.g., on C&C's social media);

Personal data generated from service consumption (e.g., using our self-service or storing contact information or purchase preferences data when making a purchase or order in our store or e-store. C&C may request voluntary submission of personal data and personal information on certain website areas. Required personal data may include name, address, postal code, email address, phone number, and other information) when submitting a credit application. We also collect personal data during maintenance registration at our branches or online.

Personal data resulting from visiting and using the website. For example, data permitted via the website's use of client account information or cookies.

Personal data received from third parties.

For better customer service, iDeal may disclose information about individuals to third parties that provide services to iDeal. Such third parties include, for instance, our partner responsible for transporting goods sold in the e-shop or offering credit service, advertising and marketing partners; payment service providers; partners providing recruitment-related services, companies conducting customer satisfaction surveys, debt recovery service providers, registers of payment default, ICT partners, i.e., providers of various technical services, invoice transmission service providers. Disclosure occurs only if it is legal and the third party processes the data based on a contract, in which the third party undertakes to keep shared information confidential.

Regarding your maintenance work, iDeal processes personal data through a web environment (maintenance base) managed by a third party, with the data stored on a server located in the European Union.

Generally, we do not transfer personal data outside the European Economic Area. When we transfer personal data outside the European Union, it is done following data protection legislation requirements, provided the European Commission has determined that there is an adequate level of protection in that country, or, in the absence of such a decision, we have implemented adequate safeguards (e.g., binding corporate rules or standard data protection clauses).

Collection of Other Data

We also collect non-personal data when the client gives consent through cookies modal—data that cannot be directly linked to a specific person (gender, age, language preference, location). We may also collect data on generalized client activities in our stores and on the website. This data is aggregated and is used to provide more useful information to clients and to learn which parts of the website, products, and services are most interesting. Aggregated data is treated as non-personal data in this privacy policy.

The Purpose and Legal Basis of Using Collected Personal Data

We use the following legal bases for processing personal data as required by law:

On the basis of consent, we process personal data to inform clients about C&C's product news, campaigns, and upcoming events. A client who does not wish to be on our newsletter list or receive notifications about products that may interest them can remove themselves from the recipient target group at any time. Withdrawal of consent does not affect the legality of personal data processing that occurred based on consent before the withdrawal.

To fulfill contractual obligations, we use collected personal data: to take measures before the conclusion of a contract; to identify the client to the extent required by due diligence; to fulfill obligations with respect to service provision (e.g., we use personal data to deliver goods); for communication with the client and ensuring the client's payment obligation is met.

Note that the purpose of personal data processing may be further specified in the specific contract concluded with you.

For the conclusion of an employment contract based on the contract and legitimate interest, our processing of applicant personal data includes:

processing data provided by job applicants to us for the purpose of concluding an employment contract;

processing data from the person cited as a referee by the job applicant, and where there is no referee, from the previous employer;

processing data collected from public (social) media sources.

If the job applicant is not selected, we retain the personal data collected for the employment contract for the possibility of making a job offer upon the availability of an appropriate job position, but no longer than 36 months

Legitimate interest means Our interest in managing or operating our company to offer the best possible Services on the market. We process your personal data on the basis of legitimate interest for the following purposes:

to ensure a trustworthy client relationship, which includes processing personal data to prevent fraud;

to manage and analyze the client base, to improve service availability, selection, and quality, and to make the best and personalized offers to the client with consent;

To use identifiers and personal data collected when using the website, our social media pages, and services. We use collected data for web analytics or information society services analytics, ensuring the functioning of these channels, improving them, compiling statistics, and analyzing your behavior and usage experience, as well as providing better and more personalized services;

to organize campaigns, including personalized and targeted campaign organization, conducting client satisfaction surveys, and measuring the effectiveness of marketing activities;

for making records. We may record messages and instructions given at our location's premises or via communication means (email, telephone, etc.), as well as information and other operations we have performed, and may use them to verify orders or other operations;

for network, information, and cybersecurity reasons, such as combating piracy and ensuring website security, and taking measures for backup creation and storage;

for organizational purposes. Mainly for financial management and internal purposes within the group, including the processing of personal data of clients or employees;

we may share personal data when conducting or negotiating a business transaction that involves selling or transferring all or part of our business or assets. These transactions may include any merger, financing, acquisition, bankruptcy transaction, or proceeding;

for preparing, presenting, or defending legal claims;

If necessary, we also use data to send you exceptional notices regarding safety precautions issued by the manufacturer or recall programs.

We use surveillance cameras in our stores. The purpose of camera usage and recording is to protect the property of C&C EE OÜ as well as employees and visitors; ensure security; protect and present claims; resolve complaints and use recordings as teaching material. Recordings are deleted after a maximum period of 3 months or when storage space is full.

In compliance with the law, we also process your personal data for obligations arising from the law, such as payment processing or adherence to anti-money laundering rules. Additionally, we may be required to process video footage in accordance with legal provisions for investigative bodies stipulated by law.

If personal data is processed for a purpose other than that for which it was collected, we carefully analyze the possibility of such processing in accordance with data protection legislation (General Data Protection Regulation, 2016/679, Article 6(4)).

Disclosure and/or Transfer of Personal Data to Third Parties

For better customer service, C&C may disclose information about individuals to third parties providing services to C&C. Such third parties include, for example, our partner responsible for the transport of goods sold in the e-shop or offering deferred payment services, buyback services, advertising and marketing partners; payment service providers; recruitment-related service providers, companies conducting customer satisfaction surveys, debt collection service providers, payment default registers, ICT partners i.e., providers of various technical services, invoice transmission service providers. Disclosure only occurs provided that the purpose of disclosure is lawful and the third party processes the data based on a contract, which includes a commitment by the third party to keep shared information confidential.

Regarding your maintenance work, C&C processes personal data through a web environment managed by a third party, with the data stored on a server located in the European Union.

Generally, we do not transfer personal data outside the European Economic Area. When we transfer personal data outside the European Union, it is carried out in compliance with data protection legislation requirements, only if the European Commission has decided that there is an adequate level of protection in that country, or, in the absence of such a decision, we have implemented adequate safeguards (e.g., binding corporate rules or standard data protection clauses).

Amendment of Collected Personal Data and Your Rights

When processing personal data, you as the data subject have the following rights:

You have the right to receive information about the personal data collected concerning you.
You have the right to access the data, including your right to a copy of the processed personal data.
You have the right to the correction of inaccurate personal data.
In certain cases, you may have the right to data deletion, i.e., you can request the erasure of personal data, for example, when processing is based solely on consent. With the deletion of data, all personalized benefits provided to you also end.
The right to restrict the processing of personal data.
You have the right to data transfer, i.e., in certain cases, you have the right to receive personal data in a machine-readable format or have it transferred to another responsible processor.
You have the right to a supervisory authority's assessment of the legality of your personal data processing.
You have the right to compensation for damages incurred due to personal data processing.
Rights related to automated processing mean that the data subject has the right to object at any time, based on their specific situation, to the processing of their personal data based on automated decisions. You have the right to avoid decisions based on any automatic personal data processing classified as profiling;
You have the right to file a complaint with Us, the Data Protection Inspectorate, or the court. Contact information for the Data Protection Inspectorate (AKI) can be found on the AKI website at: https://www.aki.ee/et/inspektsioon-kontaktid/tootajate-kontaktid.

Personal data collected for the identification and communication with the client can be viewed, amended, and supplemented on our website in the "My Account" area.

Cookies and Other Web Technologies

We may collect data about you via the website and other information society services, with your consent, using cookies (i.e., small information fragments stored by the browser on the computer or another device's hard drive) or similar technologies (e.g., IP address, device information, location data) and process this data.

We use collected data to allow the provision of the Service according to your habits; ensure the best service quality; inform you about the content of the service and make recommendations; make advertisements more relevant and enhance marketing efforts; facilitate login and data protection. The cookies in use can be categorized: necessary; preferences; statistics; marketing and yet unclassified. Necessary cookies help improve website usability, enabling basic features like navigation and access to protected sections of the site. The website does not function properly without these cookies. Preference cookies allow the website to remember information that changes its operation or appearance – e.g., your preferred language or location. Statistics cookies help website owners understand how visitors interact with the site by collecting and publishing data anonymously. Marketing cookies are used to track visitors across websites. The aim is to show the customer advertisements relevant and interesting to them, and therefore more valuable to publishers and third-party advertisers. Unclassified cookies are those we are still classifying together with individual cookie providers. Details can be reviewed before consenting to cookies. Permitting or prohibiting cookies and similar technologies is under visitor control through the cookie modal and cookie settings. You can change your consent settings or withdraw consent at any time.

Smartlook

To enhance user experience, some of our websites use Smartlook software. Smartlook allows us to measure and assess user activity (mouse movements, number of clicks, scrolling extent). For this purpose, Smartlook places cookies on the user's device and may record user data, such as browser, operating system, time spent on the website, and more. For detailed information about Smartlook data processing, visit https://help.smartlook.com/en/articles/3244454-data-security.

Personal Data Protection

C&C takes all precautions (including administrative, technical, and physical measures) to protect client personal data. Data may be modified and processed only by authorized persons. We retain personal data strictly for the minimum necessary period. We store personal data for up to 5 years from the last order or maintenance work. We also comply with accounting law requirements for data storage.

Personal data for which the retention period has expired are destroyed or anonymized using best practices.

Security

All personal data disclosed and obtained during visits to and purchases on the C&C e-shop are treated as confidential information. An encrypted data communication channel with banks ensures the security of personal data and banking details of the purchaser. In case a violation related to personal data occurs, we will take all necessary measures to mitigate consequences and manage future relevant risks. Among others, we register all incidents and, in the prescribed manner and format, inform the Data Protection Inspectorate and data subjects. All data on C&C's website, e-shop, and maintenance database are encrypted and treated as confidential information.

By using our website or completing the loyalty application, you have reviewed and acknowledged these principles and conditions. We reserve the right to amend the general terms of the privacy policy if necessary, by notifying on our website and, if possible, by email.

For any questions or concerns regarding privacy policy or data processing, please contact us at klienditugi@cec.ee

These privacy conditions were last amended in July 2025.

C&C EE is committed to protecting the privacy of clients and users. Accordingly, we have developed these privacy policy principles that address the collection, use, disclosure, transfer, and storage of personal data. Our online activities are in line with all relevant activities and the relevant legislation of the European Union and the Republic of Estonia. Take some time to review our privacy principles.

The controller responsible for the processing operations described in these privacy conditions is C&C EE OÜ (reg. code 10390835).

Collection and Composition of Personal Data

We collect the following types of personal data:

Personal data disclosed by you to us. For example, when you provide contact details (including your name, personal identification code, bank account number, postal address, phone number, email address, preferred method of contact) on our website or elsewhere (e.g., stores).

Personal data generated from regular communication (e.g., personal data transmitted via correspondence or the website's Askly communication tool).

Personal data obviously disclosed by you (e.g., on C&C's social media);

Personal data generated from the use of services (e.g., using our self-service or storing data concerning personal contact details or purchasing preferences when making a purchase or order in our store or e-store. C&C may request the voluntary submission of personal data and personal information in certain areas of the website. Required personal data may include name, address, postal code, email address, phone number, and other data) when submitting a hire purchase application. We also collect personal data when registering maintenance work at our representatives or online.

Personal data generated as a result of visiting and using the website. For example, data allowed from client account information or cookies upon using the website.

Personal Data Received from Third Parties.

For better customer service, iDeal may disclose information concerning individual persons to a third party providing services for iDeal. A third party could be, for example, our partner responsible for the transport of goods sold in the e-store or offering hire purchase services, advertising and marketing partners, payment service partners, partners providing recruitment-related services, companies conducting customer satisfaction surveys, debt collection service providers, credit reporting agencies, ICT partners, i.e., providers of various technical services, service providers for forwarding invoices. Transmission only occurs if the purpose of the transmission is legal and the third party processes the data under a contract which, inter alia, obliges the third party to keep the shared information confidential.

Related to Your maintenance work, iDeal processes personal data also through a web environment managed by a third party (maintenance base), whose data storing server is located within the European Union.

As a general rule, we do not transfer personal data outside the European Economic Area. If we transfer personal data outside the European Union, it takes place only following data protection legislation, if the European Commission has decided that this country provides adequate protection or, in the absence of such a decision, we have implemented appropriate safeguards (e.g., binding corporate rules or standard data protection clauses).

Collection of Other Data

We collect non-personalized data if the client has provided consent in the cookies modal—data that cannot directly be linked to a specific person (gender, age, language preferences, location). We may also collect data on general client activities in our stores and on the website. This data is aggregated and used so that we can provide more useful information to clients and find out which parts of the website, products, and services are most interesting. Aggregated data is treated as non-personal data in this privacy policy.

Purpose and Legal Basis for Using Collected Personal Data

As a basis for processing personal data under the law, we use the following foundations:

On the basis of consent, we process personal data to inform clients about C&C's product news, campaigns, and upcoming events. A client who does not wish to be on our newsletter list or receive notifications about products of interest can remove themselves from the recipient group at any time. Withdrawal of consent does not affect the legality of personal data processing before the withdrawal.

For fulfilling contractual obligations, we use collected personal data: to take measures before the conclusion of a contract; to identify the client to the extent required by due diligence duty; to fulfill the obligations towards the client in terms of service provision (e.g., using it for goods delivery); for communication with the client and ensuring the fulfillment of the client's payment obligation.

Note that the purpose of personal data processing may be further set out in a specific Agreement concluded with you.

For entering into an employment contract, processing of job applicant's personal data on the basis of contract execution and legitimate interest includes:

processing of data provided by the job applicant for the purpose of entering into an employment contract;

processing of data obtained from a person indicated as a referee by the job applicant and, in the absence of a referee, from the previous employer;

processing of personal data collected from public (social) media.

If a job applicant is not selected, we retain the personal data collected for the purpose of concluding an employment contract so that we can make a job offer in case of a suitable position opening, but not longer than 36 months.

Legitimate interest means Our interest in managing or administering our company to provide the best possible Services on the market. We process your personal data on the basis of legitimate interest for the following purposes:

ensuring a trustworthy client relationship, which involves processing personal data to prevent fraud;

managing and analyzing our client base to improve service availability, selection, and quality, and to make the best and most personalized offers to the client, with their consent;

Identifiers and personal data collected during the use of the website, our social media pages, and services. We use collected data for web analysis or analysis of information society services, to ensure the functionality of these channels, to improve, make statistics, analyze your behavior and usage experience, and provide better and more personalized service;

for organizing campaigns, including personalized and targeted campaigns, conducting customer satisfaction surveys, and measuring the effectiveness of marketing activities;

for making recordings. We may record information and orders given in our premises or via communication means (email, phone, etc.), also information and other operations we have made, and where necessary, we use these recordings to prove orders or other operations;

for network, information, and cyber security considerations, such as combating piracy and ensuring website security, and for backup measures and storage;

organizational purposes. Primarily for financial management and transmitting personal data within the group for internal administration purposes, including processing personal data of clients or employees;

we may share personal data if we conduct a business transaction or negotiate a business transaction involving our business or part of our assets. These transactions may include any merger, financing, acquisition, or bankruptcy transaction or proceeding;

for preparing, presenting, or defending legal claims;

if necessary, we also use the data to send exceptional notices linked to manufacturer safety factors or recall programs.

We use surveillance cameras in our stores. The purpose of using cameras and processing recordings is the protection of employees, visitors, and C&C EE OÜ property; ensuring security; legal claim protection and presentation; resolving complaints and using recordings as educational material. Recordings are deleted no later than 3 months after storage space is filled.

We also process your personal data for fulfilling obligations arising from the Law. For instance, the obligations arising from the processing of payments or the compliance with anti-money laundering rules.

If personal data is processed for a purpose other than that for which it was collected, we carefully analyze the feasibility of this processing in accordance with data protection legislation (General Data Protection Regulation, 2016/679, Article 6(4)).

Disclosure and/or Transmission of Personal Data to Third Parties

For better customer service, C&C may disclose information concerning individual persons to a third party providing services for C&C. A third party might be such as our partner responsible for transport of goods sold in the e-store or offering hire purchase services, buy-back services, advertising and marketing partners, payment service providers, recruitment-related service providers, companies conducting customer satisfaction surveys, debt collection service providers, credit reporting agencies, ICT partners, i.e., providers of various technical services, service providers for forwarding invoices. Transmission only occurs if the purpose of transmission is legal and the third party processes the data under a contract which inter alia obliges the third party to keep the shared information confidential.

Related to Your maintenance work, C&C processes personal data also through a web environment managed by a third party (maintenance base), whose data storing server is located within the European Union.

As a general rule, we do not transfer personal data outside the European Economic Area. If we transfer personal data outside the European Union, it only happens following data protection legislation and if the European Commission has decided the country provides adequate protection or, in the absence of such a decision, we have implemented appropriate safeguards (e.g., binding corporate rules or standard data protection clauses).

Modification of Collected Personal Data and Your Rights

When processing personal data, you have the following rights as a data subject:

You have the right to get information about the personal data collected about you.
You have the right to access the data which includes your right to a copy of the personal data being processed.
You have the right to correct inaccurate personal data.
You may have the right to data deletion, i.e., in certain cases, you have the right to request that personal data be deleted, for example, if processing is only based on consent. With data deletion, all personal benefits granted to you also cease.
The right to request the restriction of personal data processing.
You have the right to data portability, i.e., in certain cases, you have the right to receive personal data in a machine-readable format to carry with you or transmit to another controller.
You have the right to the supervisory authority's assessment of whether the processing of your personal data is lawful.
You have the right to compensation for damage if damage is caused by personal data processing.
Rights related to automated processing mean that the data subject has the right, based on their specific situation, to object at any time to the processing of their personal data, based on automatic decisions. You have the right to avoid any decisions based solely on automated processing of personal data, if they can be categorized as profiling;
You have the right to submit a complaint to us, the Data Protection Inspectorate, or the court. The Data Protection Inspectorate (AKI) contact details can be found on the AKI website at: https://www.aki.ee/en/introduction-contacts/staff-contact-information.

You can see, change, and supplement the personal data collected for your identification and contact in the "My Account" area on our website.

Cookies and Other Web Technologies

We may collect data about you through the website and other information society services, with your consent, using cookies (small pieces of information stored by the browser on the computer's or other device's hard drive) or similar technologies (e.g., IP address, device information, location information) and process this data.

We use collected data to enable the provision of the Service according to your habits; ensure the best service quality; inform you about the content of the service and make recommendations; make advertisements more relevant and improve marketing efforts; facilitate logging in and data protection. The used cookies can be categorized into: necessary, preferences, statistics, marketing, and yet unclassified. Necessary cookies help in making the website usable by enabling basic functions like page navigation and access to secure areas of the site. The website cannot function properly without these cookies. Preference-related cookies allow the website to remember information that changes how the website behaves or looks—e.g., your preferred language or location. Statistical cookies help website owners understand how visitors interact with sites by collecting and reporting information anonymously. Marketing cookies are used to track visitors across websites. The objective is to display ads that are relevant and engaging to the user and thus more valuable to publishers and third-party advertisers. Unclassified cookies are cookies we are still in the process of classifying together with the individual cookie providers. Details can be familiarized with even before agreeing to cookies. Allowing or forbidding cookies and other similar technologies is within the visitor's control through the cookies modal and cookies settings. You can change your consent settings at any time or withdraw consent.

Smartlook

To enhance user experience, some of our websites use Smartlook software. Smartlook allows us to measure and evaluate user activity (mouse movements, clicks, scroll depth). For this purpose, Smartlook places cookies on the user's device and may record user data, e.g., regarding the browser, operating system, time spent on the website, etc. More detailed information regarding data processing by Smartlook can be found at: https://help.smartlook.com/en/articles/3244454-data-security.

Protection of Personal Data

C&C takes all precautions (including administrative, technical, and physical measures) to protect client’s personal data. Access to modify and process data is only for authorized persons. We keep personal data only for the strictly necessary time. We retain personal data for up to 5 years from the last order or maintenance work. Data storage is also based on the requirements of the accounting law.

Personal data for which the retention period has expired is destroyed or anonymized using best practices.

Security

All personal data obtained during visits to the C&C e-shop and making purchases are treated as confidential information. An encrypted data communication channel with banks ensures the security of personal data and bank requisites of the person completing the transaction. In the case of any breach related to personal data, we will take all necessary measures to alleviate the consequences and mitigate relevant risks in the future. Among other things, we will register all incidents and notify the Data Protection Inspectorate and data subjects, if the situation requires and in the manner provided. All information on the C&C website, e-store, and maintenance database is encrypted and treated as confidential data.

By starting to use our website or completing a loyalty customer application, you have read and accepted these principles and terms. We reserve the right to change the general terms of the privacy policy if necessary, notifying on our website and, where possible, via email.

For any questions or concerns about the privacy policy or data processing, please contact us at klienditugi@cec.ee

These privacy terms were last modified in July 2025.

C&C

SUPPORT

Manufacturer's warranty

Private copying levy