Order before 18:00 — dispatched same evening · Free delivery from 49€

Privacy policy

Last updated: 2 December 2025

This Privacy Policy explains how Rosamus OÜ (the KUMII online store) collects, uses, stores, and protects your personal data.

Data Controller:
Rosamus OÜ
Registry Code: 17346851
VAT No.: EE102911644
Address: Pikk tn 20a, Pärnu, Pärnumaa, 80013
Email: info@kumii.ee

1. General Provisions

1.1. This Privacy Policy governs the principles of collecting, processing, and storing personal data in the KUMII online store.
1.2. A data subject is a natural person (a customer or website visitor) whose personal data is processed by Rosamus OÜ.
1.3. A customer is a person who purchases goods from the KUMII online store or creates a user account (if this feature is available).
1.4. Rosamus OÜ processes personal data lawfully, fairly, and securely, and only for the purpose for which it was collected. If necessary, we can demonstrate how and why personal data has been processed.

2. Collection, Processing, and Storage of Personal Data

2.1. Personal data is primarily collected:

  • When placing an order on the KUMII website
  • When communicating with customer support via email (info@kumii.ee)
  • When subscribing to the newsletter (if available)
  • Through cookies and similar technologies (website usage information)

2.2. By submitting their data (e.g., when making a purchase, creating an account, or subscribing to the newsletter), the data subject grants Rosamus OÜ the right to process this data for the purposes described in this Privacy Policy.
2.3. The data subject is responsible for ensuring that the data provided is true, accurate, and up-to-date. Submitting incorrect data may hinder the correct fulfilment of an order.
2.4. If your data changes, please inform us immediately at info@kumii.ee.
2.5. Rosamus OÜ is not liable for any damage caused to the data subject or third parties due to the submission of incorrect data.

3. Types of Customer Personal Data and Purposes of Processing

3.1. Personal Data Processed

Rosamus OÜ may process the following data (depending on the specific action):

  • First and last name
  • Email address
  • Telephone number
  • Delivery address (including postcode, city, country – currently Estonia)
  • Order information (products purchased, quantities, prices, delivery method, order date)
  • Preferred payment method (e.g., Visa/Mastercard, specific online bank)
  • Communication with customer support (email correspondence)
  • Newsletter preferences (if the customer has given consent)
  • Web usage data (IP address, device and browser type, cookie information)

NB! KUMII does not see or store full bank account details or payment card numbers – payments are processed by Maksekeskus AS in their secure environment.

3.2. If necessary, Rosamus OÜ may use information available from public registers (e.g., to assess the fulfilment of payment obligations, where justified).

3.3. Legal Bases for Processing Personal Data

Personal data is processed primarily on the following bases:

  • Performance of a contract – to accept, fulfil, and deliver an order
  • Legal obligation – to comply with accounting, tax, and consumer protection obligations
  • Consent – for example, to send newsletters, if the customer has given separate consent
  • Legitimate interest – to develop KUMII's business, prevent fraud, and ensure website security

3.4. Purposes of Processing and Retention Periods

Rosamus OÜ processes personal data for the following purposes:

a) Processing and delivering orders

  • Data: name, contact details, delivery address, order information
  • Retention: generally up to 3 years from the fulfilment of the order (period for consumer disputes and claims)

b) Accounting and fulfilling legal obligations

  • Data: information on invoices, payment and transaction data
  • Retention: up to 7 years in accordance with accounting requirements

c) Customer communication and management

  • Data: contact details, correspondence, feedback
  • Retention: up to 3 years from the last active contact

d) Marketing and newsletters (if the customer has given consent)

  • Data: name, email address, preferences
  • Retention: up to 3 years from the last interaction or until consent is withdrawn

e) Website operation and security (cookies, logs)

  • Data: IP address, cookie information, technical logs
  • Retention: generally for 1 year, unless a longer period is required by law

3.5. Sharing of Personal Data

Rosamus OÜ may share data only to the extent necessary to fulfil a specific purpose:

  • Maksekeskus AS – for payment processing (bank links, card payments)
  • Logistics partners – Omniva, Smartpost Itella, DPD (information required for goods delivery)
  • IT and hosting partners – to ensure the operation and security of the online store

All partners process data in accordance with applicable data protection requirements and only to the extent necessary to provide the service.

3.6. Security

Rosamus OÜ implements organisational and technical measures to protect personal data:

  • limiting access rights
  • secure servers and connections (HTTPS)
  • regular system updates
  • access logging and monitoring

4. Rights of the Data Subject

You always have control over your data. The data subject has, among others, the following rights:

4.1. Right of access to data – the right to know what personal data is being processed about you.
4.2. Right to rectification – if your data is inaccurate or has changed, you have the right to have it updated.
4.3. Right to erasure (“right to be forgotten”), if:

  • the data is no longer needed for the purposes for which it was collected
  • consent has been withdrawn
  • the processing is based solely on consent or legitimate interest and there is no other basis for processing
    (it should be noted that legal obligations – e.g., accounting data – may not allow for immediate erasure)

4.4. Right to restriction of processing – in certain cases, you have the right to restrict the active use of your data.
4.5. Right to object to processing – if the processing is based on a legitimate interest, you have the right to object to it.
4.6. Right to withdraw consent – if the processing of data is based on consent (e.g., for a newsletter), you can withdraw it at any time.
4.7. Right to data portability – the right to receive your data in a structured, commonly used format and to transmit it to another service provider, where technically feasible.

4.8. Exercising Your Rights

To exercise your rights, please contact:
info@kumii.ee

Please include in your request:

  • your name
  • contact details
  • which right you wish to exercise (e.g., data erasure, rectification)

Rosamus OÜ will generally respond to requests within 30 days.

4.9. Right to Lodge a Complaint

If you feel that your rights have been violated, you have the right to lodge a complaint with:

  • The Data Protection Inspectorate (www.aki.ee)
  • or the supervisory authority in your country of residence (if you live outside of Estonia)

5. Final Provisions

5.1. This Privacy Policy has been drawn up in accordance with applicable data protection requirements (including the General Data Protection Regulation – GDPR).
5.2. Rosamus OÜ may update this Privacy Policy to reflect changes in our services, legislation, or technical solutions.
5.3. The updated Privacy Policy will be published on the KUMII website www.kumii.ee and will apply from the date of publication or the date specified in the notice.
5.4. For any questions, requests, or concerns regarding the processing of personal data, please write to: info@kumii.ee.