Privacy Policy

What personal data GRILLY collects, why, who sees it and for how long. Version 1, 18 September 2026

Controller

BBQÄssad OÜ (GRILLY), Pärnu mnt 230/1, 11314 Tallinn, Estonia, company no. 16583831. Questions about your data: info@grilly.eu.

What we collect and why

  • Order data – name, delivery and billing address, email, phone, what you bought, payment method (never full card numbers – those go directly to the payment provider). Needed to fulfil the contract (GDPR art. 6(1)(b)) and kept for accounting under Estonian law (art. 6(1)(c)).
  • Account data – if you create an account: login, saved addresses, order history. Based on the contract; you can delete the account at any time from My account or by writing to us.
  • Customer service – emails and calls with us. Legitimate interest in answering you and keeping a record of what was agreed (art. 6(1)(f)).
  • Website usage – with your consent (art. 6(1)(a)): Google Analytics 4 via Google Tag Manager, to see which pages and products are used. Without consent, Google’s tag sends only anonymous, cookieless signals that cannot identify you. See Cookies.
  • Server logs – IP address, browser, pages requested, kept by our hosting provider for security for a short period. Legitimate interest.
  • Marketing emails – only if you sign up; you can unsubscribe in every email. We do not run a newsletter at the moment.

Who receives data

We share data only with providers needed to run the shop, under contracts that bind them to protect it:

  • Zone Media OÜ (Estonia) – hosting and email.
  • WooPayments / Stripe – card, Apple Pay and Google Pay processing; Stripe processes data in the EU and the USA under EU standard contractual clauses.
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) – if you pay with PayPal.
  • Omniva (AS Eesti Post) and its partner carriers – name, address, phone and email for delivery and delivery notifications.
  • Google Ireland Ltd – Google Analytics and Tag Manager, only with your consent; IP addresses are truncated.
  • Our accountant – invoice data as required by law.
  • Authorities where the law requires it.

How long we keep it

  • Orders and invoices: 7 years after the end of the financial year (Estonian Accounting Act).
  • Account: until you delete it or after 3 years without orders or logins.
  • Customer service emails: 2 years.
  • Analytics data: 14 months in Google Analytics.
  • Cookies: see the lifetimes on the Cookies page.

Your rights

You can ask us for access to your data, correction, deletion (where we are not required to keep it), restriction, portability of the data you gave us, and you can object to processing based on legitimate interest. Consent can be withdrawn at any time, for cookies via cookie settings. Write to info@grilly.eu; we answer within one month. You also have the right to complain to a supervisory authority – in Estonia the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or the authority in your own country.

Security

The site runs over HTTPS. Payment details are entered on the payment provider’s secure forms and never stored by us. Access to order data is limited to staff who need it.

Changes

We update this page when our processing changes; the date at the top tells you which version you are reading.