This privacy policy, hereinafter referred to as the Policy, describes the procedure by which Matkavarustus OÜ, hereinafter referred to as Outdoor Equipment, processes personal data.

1. Definitions

Processing – any operation or set of operations performed on personal data or sets of personal data, with or without automated means, such as collection, registration, organization, structuring, storage, adaptation or transformation, retrieval, viewing, use, disclosure, sending , distributing or otherwise making them available, matching or combining, limiting, erasing or destroying.

Data Manager – OÜ “Matkavarustus”, Reg. No. 16523601, Legal adreess: Tähesaju tee 9 Lasnamäe linnaosa, Tallinn Harju maakond 11313

Customer – any natural or legal person who uses, has used, or has expressed a desire to use any services provided by Outdoor Equipment or is in any other way related to them;

Personal data – any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be directly or indirectly

identified, in particular by reference to an identifier such as the said person’s name, surname, identification number, location data, online identifier or one or more physical, physiological, genetic, spiritual, economic, cultural or social identity factors.

1. Applicable law

• Regulation No. 2016/679 of the European Parliament and the Council on the protection of natural persons with regard to the processing of personal data and the free movement of such data (April 27, 2016). 2.2.
• Advertising law.

1. General terms

1. This Policy provides general information about how we process personal data. Detailed information on the processing of personal data is provided to the Clients, including it in contracts and other documents related to our services, as well as on our website

1. We ensures the confidentiality of personal data within the framework of applicable laws and regulations and have implemented appropriate technical and organizational measures to protect personal data from unauthorized access, illegal processing or disclosure, accidental loss, alteration or destruction.
   
2. We may use approved personal data processors for personal data processing. In such cases, we takes the necessary measures to ensure that such personal data processors process personal data in accordance with our instructions and in accordance with the applicable regulatory legislation and require the implementation of appropriate security measures.

1. If we update this Policy, the current version of the policy will be immediately published at our website.

1. In order to provide the Customer with better and more suitable products and services, as well as to provide, maintain, protect and improve existing products and services, we process data collected from the provision of services.

1. Good practice

We follow the principles of good practice when processing personal data:

• Legality and transparency
• Purpose limitations
• Data minimization
• Accuracy
• Storage limit
• Integrity and confidentiality

1. Categories of personal data

1. Identification data, such as name, surname, personal identification number, date of birth (for non-residents);

1. Contact information such as address, phone number, email address.

1. Information about current payment accounts.

1. Data related to the services, such as fulfillment or non-fulfillment of contracts, transactions made, concluded and expired contracts, submitted applications, requests and complaints.

1. Communication data, such as e-mail, letter or other information related to the Client’s communication with us;

1. Data that the Customer himself reports to us;

1. Photographs – from corporate or public events;

1. Data that our customers transfer to us for the purpose of publishing advertisements, announcements, etc.
   

1. Legal basis for data processing

1. Conclusion and performance of the contract – in order for us to be able to conclude and fulfill the contract with the Client, providing high-quality services and serving the Client, it must collect and process certain personal data that is collected before concluding the contract with us or during the already concluded contract.

1. Our legitimate interests – respecting our interests, which are based on the provision of quality services and timely support to the Client, we have the right to process the Client’s personal data to the extent that it is objectively necessary and sufficient for the purposes indicated in this Policy. The legitimate interests of our company are considered to be the processing of personal data during direct marketing, as a result of which new and/or individual offers of our products and services are presented to the Client. We have a legitimate interest in processing its Clients’ data in order to offer Clients products and services that meet modern requirements.
2. Fulfillment of legal obligations – we are entitled to process personal data in order to fulfill the requirements of regulatory acts, as well as to provide answers to legal requests of the state and local government.
3. Customer’s consent – The customer, as the subject of personal data, gives his consent to the collection and processing of personal data for certain purposes. The client’s consent is his free will and independent decision, which can be given at any time, thus allowing us to process personal data for the specified purposes. The

Client’s consent is binding if it is given orally (during the meeting after the Client’s identification) or in writing (by filling in the form agreement, sending the electronic

request to the registration at www.outdoorequipment.ee user profile sections. The customer has the right to withdraw his previously given consent at any time by using the indicated communication channels with us. The changes applied will take effect within 10 business days. The withdrawal of consent does not affect the legality of the processing, which is based on the consent before the withdrawal.

1. Execution of official powers – we are entitled to process data in order to fulfill the official powers legally granted to us. In such cases, the basis for personal data processing is included in regulatory acts.

1. Purposes of data processing

1. For general management of customer relations and provision of access to products and services, and administration – to conclude and execute a contract with the Customer; to ensure the relevance and correctness of the data by checking and supplementing the data.
2. To ensure high-quality, timely and convenient service for the Customer during the validity of the contractual relationship:
   1. For the management of customer relations (including remote), ensuring the conclusion and execution of Agreements, as well as the implementation of related processes;
   2. For handling customer complaints and providing support in connection with the
      

services provided;

1. Effective cash flow management, including customer payment and debt administration;
2. To inform the customer about other products and services provided by us;

1. We are entitled to process data for the following purposes, as well as for other purposes, upon receiving the freely given and unequivocal consent of the Client:
   1. direct marketing activities;
   2. for promoting our image in the market, sending good wishes to the Client, awarding bonuses, organizing surveys for the improvement of existing products and services, as well as for the creation of new products;
2. We process personal data in order to promote the development of the industry and offer new services to Customers, including:
   1. for creating or offering new products and making offers about them;
   2. statistical data of our customers is processed for market analysis and business model development;
3. We process personal data in order to create and maintain our internal processes, ensure the circulation of documents and other internal processes (e.g., archiving of contracts and other documents) to the necessary and sufficient extent.
4. We process personal data by photographing and filming clients at corporate, public events.
5. We processes personal data by photographing and filming customers for advertising videos, photos and other marketing purposes.

1. Rights of the Data subject

The data subject has rights regarding the processing of his data, which are classified as personal data in accordance with the applicable laws and regulations. These rights are generally as follows:

1. Request correction of your personal data if it is inadequate, incomplete or incorrect.
2. Object to the processing of your personal data if the processing is based on legitimate interests, including objecting to personal data profiling.
3. Request the deletion of your personal data, for example, if the personal data is processed on the basis of consent and the Customer has withdrawn his consent. This right does not apply if the Personal Data whose deletion is requested is processed also on the basis of another legal basis, such as a contract or the obligations arising from relevant regulatory enactments, or their preservation is determined by the requirements of the applicable regulatory enactments.
4. Limit the processing of your personal data in accordance with the applicable regulatory enactments, for example, when we evaluate whether the data subject has the right to delete his data.
5. To receive information on whether we process personal data and, if processed, to access them.
6. Receive personal data provided by the Client to us and which are processed on the basis of consent and performance of the contract in written form or in one of the
   

more commonly used electronic formats and, if possible, transfer such data to another service provider (data portability).

1. To withdraw your consent to the Processing of your Personal Data.
2. Not to be subjected to fully automated decision-making, including profiling, if such decision-making has legal consequences or which significantly affects the Customer in a similar way.
3. Submit complaints about the use of personal data to the Data State Inspectorate (www.riigikohus.ee) if the Client believes that the processing of his personal data violates his rights and interests in accordance with the applicable regulatory enactments.

1. Profiling of personal data as data processing

1. Profiling is any type of automated processing of personal data, which manifests as the use of personal data for the purpose of evaluating specific personal aspects related to a natural person, in particular analyzing or predicting aspects related to the said natural person’s personal wishes, interests, reliability, behavior, location or movement;

9.1.2. By processing the Customer’s personal data, we can perform profiling in order to send nice wishes, gifts, award bonuses, create and express individual offers.

Automated individual decisions are made for business purposes only and will not create legal consequences for the Client. The customer has the right to object to the adoption of an automated decision at any time and not to be the subject of such a decision.

1. Direct marketing and the basis for sending commercial notices to the Client: we conduct direct marketing by distributing commercial notices to the Client, so that the Client is always informed about new, modern and/or products, services created directly for the Client, as well as special contract terms (e.g. discounts). The customer has the right to refuse receiving commercial notices at any time and free of charge by informing us about it.

1. Cookies

In order to make visiting our website attractive and to enable the use of certain functions, to display suitable products or for market research, we use technologies on various pages, including so-called cookies. Cookies are small text files that are automatically stored on your end device. Some of the cookies we use are deleted after the end of the browser session, i.e. after closing your browser (so-called session cookies). Other cookies remain on your end device and enable us to recognise your browser during your next visit (persistent cookies).

Protection of privacy for terminal devices

When you use our online services, we use technologies that are absolutely necessary in order to provide the telemedia service you have expressly requested. The storage of information in your terminal device or access to information that is already stored in your terminal device does not require consent in this respect.

For functions that are not absolutely necessary, the storage of information in your terminal device or access to information that is already stored in your terminal device requires your consent. Please note that if you do not give your consent, parts of the website may not be available for unrestricted use. Any consent you may have given will remain valid until you adjust or reset the respective settings in your terminal device.

In addition, we use technologies to fulfil the legal obligations, which we are subject to (e.g. to be able to prove consent to the processing of your personal data) as well as for web analysis and online marketing. Further information on this, including the respective legal basis for data processing, can be found in the following sections of this privacy policy.

Any downstream data processing through cookies and other technologies

We use such technologies that are strictly necessary for the use of certain functions of our website (e.g. shopping cart function). These technologies are used to collect and process IP addresses, time of visit, device and browser information as well as

information on your use of our website (e.g. information on your preferences). This serves to safeguard our legitimate interests in an optimised presentation of our offer that are overriding in the process of balancing of interests.

You can find the cookies settings for your browser by clicking on the following links: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™

If you have consented to the use of the technologies in accordance with Art. 6 (1) (a) GDPR, you can withdraw your consent at any time by sending a message to the contact option described in the privacy policy.

How can I configure the cookie settings of my browser?

Each browser is different in the way it manages cookie settings. This is described in the help menu of each browser, which explains how to change your cookie settings. You can find these for each browser under the following links:

Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™ What types of cookies are being used?

Functional cookies: These cookies are used for certain features of our website, e.g. to improve the website’s navigation, or deliver to you customised and relevant

information (e.g. ads that match your interests).

Targeting cookies: These cookies record information about your visit to the website, previously viewed pages and links you clicked. We use this information to tailor our website and displayed ads to your interests.

Marketing Cookies: These cookies record information about your visit to the website, previously viewed pages and links you clicked. We use this information to tailor our website and displayed ads to your interests.

Analytical / performance cookies: These cookies enable collecting anonymised data about user behaviour on our website. We analyse them e.g. to improve the functionality of our website and recommend you products that will be interesting to you.

Essential cookies: These cookies are necessary to enable you to use our website. This includes e.g. cookies that enable you to log into the customer area or add items to your shopping cart.

Use of Google services

We use the following technologies of Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The information automatically collected by

Google technologies about your use of our website is usually transferred to a server of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA and stored there. There is no adequacy decision with respect to the USA by the

European Commission. Our cooperation is based on standard data protection clauses adopted by the European Commission. If your IP address is collected using Google technologies, it will be shortened by activating IP anonymisation before being stored on Google’s servers. Only in exceptional cases will the full IP address be transferred to a Google server and shortened there. Unless otherwise specified for the specific technologies, data processing is based on an agreement concluded for the respective technology between jointly responsible parties in accordance with Art. 26 GDPR. Further information about data processing by Google can be found in Google’s privacy policy.

Google Analytics

For the purpose of website analytics, Google Analytics automatically collects and stores data (IP address, time of visit, device and browser information as well as

information on your use of our website), from which usage profiles are created using pseudonyms. Cookies can be used for this purpose. Your IP address will not be merged with other data from Google. The data processing is based on a data processing agreement with Google.

Google Ads

For advertising purposes in the Google search results as well as on the websites of third parties, the so-called Google Remarketing Cookie is used when you visit our website, which automatically enables interest-based advertising through the collection and processing of data (IP address, time of visit, device and browser

information as well as information on your use of our website), by means of a pseudonymous cookie ID and on the basis of the pages you visit. Any further data processing only takes place if you have activated the setting “personalised advertising” in your Google account. In this case, if you are logged into Google while visiting our website, Google will use your data together with Google Analytics data to create and define target group lists for cross-device remarketing.

For website analysis and event tracking, we use Google Ads Conversion Tracking to measure your subsequent usage behavior when you arrive on our website via a Google Ads ad. For this purpose, cookies may be used and data (IP address, time of visit, device and browser information as well as information on your use of our

website based on events specified by us, such as a visit to a website or newsletter registration) may be collected, from which usage profiles are created using pseudonyms.

Google Fonts

For the purpose of a uniform presentation of the contents on our website, data (IP address, time of visit, device and browser information) are collected by the script code “Google Fonts”, transmitted to Google and then processed by Google. We have no influence on this subsequent data processing.

YouTube Video Plugin

In order to integrate third party content, data (IP address, time of visit, device and browser information) are collected via the YouTube Video Plugin in the expanded data protection mode used by us, transmitted to Google and then processed by Google only when you play a video.

1. Social Media

1. Social Plugins by Facebook (by Meta), Instagram (by Meta)

Social buttons by social networks are used on our website. These are only integrated into the page as HTML links, so that no connection to the servers of the respective provider is established when our website is accessed. If you click on one of the buttons, the website of the respective social network will open in a new window of your browser. There you can click e.g. the Like or Share button.

1. Our online presence on Facebook (by Meta), Youtube, Instagram (by Meta), Xing, LinkedIn

If you have given your consent to the respective social media provider in accordance with Art. 6 (1) (a) GDPR, when you visit our online presence on the social media mentioned above, your data will be automatically collected and stored for market research and advertising purposes, from which user profiles are created using pseudonyms. These can be used, for example, to place advertisements within and outside the platforms that presumably correspond to your interests. Cookies are usually used for this purpose. For detailed information on the processing and use of data by the respective social media provider, as well as a contact option and your rights and settings options for the protection of your privacy, please refer to the provider’s privacy policies linked below. Should you still require assistance in this regard, please contact us.

Facebook (by Meta) is provided by Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland (hereafter “Meta Platforms Ireland “) The information automatically collected by Meta Platforms Ireland about your use of our online

presence on Facebook (by Meta) is usually transferred to a server of Meta Platforms, Inc., 1 Hacker Way, Menlo Park, California 94025, USA and stored there. There is no adequacy decision for the United States by the European Commission. Our cooperation is based on standard data protection clauses adopted by the European Commission. Data processing in the context of a visit to a Facebook (by Meta) fan page is based on an agreement between joint controllers in accordance with Art. 26 GDPR. Further information (information on Insights data) can be found here.

Instagram (by Meta) is provided by Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland (hereafter “Meta Platforms Ireland “) The information automatically collected by Meta Platforms Ireland about your use of our online presence on Instagram is typically transferred to and stored on a server at Meta Platforms Inc, 1 Hacker Way, Menlo Park, California 94025, USA. There is no adequacy decision for the United States by the European Commission. Our

cooperation is based on standard data protection clauses adopted by the European Commission. Data processing in the context of a visit to an Instagram (by Meta) fan page is based on an agreement between joint controllers in accordance with art. 26 DSGVO. Further information (information on Insights data) can be found here.

YouTube is provided by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (hereafter “Google”). The information automatically collected by Google about your use of our online presence on YouTube is generally transferred to a server of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA and stored there. There is no adequacy decision for the United States by the

European Commission. Our cooperation is based on standard data protection clauses adopted by the European Commission.

1. Contact options

12.1 The customer can contact us in connection with questions, withdrawal of consent, requests, exercise of the rights of data subjects and complaints about the use of personal data.

12.2. our contact information is available on the website: https://outdoorequipment.ee/contact-us