Legal notice and privacy

Operator

• Brand: MIU Kids
• Company: Greenback OÜ
• Registry code: 11903107
• Country: Estonia
• Website: www.miukids.eu
• Email: info@miukids.eu

What we process

• Name, so we know who the order belongs to.
• Email, phone and language, so we can reach you about the delivery.
• Delivery address or the parcel locker you chose.
• The products, quantities, payment method and date of the order.
• Payment references from the payment provider. We do not ask you to send a full card number by email.

Why

• To take the order, pack it and hand it to the carrier.
• To pass the payment through the payment provider.
• To answer questions and handle a return or a fault.
• To send a newsletter only if you have asked for it.

Who else receives data

We pass your name, phone and delivery details to the carrier you select, so the parcel can reach you.

Your rights and cookies

You may ask to see, correct or delete your data, or to limit how we use it, by writing to this shop. You may also lodge a complaint with a supervisory authority. Cookies are explained in full in the section below. We do not use advertising cookies. Analytics cookies are used only after you accept them.

Why we use them

Necessary cookies exist so that the thing you came to do can happen. Without them the basket forgets the product, the checkout cannot tell one visitor from another, the language and currency would reset, and we could not remember that you had already refused analytics.

Analytics cookies exist for a narrower reason. They tell us which pages families actually use, so we can improve the shop. They are not required for buying. That is why they wait for a yes.

Necessary cookies, and why they do not need a separate yes

European law requires consent before information is stored on your device or read from it. The same law makes a narrow exception where the storage is strictly necessary to provide a service you have explicitly asked for, or solely to carry a communication. Opening this shop and using the basket or checkout is that request.

We rely on that exception only for the shop cookie and for the cookie that stores your choice. We do not stretch it to cover measurement, advertising or profiles. The exception is interpreted narrowly, and analytics does not fall inside it.

• Shop cookie. Keeps the basket, the language, the currency and a signed-in session. It lasts up to 20 days, so a basket can still be there when you return. Some session data ends when you close the browser.
• Choice cookie, named miu_cc. Remembers whether you accepted analytics or kept only necessary cookies. It lasts six months. It is necessary, because without it we would have to ask on every page, and we could not honour a refusal.

Analytics, only after you accept

When you arrive, analytics cookies are off. We do not store an analytics cookie until you press “Accept all cookies”. Google may receive a cookieless visit signal so we can count visits. That signal does not use an analytics cookie and is not used for advertising. Silence, scrolling and closing the notice are not a yes. The analytics switch in settings is off until you turn it on. A pre-ticked box would not be consent.

If you accept, Google Analytics, provided for visitors in the European Economic Area by Google Ireland Limited, receives a measurement of the pages you open: that a page was viewed, roughly when, and a technical identifier stored in the analytics cookie. We use that to see which pages help families. We do not use it to build advertising profiles, and we do not sell it.

You can refuse in one click, with “Necessary only”, on the same screen and in a button of the same size. Refusing does not block the shop. If you accept and later change your mind, the link at the bottom of every page opens the same choice. Withdrawal is as easy as acceptance, and it does not affect a contract you have already made. When you refuse, or withdraw, we tell Google to stop analytics storage and we delete the analytics cookies we can delete from this browser.

• _ga, only after acceptance. Recognises a returning browser for measurement. Google’s usual lifetime is up to 24 months.
• _gid, only after acceptance. Distinguishes visitors during the day. It usually lasts 24 hours.
• _gat, only after acceptance. Slows down how often measurements are sent. It usually lasts about a minute.

What we do not use

• No advertising cookies, and no cookies that build a profile for ads. Advertising storage stays denied.
• No social-media cookies and no third-party marketing tags.
• No sale of cookie data, and no use of analytics to decide what price you see.
• A newsletter is separate. We send one only if you have asked for it. That request is not hidden inside the cookie choice.

How the law applies, country by country

The common rule is Article 5(3) of Directive 2002/58/EC, as amended by Directive 2009/136/EC. Consent, where it is required, has the meaning in the General Data Protection Regulation (EU) 2016/679: freely given, specific, informed and unambiguous, by a clear affirmative act. Articles 4(11), 6(1)(a), 7 and 13 are the ones that matter here. Legitimate interest is not a lawful substitute for that consent when a non-essential cookie is stored or read.

For the personal data inside an order, the legal basis is the contract, Article 6(1)(b). The cookie exception above is what allows the necessary cookies themselves. Analytics, once you accept, rests on consent, Article 6(1)(a). You may withdraw that consent at any time, Article 7(3).

Finland. Section 205 of the Act on Electronic Communications Services (917/2014) requires clear information and consent before storage or access, with an exception only for what is strictly necessary to provide the service you requested. Finnish case law has confirmed that audience measurement, including a measurement call, is not inside that exception, and that refusing must not be harder or slower than accepting. The data-protection authority is the Office of the Data Protection Ombudsman. Traficom supervises the cookie rule.

Latvia. Section 7.1 of the Law on Information Society Services requires consent after clear and comprehensive information, with the same narrow exception for a service the user requested. The authority is the Data State Inspectorate (DVI).

Lithuania. Article 73(4) of the Law on Electronic Communications requires prior consent after clear information. Analytics is not one of the two exceptions. The authority is the State Data Protection Inspectorate (VDAI).

Estonia, where the company is established. The same Directive rule and the General Data Protection Regulation apply, together with the Estonian Personal Data Protection Act. The authority is the Data Protection Inspectorate (AKI).

If you live in another EU or EEA country, your own national implementation of Article 5(3) applies to the cookie, and you may complain to your national data-protection authority. A list of those authorities is published by the European Data Protection Board.

Your rights

You may ask to see the personal data we hold, to correct it, to delete it, to restrict it, and to receive a copy you can move. Where a use rests on consent, you may withdraw it. Where a use rests on the contract, we keep what we still need to perform it, for accounting, or for a legal claim. The retention periods higher up on this page still apply to orders.

Write to the email address shown at the top of this page. You may also complain to the authority of the country where you live, or of the country where the issue arose. We would rather hear from you first.