Privacy policy

Last updated: 6 October 2026

This privacy policy explains how the H Market online store (“H Market”, “we”) collects, uses and protects your personal data. We process data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Estonian Personal Data Protection Act.

1. Controller

2. What data we collect

• Order data: first and last name, email, phone number, delivery address or chosen parcel locker, products ordered, amount, payment method and order history.
• Payment data: payment status and transaction reference. We never see or store card or bank account details — payments are processed by ESTO.
• Communication: emails and product enquiries (name, email, phone, message) you send us. Enquiries are kept in our customer management system for up to 24 months.
• Technical data: server logs (IP address, browser type, time of visit) kept briefly for security purposes.

3. Why and on what basis we process data

We do not use your data for automated decision-making and we never sell it. We only send marketing newsletters with your separate consent.

4. Who we share data with

• ESTO AS — payment provider (bank link, pay in 3, hire purchase, pay later). For hire purchase and instalments ESTO makes the credit decision as an independent controller under its own privacy terms (esto.ee).
• Banks — for bank link payments.
• Couriers and parcel locker operators (e.g. Omniva, DPD) — name, phone, email and address to deliver your order.
• Suppliers and manufacturers — where needed to fulfil the order or handle a warranty claim.
• IT service providers — hosting and email, processing data on our instructions.
• Authorities — where required by law.

Data is processed within the European Economic Area. If a provider is located outside the EEA, we safeguard your data with the European Commission’s standard contractual clauses.

5. How long we keep data

• Order and invoice data — 7 years (Accounting Act).
• Warranty and complaint data — until claims expire (generally 3 years).
• Server logs — up to 90 days.

6. Cookies and browser storage

H Market does not use advertising cookies. We only use your browser’s local storage (localStorage) to remember your bag, recently viewed products and, if you choose, your checkout contact details. This data stays on your device and you can delete it in your browser settings at any time. We also collect anonymous visit statistics (page and product view counts, traffic source) without cookies or personal data — it is never linked to any individual.

Google Analytics (only with your consent). If you click “Accept” in the cookie banner, we use Google Analytics 4 (Google Ireland Ltd) to understand how the shop is used (pages visited, bag and checkout steps, device and approximate country-level location). This sets the cookies _ga and _ga_* (kept for up to 14 months). Google Analytics does not store IP addresses and the data is not used for ad personalisation. Without your consent these cookies are not set. You can change your choice at any time via “Cookie settings” in the footer. Analytics is loaded through Google Tag Manager; the legal basis is your consent (GDPR Art. 6(1)(a)).

7. Your rights

You have the right to access your data; to have inaccurate data corrected; to have your data erased (unless we are legally required to keep it); to restrict processing; to object to processing based on legitimate interest; to data portability; and to withdraw consent at any time.

To exercise your rights, email info@hmarket.ee. We will respond within one month.

If you believe your rights have been violated, you may contact the Estonian Data Protection Inspectorate (www.aki.ee, Tatari 39, Tallinn).

8. Security

The website uses an encrypted HTTPS connection. Order data is accessible only to authorised persons through a password-protected admin area.

9. Changes

We may update this policy. The current version is always on this page with the date of the last update.