PRIVACY POLICY

Last updated: 3 September 2026

Dr. Spiller Estonia, operated by ALINACOSMETICS OÜ, respects your privacy and is committed to processing personal information responsibly and in accordance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Estonian law.

This Privacy Policy explains what personal information we collect, why we use it, how it may be shared, how long we retain it, and what rights you have.

1. Data Controller

The controller responsible for your personal information is:

ALINACOSMETICS OÜ
Trading name: Dr. Spiller Estonia
Registry code: 14078879
Registered address: Liivalaia tn 7
VAT number: EE102013157
E-mail: drspillerestonia@gmail.com
Website: https://drspiller.ee

2. What Personal Information We Collect

Depending on how you use our website, we may process:

Contact information

• first and last name;
• e-mail address;
• telephone number;
• billing address;
• delivery address;
• parcel-locker information.

Order and transaction information

• products purchased;
• order number;
• order history;
• transaction amount;
• discounts and gift cards;
• returns and refunds;
• delivery information.

Customer communication

Information you provide when contacting us by e-mail, contact forms or other customer-support channels.

Account information

Where customer accounts are available, we may process account credentials, preferences and related information.

Website and technical information

Depending on the technologies used on the website, this may include:

• IP address;
• browser type;
• device information;
• operating system;
• language settings;
• website interaction data;
• pages viewed;
• referral information;
• cookies and similar technologies.

Marketing information

If you subscribe to marketing communications, we may process your e-mail address, subscription status, preferences and interaction with marketing communications.

Quiz information

If you use our skincare recommendation quiz, we may process the answers you voluntarily provide in order to generate product recommendations.

The quiz is intended to provide general skincare recommendations and is not intended to diagnose medical conditions.

3. How We Collect Information

We may collect information:

• directly from you;
• when you place an order;
• when you create or use an account;
• when you subscribe to marketing communications;
• when you complete our skincare quiz;
• when you contact customer support;
• automatically through cookies and similar technologies;
• through service providers that operate parts of our website and services.

4. Why We Use Personal Information

We may process personal information for the following purposes:

Order fulfilment

To process purchases, payments, delivery, returns and refunds.

Customer service

To answer questions, resolve complaints and communicate with you about your orders.

Website operation

To operate, maintain, secure and improve our website.

Personalisation

To remember preferences and provide relevant product recommendations.

Marketing

Where legally permitted and where required, with your consent, to send promotional communications about products, offers and services.

Security and fraud prevention

To protect the website, customers and business from fraudulent, unlawful or malicious activity.

Legal obligations

To comply with applicable legal, tax, accounting and regulatory obligations.

Dispute resolution

To establish, exercise or defend legal claims where necessary.

5. Legal Bases for Processing

Depending on the circumstances, we may rely on the following legal bases under the GDPR:

• Performance of a contract — for processing and fulfilling orders.
• Legal obligation — where processing is required by law, including accounting and tax obligations.
• Legitimate interests — for website security, fraud prevention, business administration and certain customer communications, where our interests are not overridden by your rights.
• Consent — where required, including certain marketing and non-essential cookies.

6. Payments

Payments are processed by third-party payment providers.

We do not intend to store complete payment card details ourselves.

Payment providers may process payment information in accordance with their own privacy policies and applicable legal requirements.

7. Shopify

Our online store is powered by Shopify.

Shopify processes personal information as part of providing the ecommerce platform and related services.

Information submitted through our store may therefore be processed by Shopify and other service providers involved in operating the website.

For more information, customers may review Shopify's applicable privacy information.

8. Service Providers

We may use third-party providers to operate our business, including providers for:

• ecommerce and hosting;
• payment processing;
• parcel delivery and shipping;
• parcel-locker services;
• accounting;
• customer support;
• e-mail marketing;
• analytics;
• website security;
• reviews;
• skincare quiz and recommendation tools.

We share only information reasonably necessary for the relevant service.

9. Marketing Communications

If you subscribe to our marketing communications, we may send information about:

• products;
• skincare routines;
• new collections;
• promotions;
• special offers;
• educational content.

You may unsubscribe at any time using the unsubscribe link in our marketing emails or by contacting us.

Unsubscribing from marketing communications does not prevent us from sending necessary transactional messages, such as order confirmations, shipping notifications or important service communications.

10. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Some cookies are necessary for the operation, security and functionality of the website.

Other cookies may be used for analytics, personalisation or marketing, depending on the technologies and applications installed on the website.

Where consent is legally required, non-essential cookies should only be activated after the appropriate consent has been obtained.

11. Data Sharing

We may disclose personal information where necessary to:

• Shopify;
• payment providers;
• delivery and parcel-locker providers;
• technology and hosting providers;
• accounting and professional advisers;
• customer-support providers;
• marketing service providers;
• analytics providers;
• authorities where legally required.

We do not sell customer personal information as a standalone commercial product.

12. International Data Transfers

Some service providers used by our store may process information outside Estonia or the European Economic Area.

Where personal information is transferred outside the EEA, we will rely on an appropriate legal mechanism under applicable data protection law, such as an adequacy decision or Standard Contractual Clauses where applicable.

13. Data Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to:

• fulfil orders;
• provide customer service;
• comply with accounting and tax obligations;
• resolve disputes;
• prevent fraud;
• establish or defend legal claims;
• maintain marketing preferences where applicable.

Different categories of information may therefore be retained for different periods.

14. Your GDPR Rights

Subject to applicable legal conditions and exceptions, you may have the right to:

• access your personal information;
• correct inaccurate information;
• request deletion;
• request restriction of processing;
• object to certain processing;
• withdraw consent where processing is based on consent;
• receive your personal information in a portable format where applicable;
• lodge a complaint with a supervisory authority.

To exercise your rights, contact:

drspillerestonia@gmail.com

We may need to verify your identity before processing certain requests.

15. Right to Complain

If you believe that your personal information has been processed unlawfully, you may contact us first.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

In Estonia, this is:

Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)

Website: aki.ee

16. Children's Data

Our website is not intended for children.

We do not knowingly collect personal information from children where such collection is prohibited by applicable law.

If you believe that a child has provided us with personal information unlawfully, please contact us.

17. Data Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

However, no online system can be guaranteed to be completely secure.

18. Third-Party Websites

Our website may contain links to third-party websites or services.

We are not responsible for the privacy practices of third-party websites that we do not control.

We recommend reviewing the privacy policy of each third-party service before providing personal information.

19. Changes to This Privacy Policy

We may update this Privacy Policy when necessary to reflect changes in our business, services, technology or legal requirements.

The updated version will be published on this page with a revised “Last updated” date.

20. Contact

For privacy questions or GDPR requests:

ALINACOSMETICS OÜ
Trading name: Dr. Spiller Estonia
Registry code: 14078879
Registered address: Liivalaia tn 7
E-mail: drspillerestonia@gmail.com
Website: https://drspiller.ee