• ·Account & authentication — email address and password (stored as a secure hash) when you create an account.
• ·Order & delivery — first name, last name, email address and delivery address (street, city, postal code, country).
• ·Order records — products ordered, quantities, prices, order status, timestamps and bank transfer payment reference.
• ·Usage & security — IP address and browser signals collected by Google Analytics 4 (with your consent) and Google reCAPTCHA (bot protection).
• ·Cookie preferences — your consent choices stored in your browser.
• ·Recently viewed products — for logged-in users who have not opted out, we save the last 20 products you viewed (product ID, domain and timestamp) so you can quickly navigate back to them. This is stored in your account solely for your convenience and is never used for advertising or profiling.

• ·Contract performance (Art. 6(1)(b)) — processing your order, managing your account and arranging delivery.
• ·Legal obligation (Art. 6(1)(c)) — retaining accounting and tax records for 7 years as required by applicable EU law.
• ·Legitimate interest (Art. 6(1)(f)) — protecting our website against bots and fraud using Google reCAPTCHA; saving your last 20 viewed products so you can quickly navigate back to them (never used for advertising).
• ·Consent (Art. 6(1)(a)) — Google Analytics 4 cookies. You may withdraw consent at any time via our cookie banner.

When you are logged in to your account, we save the last 20 products you viewed so you can quickly navigate back to them. This list is shown in the 'Recently Viewed' strip across the store and on your account page, and syncs across your devices.

This feature exists entirely for your benefit — to help you find products you were interested in without having to search again. The data is never used for advertising, profiling, or shared with third parties.

Specifically, we store: your user ID, the product ID, the store domain (e.g. cbditaly.ee) and the date and time of the visit. The list is capped at 20 entries; older entries are automatically replaced. We do not store your IP address or any other data in connection with this feature.

The legal basis is our legitimate interest (GDPR Art. 6(1)(f)). You have the right to object at any time.

You can disable this feature and immediately erase all stored entries by going to Account → Marketing & Privacy and turning off 'Remember my recently viewed products'.

We share personal data with the following processors under data processing agreements:

• ·Account data — retained until you delete your account.
• ·Order records — retained for 7 years from purchase date (legal/tax obligation).
• ·Recently viewed browsing history — retained until you disable the feature in Account → Marketing & Privacy, or until you delete your account.
• ·Google Analytics data — user-level data retained for 2 months (GA4 default).
• ·Cookie preferences — stored in your browser until you clear them.
• ·reCAPTCHA data — subject to Google's own retention policy.

As a data subject you have the following rights. To exercise any of them, email dpo@cbditaly.ee. We will respond within 30 days.

Art. 15

Right of access— Request a copy of your personal data.

Art. 16

Right to rectification— Correct inaccurate or incomplete personal data.

Art. 17

Right to erasure— Request deletion of your data ("right to be forgotten"), subject to legal retention obligations.

Art. 18

Right to restriction— Ask us to limit processing of your data.

Art. 20

Right to data portability— Receive your data in a structured, machine-readable format.

Art. 21

Right to object— Object to processing based on legitimate interest.

Art. 7(3)

Right to withdraw consent— Withdraw consent for analytics cookies at any time via the cookie banner.

We use cookies for essential functionality (cart, authentication) and, with your consent, for analytical purposes (Google Analytics 4). For full details please read our Cookie Policy.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. We will notify you of significant changes by posting a notice on our website.

For privacy-related questions or to exercise your rights:

Email: dpo@cbditaly.ee

Post: INK AND CHILL LATVIJA, SIA, Rīga, Audēju iela 5, LV-1050