Privacy and data protection

In short: if you are just browsing, we collect no personal data about you; the web server only keeps a short technical log, described below. If you place an order or send us a message, we store the data needed to fulfil it — and nothing more. We never sell or share it for marketing, and we do not track visitors.

Who processes the data

EMK Varahalduse OÜ, email info@charms.ee. You can contact us at the same address with any data protection questions.

What we collect and why

• Order details — name, email, phone, delivery address or parcel machine, and the items ordered. Without these we cannot fulfil the order or issue an invoice. Basis: performance of a contract.
• Uploaded designs — the logo or image you send for your badge. We use it solely to produce your item. We offer your design to others only if you have ticked the sharing consent box in the designer yourself — by default we do not.
• NFC tag profile — if you set up an NFC tag, we store the name, phone number and extra info you enter. THIS DATA IS PUBLIC: anyone who taps the tag or opens the page with its code can see it — that is the point of the product. You enter it yourself and the basis is your consent, given with the tick box during setup. You can change or delete it at any time ("Edit details" → "Delete profile data"), or ask us to reset the profile. No personal data is written onto the chip itself — it only holds the tag's address. The PIN is stored as a one-way hash; not even we can see it, and a forgotten PIN cannot be recovered.
• Enquiries and correspondence — the contents of the contact and quote forms, and emails. Basis: our legitimate interest in replying to you.

Cookies and information kept in your browser

The site uses only strictly necessary cookies. They contain no personal data, only a random identifier or a "yes" flag.

• Session cookie: remembers your shopping cart, the chosen gift, the language and the form protection code. The cookie is deleted when you close your browser.
• Shopping cart cookie: a random identifier that lets the site find your cart on your next visit. The cookie is set when you add something to the cart and is kept for 7 days.

The site also keeps a few things in your own browser's storage. These are not cookies and are never sent to our server:

• Details of an unfinished order at checkout — when you start entering your details at checkout (name, email, phone, address or parcel machine), your browser keeps them in that tab for 10 minutes so they are not lost if, for example, you go to read the terms in between. A countdown is shown at the edge of the page during that time: there you can extend the time or delete the details immediately. They are deleted when the order is placed, when the time runs out or when you close the tab. They reach our server only when you press "Order and pay".
• Flags for your choices — that you have seen the cookie notice (or which choice you made), that you closed a campaign notice or the phone hint, and that you paused the page animations. They stay until you clear your browser data, so the site does not ask the same thing on every visit.

We use no tracking, advertising or analytics cookies. There is no Google Analytics, Facebook pixel or any other visitor tracking on this site. We do not know who is looking at the site until they send us an order or a message. That is why there is no consent to ask for.

We count visits on our own server, without cookies or outside services. For each page view we store the page address, the time, the device type (phone, tablet or computer) and the site the visit came from. We do not store IP addresses. To tell apart visits on the same day, a temporary identifier is calculated with a key that changes daily and is then deleted, so visits cannot be linked to any person or across days. Individual records are deleted after 35 days; only daily totals remain.

Fonts, images and scripts are all served from our own server. No outside service learns that you visited this page.

Who we share data with

• Our email provider (Resend) — your email address and the message content, so that confirmations and invoices reach you.
• The parcel carrier — your name, phone number and delivery address or chosen parcel machine.
• Accounting — invoice data, which must be retained by law.
• The Estonian Land Board address registry — if you use the address search at checkout, our server sends it the search text you typed (only the address, never your name or other data).

We do not pass on or sell your data to anyone else.

How long we keep it

We keep orders and invoices for 7 years, as required by accounting law. We delete uploaded design files and proofs no later than one year after the order is completed, unless you want them kept for a repeat order. While the files are kept you can download your proof from the order page; on the same page you can ask us to delete the files earlier or keep them longer. Correspondence and the conversation on the order page are kept for as long as they remain relevant.

• A shopping cart that is not turned into an order: 7 days after the last change.
• Designs made in the designer and uploaded images that you do not order: we delete them regularly, at the latest after 60 days.
• Details entered at checkout but not submitted: only in your browser and for up to 10 minutes; they never reach our server.
• The web server's technical log (request time, page address, browser type and IP address): 14 days. It is needed to fend off attacks and find faults; we do not use it for visitor statistics.
• The form abuse limiter: an irreversible identifier calculated from the IP address, for up to one hour, so that forms cannot be sent endlessly from the same address.

Your rights

You have the right to ask what data we hold about you, to have it corrected or deleted, to restrict its use, and to receive your data in a machine-readable form. Just write to info@charms.ee — we reply within a month at the latest. If you are not satisfied with our response, you may contact the Estonian Data Protection Inspectorate (info@aki.ee).

Last updated 16.10.2026.