This Privacy Policy is based on the European Union General Data Protection Regulation (EU) 2016/679 (GDPR) and applies to the processing of personal data of customers of Alpek OÜ (hereinafter Alpek), visitors to www.alpek.ee, people submitting enquiries, and representatives and contact persons of business customers.
This Privacy Policy covers the collection, use, disclosure, transfer and storage of personal data (hereinafter collectively referred to as “processing”). Personal data is processed in accordance with applicable legislation and with appropriate measures in place to protect it.
Alpek collects and processes only the personal data necessary to serve customers in its showroom, online store, by email or telephone, and to fulfil orders.
Terminology and definitions
A data subject is a natural person whose personal data is processed. Personal data is information relating to an identified or identifiable natural person. A controller determines the purposes and means of processing personal data. A processor processes personal data on behalf of the controller.
Controller
The controller of personal data is Alpek OÜ, registry code 11457530, address Taevavärava tee 4a, Lehmja village, Rae municipality, 75306, Estonia, email: myyk@alpek.ee.
Personal data processed
- First and last name, telephone number and email address.
- The company and job title of a business customer’s representative or contact person.
- Delivery address and payment details, including a bank account number where necessary.
- For electronic channels, the IP address and other technical data.
- Information about the customer’s purchases and contracts, and correspondence and attachments relating to enquiries, orders and complaints.
- Email labels and extracted order data generated through automated processing.
Depending on the needs and circumstances, Alpek may process only some of the data listed above. Data is obtained from the customer, their representative or company, and service providers involved in fulfilling the order. It may not be possible to fulfil an order without the necessary data.
Purposes of processing personal data
Personal data is used to respond to enquiries, manage orders, deliver goods, handle billing and provide customer support. Purchase history is used to compile an overview of goods and services purchased. Technical data is used to ensure the operation and security of the website.
The legal basis for processing an individual customer’s order is taking steps necessary to enter into a contract and performing the contract. Accounting data is processed to comply with a legal obligation. Data concerning business customer contacts, the organisation of sales activities, email classification, security and the defence of legal claims is processed on the basis of Alpek’s legitimate interests, taking account of the individual’s rights and interests.
Use of artificial intelligence
Alpek uses Ampwise and OpenAI services, including ChatGPT/Codex, to classify sales emails, identify items and quantities in orders, and enter orders into Directo. This may involve processing sender and contact person details, email content and relevant attachments.
Data necessary to perform the task is transferred to service providers. Artificial intelligence is used for the purposes and on the legal bases described above. Alpek remains responsible for the processing of personal data.
Security and access to data
Alpek employees and service providers have access to personal data where this is necessary to perform their duties or provide services. Alpek restricts access and implements appropriate technical and organisational security measures.
Retention
Accounting source documents and documents necessary to substantiate transactions are generally retained for seven years from the end of the relevant financial year, or longer in specific cases provided for by law.
Other enquiries and customer correspondence are retained until the enquiry is resolved or the customer relationship ends and, where necessary, until the applicable limitation period for a legal claim expires. AI working copies and technical logs are retained only for as long as necessary for processing, security and error checking, taking account of the service’s retention terms. The data is then deleted or anonymised.
Direct marketing communications
Email addresses are used to send direct marketing communications with the customer’s consent. Consent may be withdrawn at any time using the unsubscribe option in the email or by writing to myyk@alpek.ee. Alpek may retain information necessary to honour the opt-out after consent has been withdrawn.
Transfer of data to third parties
Where necessary, personal data is transferred to providers of email and cloud services, web hosting, business management software, accounting, transport, automation and AI services, including Directo, Ampwise and OpenAI. Providers processing data on behalf of Alpek must comply with the agreed data protection requirements. Data is disclosed to public authorities on a legal basis.
If data is transferred outside the European Economic Area, the transfer must rely on a basis permitted by law, such as a European Commission adequacy decision or standard contractual clauses. Information about recipients, destination countries and safeguards, and how to obtain a copy of those safeguards, is available by contacting myyk@alpek.ee.
Your rights regarding your data
You have the right to access your personal data and request the correction of inaccurate data. In the cases provided for by law, you may request erasure, restriction of processing and data portability, and object to processing based on legitimate interests on grounds relating to your particular situation. You may opt out of direct marketing at any time.
If a decision concerning you is made solely by automated means and has legal or similarly significant effects, you have the right, in the cases provided for by law, to obtain human intervention, express your point of view and contest the decision.
To exercise your rights, contact myyk@alpek.ee. Where necessary, Alpek will request additional information to verify your identity. Requests are answered without undue delay, generally within one month. For complex requests, the deadline may be extended as permitted by law, with notice given within the first month. To protect your rights, you may contact the Estonian Data Protection Inspectorate (www.aki.ee) or a court.
Erasure
To request the erasure of personal data, email myyk@alpek.ee. Data is erased when there is no legal basis for retaining it. Data subject to a statutory retention obligation or necessary for the defence of legal claims may not be erased immediately; in such cases, Alpek will explain the reason for retaining it.
Cookies and changes to the Privacy Policy
Information about cookies requiring consent is provided and consent is requested on the website. Consent may be withdrawn through the website’s cookie settings.
Alpek may update this Privacy Policy by publishing the current version on www.alpek.ee together with the date of the update. Where appropriate, significant changes to processing will also be communicated through other suitable means.
Updated 2 October 2026