Privacy Policy

Last updated: 28.09.2026. Applies in the online store mano.ee.

1. General provisions

1.1. This privacy policy regulates the collection, processing and storage of personal data. Personal data is collected, processed and stored by the controller ZRN Group OÜ (hereinafter data processor) in the online store mano.ee. Mano is only an online store; the legal address is not a visiting store.

ZRN Group OÜ (private limited company)
Registry code: 16585592
VAT number: EE102784994 (from 08.10.2024)
Registered: 03.10.2022, entered in the register
Legal address: Mustvee mnt 17, 48305 Jõgeva town, Jõgeva municipality, Jõgeva county, Estonia
Sales only in the online store mano.ee — no physical store.
Email: klienditugi@mano.ee
Web: mano.ee

1.2. The data subject is the customer or other natural person whose personal data is processed by the data controller.

1.3. The customer is anyone who purchases goods from the data controller's website.

1.3.1. The data of a person who has submitted an inquiry via the contact form or by e-mail (name, e-mail, message) is processed only to respond to the inquiry. They are not used for marketing without separate consent.

1.4. The data controller follows the principles set out in legal acts: lawfulness, fairness, transparency, purpose limitation, data minimisation, storage limitation, reliability and confidentiality.

2. Collection, processing and storage of personal data

2.1. Data is collected electronically, mainly through the website, checkout, account, search, contact form and e-mail.

2.2. By sharing their personal data, the data subject grants the right to collect, organize, use and manage the data for the purposes defined in the privacy policy, which they share directly or indirectly when purchasing goods on the website.

2.3. The data subject is responsible for ensuring that the submitted data is accurate, correct and complete. Knowingly submitting false data is considered a violation of the privacy policy. Changed data must be notified to the data processor without delay: klienditugi@mano.ee.

2.4. The data processor is not responsible for damage caused to the data subject or third parties due to the data subject's incorrect data.

3. Processing of customers' personal data

3.1. The data processor may process:

3.1.1. first and last name;
3.1.2. phone number;
3.1.3. e-mail address;
3.1.4. delivery address (street, city);
3.1.5. order content, notes, withdrawal and complaint data;
3.1.6. payment status and transaction reference (not full card number);
3.1.7. bank account number, if necessary for refund;
3.1.8. IP address, device and browser technical data and cookie selection, to the extent necessary for security and e-shop operation;
3.1.9. search terms used to find products (anonymously, to improve search).

3.1.10. The data processor does not store the card number, CVV or PIN code. These are processed by the payment service provider (e.g. Maksekeskus AS, if the checkout is connected).

3.2. In addition, there is the right to use data available in public registers for contract performance and fraud prevention.

3.3. The legal basis is GDPR Article 6(1)(a), (b), (c) and (f):

a) the data subject has given consent for a specific purpose (e.g. cookies, Google Ads, Facebook Ads, direct marketing);
b) processing is necessary for the performance of a contract or for measures prior to entering into a contract;
c) compliance with a legal obligation (accounting, consumer protection, tax);
f) legitimate interest (e-shop security, fraud prevention, protection of claims), provided that it does not override the rights of the data subject, especially when it concerns a child.

3.4. Purposes and retention:

3.4.1. Security and safety — period required by law or for dispute resolution.
3.4.2. Order processing and delivery — until the contract is fulfilled and until the complaint and withdrawal deadlines.
3.4.3. Operation of the e-store (shopping cart, session, cookie selection) — session or until the client wishes to remove the data / until the cookie expires (consent up to 6 months).
3.4.4. Customer support, withdrawal, complaints — until the disputes expire.
3.4.5. Financial activities and accounting — deadline required by law (usually 7 years).
3.4.6. Aggregated measurement numbers of the store's own — up to 90 days. Google Ads, Meta and other advertising measurement — only with separate consent and only if this service is connected.

3.5. Data may be shared with authorized processors: web hosting (Zone / Web hosting), accountant, transport and courier companies (e.g. DPD, SmartPOST) and payment services. The store's own aggregated measurement data remains on the mano.ee server. Microsoft Clarity receives usage data only with analytics consent. Meta receives pixel events only with marketing consent. ZRN Group OÜ is the data controller. Data necessary for making payments is forwarded to the authorized processor (e.g. Maksekeskus AS, if connected). Data is not sold to third parties.

3.6. We implement organizational and technical measures against accidental or unlawful destruction, alteration, disclosure and other unlawful processing (access restriction, HTTPS, updates, backups to a reasonable extent).

3.7. Data is retained depending on the purpose. If the basis ceases, we delete or anonymize the data, except if the law requires retention.

3.8. Data is not knowingly transferred outside the EEA, except if an authorized processor (e.g. payment or hosting service, and with consent Microsoft or Meta) does so and there is a GDPR-compliant basis for it (consent or standard contractual clauses). Such transfer may include the United States.

3.9. mano.ee does not make automated decisions that create legal consequences (incl. credit score).

4. Cookies, advertising and tracking

4.1. Complete list: cookie policy. Non-essential cookies only with prior consent (e-Privacy Directive 2002/58/EC and GDPR).

4.2. Necessary cookies are always active (shopping cart, checkout, security, consent memory).

4.2.1. Recently viewed products (with preference consent). Only product numbers are stored in the browser so that the same device sees them on the product page. This is not essential for the shopping cart, so without consent it is not done and „Only necessary“ deletes it. Numbers do not go to Meta or Google.

4.3. Store measurement (with analytics consent). If you select analytics or „I agree“ in the banner, the browser sends an event to mano.ee server: product view, adding to cart or opening checkout. We store daily aggregate numbers: event type, product number, quantity and amount in euros. We do not store name, email, phone, IP address or visitor ID. Google Analytics is not loaded and cookies _ga and not set. Aggregated numbers do not contain a person, therefore an individual visit cannot be deleted retroactively. After withdrawing consent, new events are not recorded. We retain aggregated data for up to 90 days. _gid 4.3.1. With the same consent, the page loads Microsoft Clarity to see how the page is used (for example, clicks and scrolling). Clarity may store cookies.

. Microsoft may process data in the United States. Without analytics consent, the Clarity script is not loaded. Microsoft's privacy: _clck and _clsk. 4.3.2. The number of paid orders and turnover are counted from the order (contract performance), without a separate tracking cookie. Order personal data remains in the WooCommerce order, not in the measurement table. privacy.microsoft.com.

4.4. Marketing and advertising (with consent). With marketing consent, the page loads the Meta (Facebook) pixel through PixelYourSite. The pixel sends to Meta product view, add to cart, checkout opening and purchase, to measure ad results. This may involve cookies.

4.4. Turundus ja reklaam (nõusolekul). Turundusnõusolekul laeb leht Meta (Facebook) piksli läbi PixelYourSite’i. Piksel saadab Meta’le tootevaate, ostukorvi lisamise, kassa avamise ja ostu, et mõõta kuulutuste tulemust. Sellega võivad kaasneda küpsised _fbp and _fbc. No pixel is loaded without marketing consent. Meta privacy: facebook.com/privacy/policy. Ad preferences: facebook.com/ads/preferences.

4.5. Search. The search bar helps find products. We may store search terms and time anonymously to improve search results, without linking the search to a person.

4.6. The choice can be changed from the banner („Advanced options“) or from the footer link „Cookie settings“. We retain consent for up to 6 months.

4.7. Additional information from service providers, if these services are connected in the future: Google's privacy, Google Ads settings, Meta privacy, Facebook ad preferences.

4.8. Font is loaded from mano.ee server. The page does not connect to fonts.googleapis.com or fonts.gstatic.com.

5. Data subject's rights

5.1. Right to access and view one's personal data.

5.2. Right to information about processing.

5.3. Right to supplement or correct inaccurate data.

5.4. If processing is based on consent, the right to withdraw consent at any time (incl. cookies, Google Ads, Facebook Ads), without affecting the lawfulness of processing that occurred before withdrawal.

5.5. Right to request erasure („right to be forgotten“), except where retention is a legal obligation or necessary for the establishment, exercise or defense of legal claims.

5.6. Right to restrict processing, data portability and to object to processing based on legitimate interest, to the extent provided in the GDPR.

5.7. To exercise rights: klienditugi@mano.ee. We generally respond within one month.

5.8. Complaint: Data Protection Inspectorate, info@aki.ee, +372 612 8200, aki.ee.

6. Final provisions

6.1. The terms are prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Estonian Personal Data Protection Act and other Estonian and EU law.

6.2. The data processor has the right to change the policy in part or in full, notifying of changes via mano.ee. The new version applies from publication; for already concluded contracts, the information at the time of purchase applies, unless the law requires otherwise.