PRIVACY POLICY
Mativesi OÜ
Last updated on 23 September 2026
| At a glance. Mativesi OÜ processes personal data to respond to enquiries, prepare quotations, fulfil online shop orders and process payments, manage deliveries and customer relationships, and ensure the website operates securely. In addition to Mativesi OÜ, Veetehnoloogia OÜ may review an enquiry and submit a quotation. In such cases, the customer is informed which company is making the offer. We do not sell personal data. Non-essential cookies and associated tracking technologies are activated only where the user has given the relevant consent. |
1. Scope
This privacy policy explains how Mativesi OÜ processes the personal data of visitors to mativesi.ee and its online shop, people making enquiries, customers, suppliers and contact persons of business partners. The website uses the WordPress content management system and WooCommerce online shop solution and is hosted on Zone.ee servers.
This policy does not cover third-party websites linked from our website. The relevant service provider is responsible for data processing on those websites.
2. Controllers and contact details
2.1 Mativesi OÜ
- Business name: osaühing MATIVESI (Mativesi OÜ)
- Company registration number: 11423206
- Registered address: Pae tn 4/2, Pärnu city, Pärnu city municipality, Pärnu County, 80042 Estonia
- Office and shop: Pae 4, 80042 Pärnu, Estonia
- Email: info@mativesi.ee
- Telephone: +372 5192 7981
- Website: www.mativesi.ee
2.2 Veetehnoloogia OÜ
Veetehnoloogia OÜ, registration number 10704239, address Pae tn 4/2, Pärnu city, Pärnu County, 80042 Estonia, email info@veetehnoloogia.ee, website www.veetehnoloogia.ee.
Mativesi OÜ and Veetehnoloogia OÜ jointly use the business name Mativesi Group. Mativesi Group is not a separate legal entity or an independent controller.
If an enquiry concerns the products, services or expertise of Veetehnoloogia OÜ, Mativesi OÜ may forward the enquiry and the data necessary to handle it to Veetehnoloogia OÜ. Veetehnoloogia OÜ may process the enquiry, request clarification, and prepare and submit a quotation in its own name or by agreement with Mativesi OÜ. The customer is informed in the quotation or accompanying communications which company is making the offer and may become the contracting party.
Generally, each company acts as a separate controller for the processing it determines. Where the companies jointly determine the purposes and means of specific processing, they arrange their responsibilities and the exercise of data subject rights in accordance with the GDPR. Where one company processes data solely on the other's documented instructions, it acts as a processor for that processing.
3. Processing principles
We process personal data lawfully, fairly and transparently. We collect only the data necessary to achieve the purpose, keep it accurate where possible, retain it only for as long as necessary, and apply technical and organisational security measures appropriate to the risk.
4. Personal data we process
- personal and contact data: name, email address, telephone number, position, company represented and communication language;
- enquiry and communication data: message content, products or services requested, technical input data, files and correspondence;
- quotation, contract and order data: quotation, goods or services ordered, quantities, prices, deadlines, representation authority and contract-related communications;
- online shop account data: username or account identifier, account settings, order history and customer preferences, where account creation is enabled;
- delivery data: recipient's name, telephone number, delivery address, billing address and selected delivery method or parcel locker;
- billing and payment data: name, company and address stated on the invoice, transaction amount, currency, payment status and the payment service provider's transaction identifier. Full payment card details are generally processed by the payment service provider, rather than Mativesi OÜ;
- maintenance and warranty information: data relating to equipment, site, faults, maintenance, installation and warranty cases;
- technical website usage data: IP address, device and browser type, operating system, visit time, pages viewed, referring URL, error messages, security and server logs;
- cookie choices and consent data: selected categories, time of consent or refusal, technical identifier and, where necessary, IP address;
- technical email logs: recipient, sending time, subject line, sending status and server response, and, where email logging is configured, email content or attachments;
- Data from Google, Jetpack or another enabled integration, to an extent determined by the features activated on the website and the user's cookie choices.
Please do not send special categories of personal data, such as health data, through a web form or email unless this is strictly necessary to resolve the specific matter. If you provide another person's data, you must ensure that you have the right to do so and that the data is accurate.
5. Processing purposes, legal bases and retention
The retention period may be extended where data is necessary for the establishment, exercise or defence of legal claims, compliance with a legal obligation or resolution of a security incident. When the period expires, the data is deleted or anonymised.
| Purpose | Data and activity | Legal basis | Retention |
| Contact and enquiry | Name, contact details, message, files and technical input data; responding to and clarifying the enquiry, and forwarding it between Mativesi OÜ and Veetehnoloogia OÜ. | Steps taken prior to entering into a contract; legitimate interests for a business customer's contact person. | Generally for up to 3 years after the last substantive contact. |
| Quotation | Data concerning the quotation, products or services, price, deadline, site and communications; preparation and submission of a quotation by Mativesi OÜ or Veetehnoloogia OÜ. | Steps taken prior to entering into a contract; legitimate interests for a legal entity's contact person. | Generally for up to 3 years after the quotation expires or the last substantive contact. |
| Order and contract | Customer, account, order, contract and communication data; accepting the order, performing the contract and providing customer service. | Entering into and performing a contract; legitimate interests for a legal entity's contact person. | For the duration of the contract and generally for 3 years after it ends; in the event of a claim or dispute, until final resolution. |
| Shipping | The recipient's name, telephone number, address or parcel locker and necessary order details; delivery of goods and communication of delivery information. | Performance of a contract. | Until delivery is completed; data contained in transaction documents for the statutory retention period. |
| Payment and billing | Invoice, payment and transaction data; payment initiation, processing, refunds, fraud prevention, billing and accounting. | Performance of a contract, a legal obligation and legitimate interests in preventing payment fraud. | In accounting records, generally for 7 years from the end of the relevant financial year; the payment service provider retains data under its own terms. |
| Tax calculation | Shop and customer address and order data; calculation of the applicable tax rate where automatic WooCommerce Tax is active. | Performance of a contract and a legal obligation. | For the retention period applicable to order and accounting data; technical request logs according to the service settings. |
| Maintenance and warranty | Contact, equipment, site, fault and work data; provision of the service, warranty coverage and quality assurance. | Performance of a contract, a legal obligation and legitimate interests in resolving claims. | For the duration of the service or warranty and generally for 3 years after the case is closed; longer in the event of a dispute. |
| Website operation and security | IP address, device, browser, error message and log data; website operation, load management, backups, prevention of misuse and information security. | Legitimate interests; for strictly necessary technologies, the need to provide the service. | For a limited period appropriate to the purpose of the log; in the event of a security incident, for as long as necessary. |
| Managing cookie choices | Complianz consent and preference data; applying and demonstrating the user's choice. | Legal obligation and legitimate interests in demonstrating consent. | For the period specified in the Complianz settings or until the need to demonstrate consent ends. |
| Analytics and advertising measurement | Website usage, device, cookie and conversion data; statistics, website development and measurement of Google campaigns where the relevant feature is active. | Prior consent. | For the period specified in the cookie manager or the service provider's terms, or until consent is withdrawn. |
| Direct marketing | Name, contact details, company, position, field of activity, previous business communications and marketing preferences; sending relevant offers. | Consent, the statutory existing-customer exception for the same sender, or legitimate interests for a legal entity's contact address under the conditions of the Electronic Communications Act. | Until consent is withdrawn or an objection is made; a minimal suppression record may be retained to prevent further messages. |
| Legal claims and fraud prevention | Data relating to the case; protection of rights, substantiation of claims, and prevention of fraud and infringements. | Legitimate interests or a legal obligation. | Until the limitation period for the claim expires or the dispute is finally resolved. |
6. Sources of data and the need to provide it
We receive data mainly from you or the company you represent through a web form, email, telephone, online shop, contract, order, payment or service interaction. Where necessary, we obtain company and representation authority information from public registers, and delivery, payment or fraud risk information from the relevant service provider.
Providing contact and enquiry data is voluntary, but without the necessary data we may be unable to respond to an enquiry, prepare a quotation, enter into a contract, accept payment or fulfil an order. Data required for contractual, payment, tax and accounting obligations may be required by contract or law.
7. Data recipients and technical services used
We transfer personal data only to the extent necessary to achieve the purpose. A service provider's role may depend on the specific service: it may act as our processor or, for certain activities, as an independent controller.
| Recipient or solution | Role and possible data processing |
| Zone Media OÜ (Zone.ee) | WordPress hosting, server and security logs, backups and, where necessary, email. Zone’s server facilities are located in the European Union. |
| WordPress and WooCommerce | Website and online shop software. Order, account, shopping basket and customer data is held in the WordPress database managed by Mativesi OÜ and hosted by Zone.ee, unless an activated additional service transfers data elsewhere. |
| Complianz | GDPR/CCPA Cookie Consent | Cookie banner, cookie scanning, recording consent choices and demonstrating consent. The list of active services and cookies is displayed in the website's cookie preferences. |
| FluentSMTP and the configured email service provider | Sending transactional and service emails from the website. If logging is activated, the recipient, subject, status, server response and, depending on the settings, email content or attachments may be stored in the WordPress database. |
| Automattic / WordPress.com / Jetpack | Connected services of Jetpack, WooCommerce Tax and WooCommerce. The data processed depends on the activated features. A Jetpack administration or support feature may access live website data, including WooCommerce order data, in response to an authenticated request. |
| WooPayments and payment infrastructure providers, including Stripe | Payment initiation and processing, identity or creditworthiness checks, fraud prevention, refunds and disputes. Data transferred may include name, contact and billing address, telephone number, email address, order amount, currency, payment identifier, device information and risk information. Mativesi OÜ generally does not receive full card details. |
| Google Ireland Limited and other Google group companies | Transferring the product catalogue to Google Merchant Center through Google for WooCommerce and processing advertising, analytics and conversion data with the user's consent. In the EEA, Google tags must respect the user's consent choice before activating analytics or advertising tracking. |
| TranslatePress | Displaying multilingual content and applying the user's language preference. If automatic translation is used, website content to be translated may be sent to the configured translation service, such as Google, DeepL or TranslatePress AI. Personal data entered by a customer is not sent to a translation service unless a specific feature technically requires it and there is an appropriate legal basis. |
| Logistics and courier service providers | The recipient's name, telephone number, address or parcel locker, and order information necessary for delivery, including disclosure to Omniva where its service is selected. |
| Accountants, IT partners, suppliers and professional advisers | Data to the extent necessary for order fulfilment, accounting, maintenance, technical support, auditing, insurance or the defence of legal claims. |
| Veetehnoloogia OÜ | Data necessary to arrange an enquiry, quotation, order, delivery, installation, maintenance or after-sales service. Veetehnoloogia OÜ may make an offer and continue customer communications in its own name. |
| Public authorities and authorised parties | Data is disclosed only where required by law or necessary for the establishment, exercise or defence of legal claims. |
The exact selection of service providers used may change. Before adopting a new service, Mativesi OÜ checks its necessity, data protection terms and the basis for data transfers. Service providers' privacy terms can be found on their websites; questions about specific processing or a current service provider can be sent to info@mativesi.ee.
8. Online shop, payments and tax calculation
WooCommerce stores customer and order data in the WordPress database to operate the online shop. Strictly necessary cookies are used to manage the shopping basket and session. If a customer creates an account, account data is retained for account management until the account is deleted, except for data that must continue to be retained for contractual, accounting or legal claims purposes.
When WooPayments is used, the data necessary to process the payment is transferred to the systems of WooPayments/Automattic and payment infrastructure partners, including Stripe. The payment provider may act partly as an independent controller and apply its own privacy terms and statutory retention periods.
If WooCommerce Tax automatic tax calculation is activated, the shop's and customer's location data is used to calculate the applicable tax rate, and the website must be connected to WordPress.com. If automatic tax calculation is not activated, this data transfer does not take place.
9. Cookies and similar technologies
A cookie is a small text file or other identifier stored on a device when a website is used. Complianz manages the cookie banner and the user's consent choices. Before the user makes a choice, only technologies strictly necessary for the website to function may be used. Functional, analytics and marketing technologies are activated where they require consent and the user has enabled the relevant category.
| Category | Purpose | Basis | User choice |
| Strictly necessary | Essential website and online shop functions, shopping basket, session, security, load management and storing cookie preferences. | Necessary to provide the service; consent is not requested. | These cannot be disabled in the banner, but the browser may restrict them. |
| Functional | Enabling language, region or other user preferences and additional features where these are not strictly necessary. | Prior consent where required by law. | Disabled by default; the choice can be changed. |
| Analytics | Visitor statistics, usage patterns, Jetpack Stats or Google Analytics, where these features are activated. | Prior consent. | Disabled by default; the choice can be changed. |
| Marketing | Measurement and personalisation by Google Ads or another advertising service, and linking user activity across different pages. | Prior consent. | Disabled by default; the choice can be changed. |
It must be as easy to reject non-essential technologies as to accept them. Continuing to browse, silence and preselected options are not treated as consent. You can change your choices at any time using the website's “Cookie settings” link. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Cookie names, providers, purposes and retention periods depend on the activated WordPress and WooCommerce features and may change when the software is updated. An up-to-date list of technologies currently detected on the website is displayed in the Complianz cookie preferences. Mativesi OÜ must run a new cookie scan and check consent-based blocking after significant changes to plugins or settings.
10. Transfers outside the European Economic Area
Zone’s server facilities are located in the European Union. Some other service providers, particularly Automattic/WordPress.com, Google, Stripe or their subprocessors, may also process data outside the European Economic Area. Such transfers take place only on a basis permitted under Chapter V of the GDPR, such as a European Commission adequacy decision, the EU–US Data Privacy Framework, European Commission standard contractual clauses or another appropriate safeguard. Additional technical and organisational measures are applied where necessary.
Information about a specific transfer, recipient and safeguard applied can be requested at info@mativesi.ee.
11. Direct marketing
Mativesi OÜ generally sends marketing messages to an individual's email address or telephone number only with prior consent. Mativesi OÜ may use an existing customer's contact details to offer its own similar products or services under the conditions permitted by law, provided that the customer was given a free and simple opportunity to opt out when the contact details were collected and in every message.
Veetehnoloogia OÜ may send marketing messages to an individual only if it has its own consent for this or another statutory basis. Handling a quotation or enquiry does not in itself constitute consent to marketing.
Relevant B2B offers related to a legal entity's activities may be sent to its general contact address. For a work address containing a person's name, we assess whether the offer is directly related to the recipient's duties and decision-making authority. Every marketing message is recognisable as such, identifies the sender and provides a free electronic opt-out option.
Consent may be withdrawn at any time, and you may always object to direct marketing by using the opt-out method in the message or writing to info@mativesi.ee or info@veetehnoloogia.ee. Where necessary, opt-out information is shared with the other company to ensure that the objection is respected.
12. Automated decisions and artificial intelligence tools
Mativesi OÜ and Veetehnoloogia OÜ do not make decisions concerning a data subject based solely on automated processing that produce legal effects or similarly significantly affect that person.
We may use artificial intelligence tools to summarise customer enquiries, draft text, translate and perform other supporting tasks. Personal data is sent to such services only to the extent necessary and with appropriate data protection safeguards. An employee reviews the output, and it is not used to make decisions concerning an individual that have legal or similarly significant effects without meaningful human intervention.
The website and online shop are not directed at children under 13. If we become aware that a child's data has been processed without the required legal basis, we will delete it within a reasonable period.
13. Your rights
Subject to the conditions of applicable law, you have the right to:
- obtain confirmation as to whether we process your personal data and request access to it and a copy;
- request correction of inaccurate data and completion of incomplete data;
- request erasure of data where there is no legal basis for further processing;
- request restriction of processing;
- object to processing based on legitimate interests and object to direct marketing at any time;
- receive the data you have provided in a structured, commonly used and machine-readable format and transmit it to another controller, where the right to data portability applies;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
- lodge a complaint with the Estonian Data Protection Inspectorate or bring proceedings before a court.
To exercise a right concerning processing by Mativesi OÜ, write to info@mativesi.ee. For processing by Veetehnoloogia OÜ, write to info@veetehnoloogia.ee. A request may be sent to either company; if it concerns processing by the other company, it will be forwarded to the relevant controller to the extent necessary.
We may request additional information to verify your identity. We respond without undue delay and generally within one month. For complex or extensive requests, this period may be extended to the extent permitted by law.
Estonian Data Protection Inspectorate: Tatari 39, 10134 Tallinn; email info@aki.ee; website www.aki.ee.
14. Data security
We apply technical and organisational measures appropriate to the risk to protect personal data, including restricting access rights, protecting user accounts and devices, updating software, using HTTPS connections, making backups, reviewing logs, requiring staff confidentiality, selecting service providers and establishing procedures for handling security incidents. However, no internet or email connection is entirely free of risk.
15. Changes and legal framework
We may amend this privacy policy if legislation, our operations, website features, the services we use or our data processing practices change. We publish the current version on the website together with the date of the latest update. Where possible, we notify you of significant changes on the website or by other appropriate means.
This policy is based on Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, or GDPR), the Estonian Personal Data Protection Act, the direct marketing and cookie requirements of the Electronic Communications Act, and other applicable legislation.