Privacy policy
1. Controller
FORTUNATO LAB. OÜ, registry code 16143836, Ussilaka tee 6, 11912 Tallinn, Estonia is the controller. Privacy contact: info@fortunatolab.com, +372 5534911.
2. Data we process
Depending on use of the Store, we process identification and contact data; account and authentication data; order, payment status, invoices, delivery and return data; customer-service communications; consent and marketing preferences; device, log, security, cookie and analytics data; and information voluntarily supplied through forms. Payment-card details are generally collected directly by the payment provider rather than stored by Fortunato.
Do not submit health information through ordinary contact, review or checkout fields.
3. Purposes and legal bases
We process data to perform the sales contract; comply with legal obligations; pursue legitimate interests such as Store security, fraud prevention, service administration and defence of legal claims; and, where required, on consent for non-essential cookies, analytics, targeted advertising and email marketing. Consent may be withdrawn prospectively at any time.
4. Sources and recipients
Data comes from you, your device and the services used to operate the Store. Depending on the service you use, relevant data may be processed by Shopify for the Store, checkout and customer accounts; Shopify Payments or PayPal for payments; the delivery provider selected for your order and the integration used to arrange that delivery; Zone for company email; Judge.me for reviews; and Google Analytics for analytics where the required consent has been given. Data may also be shared where necessary with authorised technical-support providers, professional advisers and public authorities as permitted or required by law. Providers may act as processors on our instructions or as independent controllers for their own services, as described in their privacy notices. We do not sell your personal data.
5. International transfers
Some providers may process data outside the EEA. Where no adequacy decision applies, we use a lawful transfer mechanism such as European Commission Standard Contractual Clauses, with supplementary safeguards where required.
6. Retention
Order, invoice and accounting records are retained for the period required by Estonian tax and accounting law, normally seven years from the end of the relevant financial year where applicable. Other data is retained only for documented, proportionate periods tied to its purpose and legal obligations. Google Analytics is configured to retain event-level data for 2 months and user-level data for 14 months, with the user-data retention period reset on new activity. These controls do not apply in the same way to most standard reports containing aggregated data.
7. Rights
Subject to legal conditions, individuals may request access, correction, erasure, restriction, portability, and object to processing based on legitimate interests or direct marketing. Consent can be withdrawn at any time. A complaint may be lodged with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority in the individual’s EU country of habitual residence, work or alleged infringement.
8. Automated decisions, security and children
Payment and fraud-prevention providers may use automated transaction, authentication and risk checks under their own privacy notices. The Store may receive payment status and risk indicators resulting from those checks. You may contact info@fortunatolab.com to ask about a decision affecting your order, explain your position and request human review where applicable. This does not restrict your statutory rights against us or a provider acting as an independent controller. We use proportionate organisational and technical safeguards. The Store is not directed to children and we do not knowingly solicit personal data from children for independent purchasing.
9. Cookies and marketing
See the Cookie Policy. A consent choice can be changed through the Store’s privacy/cookie settings. Each marketing email contains an unsubscribe method; withdrawal does not affect transactional messages necessary for an order.