Last updated: August 17, 2026

OÜ Top Textile, operating under the brand Mirtel Design (“Mirtel Design”, “we”, “us”, or “our”), operates the website and online store at mirteldesign.com (the “Website”).

Through the Website, we sell professional workwear, uniforms, footwear and related physical products (the “Products”) and provide related online-store functionality, including customer accounts, checkout, order management, delivery arrangements, returns and customer support.

This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you:

• visit or browse the Website;
• view or purchase our Products;
• create or use a customer account;
• start or complete checkout;
• contact us;
• request a return, exchange or refund;
• subscribe to marketing communications; or
• otherwise interact with Mirtel Design online.

We process personal data in accordance with applicable privacy and data-protection laws, including the EU General Data Protection Regulation (“GDPR”).

For the processing activities described in this Privacy Policy, OÜ Top Textile is the controller of your personal data, except where a third party processes personal data as an independent controller for its own purposes, as described below.

Privacy at a glance

When you use mirteldesign.com:

• we collect information necessary to operate our online store, process orders, receive payments, deliver Products, provide customer service and handle returns and claims;
• our online store is hosted by Shopify;
• Shopify Network Intelligence is enabled, which means Shopify may process certain information from interactions with our store together with information from interactions with Shopify and other Shopify merchants to provide Enhanced Services;
• we may use analytics and advertising technologies provided by Shopify, Google, Meta and Microsoft Clarity, subject to applicable privacy and consent requirements;
• we do not sell personal data for money;
• certain disclosures for advertising or personalisation may nevertheless be legally considered “sharing”, “targeted advertising” or a “sale” under some privacy laws;
• we retain personal data only for as long as reasonably necessary, including where information is required for accounting, legal compliance, fraud prevention, disputes, chargebacks or legal claims; and
• you have data-protection rights described in this Privacy Policy.

1. Who We Are

OÜ Top Textile
Operating under the brand Mirtel Design

Raua 55
10120 Tallinn
Estonia

Registry code: 11034048
VAT number: EE100902626

Email: contact@mirteldesign.com
Phone: +372 5553 7102

Website: mirteldesign.com

2. Personal Data We Collect

The personal data we collect depends on how you interact with the Website and whether you browse, contact us or purchase Products.

2.1 Contact and identity information

We may collect:

• first and last name;
• email address;
• telephone number;
• billing address;
• shipping address;
• company name;
• company registry code;
• VAT number; and
• professional role or other business information where relevant to a B2B, team or professional order.

2.2 Order and purchase information

When you place or attempt to place an order, we may collect:

• Products ordered;
• sizes;
• colours;
• quantities;
• customisation choices;
• order number;
• order date;
• order value;
• currency;
• discounts used;
• billing information;
• delivery information;
• chosen delivery method;
• order status;
• shipping and tracking information;
• purchase history;
• payment status; and
• transaction identifiers.

We may also process information relating to:

• cancellations;
• returns;
• exchanges;
• refunds;
• complaints;
• warranty matters;
• damaged or missing Products;
• payment disputes;
• chargebacks;
• suspected fraud; and
• other claims relating to an order.

2.3 Payment information

Payments are processed through third-party payment providers and financial institutions.

Depending on the payment method, these providers may process information such as:

• payment-card details;
• bank-account information;
• billing information;
• payment authentication information;
• transaction information; and
• fraud-prevention information.

We do not receive or store full payment-card numbers or card security codes.

We generally receive only information necessary to administer the transaction, such as:

• whether payment was successful;
• payment method;
• transaction identifier; and
• limited card information where made available by the payment provider, such as card type or final digits.

2.4 Customer account information

If you create or use a customer account, information may include:

• account identifier;
• name;
• email address;
• saved addresses;
• account preferences;
• order history; and
• login and authentication events.

Customer-account authentication is provided through Shopify's systems.

We do not have access to your password in plain text.

2.5 Communications with us

When you contact Mirtel Design, we may process:

• emails;
• contact-form submissions;
• customer-service messages;
• product enquiries;
• sizing enquiries;
• order instructions;
• return or exchange requests;
• complaints;
• feedback;
• reviews;
• survey responses; and
• other information you choose to provide.

We may retain records of communications and our responses where reasonably necessary for customer service, order administration, dispute resolution, fraud prevention or legal claims.

2.6 Marketing information

If you subscribe to marketing communications, we may process:

• email address;
• marketing subscription status;
• date and time of subscription;
• source of consent;
• marketing preferences;
• delivery information;
• interactions with marketing communications, such as opening or clicking an email where this functionality is used; and
• unsubscribe or consent-withdrawal records.

2.7 Device and technical information

When you use the Website, we or our technology providers may process information such as:

• IP address;
• approximate location derived from the IP address;
• browser type and version;
• device type;
• operating system;
• device or online identifiers;
• screen or browser-window dimensions;
• language;
• time zone;
• referring website;
• advertising source;
• cookie identifiers;
• session identifiers;
• pixel identifiers;
• website-performance information;
• security information;
• diagnostic information; and
• error logs.

2.8 Website usage and ecommerce behaviour

Depending on your consent choices and applicable law, we may collect information about how you interact with the Website, including:

• pages visited;
• Products viewed;
• searches;
• navigation paths;
• clicks;
• taps;
• scrolling;
• time spent on pages;
• Products added to or removed from the cart;
• checkout initiation;
• abandoned checkout;
• completed purchases;
• entry and exit pages;
• referring sources;
• advertising interactions;
• campaign attribution;
• purchase and conversion events;
• heatmap information; and
• session-replay information.

3. How We Collect Personal Data

3.1 Directly from you

We collect information directly from you when you:

• browse or purchase Products;
• place or attempt to place an order;
• create or use a customer account;
• contact us;
• submit a form;
• subscribe to marketing;
• request customer service;
• request a cancellation;
• request a return or exchange;
• request a refund;
• submit a complaint or claim;
• provide feedback or a review; or
• communicate with us regarding a team or business order.

3.2 Automatically through the Website

Certain information may be collected automatically through:

• cookies;
• pixels;
• local storage;
• server logs;
• Shopify customer-event technologies;
• ecommerce systems;
• checkout systems;
• analytics tools;
• advertising technologies;
• security tools; and
• fraud-prevention systems.

3.3 From service providers and business partners

We may receive information from parties involved in operating the online store or completing your order, including:

• Shopify;
• payment providers;
• banks and card networks;
• shipping companies;
• postal operators;
• courier and logistics providers;
• fraud-prevention providers;
• analytics providers;
• advertising platforms;
• email-marketing providers;
• customer-support providers; and
• IT and security providers.

3.4 From advertising and analytics providers

Subject to applicable law and your consent choices, we may receive campaign, attribution, advertising, audience and interaction information from providers such as:

• Google;
• Meta;
• Microsoft; and
• Shopify.

4. How and Why We Use Personal Data

We use personal data only where we have an appropriate purpose and legal basis.

4.1 Processing and fulfilling orders

We use personal data to:

• accept and process orders;
• confirm orders;
• process payments;
• prepare Products for shipment;
• deliver Products;
• provide tracking information;
• communicate about an order;
• manage customer accounts;
• process cancellations;
• process returns;
• process exchanges;
• issue refunds;
• manage complaints; and
• resolve contractual issues.

Legal basis: Article 6(1)(b) GDPR — processing necessary for performance of a contract or to take steps at your request before entering into a contract.

4.2 Customer service

We may use personal data to:

• respond to enquiries;
• provide product information;
• provide sizing assistance;
• answer order questions;
• assist with delivery issues;
• handle returns and exchanges;
• investigate complaints; and
• maintain records of customer communications.

Legal basis: Article 6(1)(b) GDPR where processing relates to an order or potential purchase, and Article 6(1)(f) GDPR where we rely on our legitimate interest in providing customer service and managing customer relationships.

4.3 Operating and securing the Website

We may process personal data to:

• operate the Website;
• maintain online-store functionality;
• troubleshoot technical problems;
• maintain account and checkout security;
• prevent misuse;
• prevent payment fraud;
• investigate suspicious activity;
• identify security incidents;
• protect customers;
• protect our business and legal rights;
• enforce applicable contractual terms; and
• maintain appropriate technical records.

Legal basis: Article 6(1)(f) GDPR — our legitimate interests in operating and securing our Website, preventing fraud and misuse and protecting customers and our business.

Where processing is required by law, the legal basis is Article 6(1)(c) GDPR.

4.4 Website analytics and improvement

Subject to applicable consent requirements, we may process information to:

• understand how visitors use the Website;
• analyse website navigation;
• understand which Products receive interest;
• identify technical or usability problems;
• understand cart and checkout behaviour;
• measure website performance;
• assess marketing performance;
• improve Product presentation;
• improve navigation;
• improve checkout;
• improve the customer experience; and
• create aggregated statistics.

Analytics providers may include Shopify, Google and Microsoft Clarity.

Legal basis: Article 6(1)(a) GDPR — consent where consent is required.

4.5 Marketing communications

Where you have provided the required consent, we may use your contact details to send:

• newsletters;
• new Product information;
• promotions;
• offers;
• sales information; and
• other Mirtel Design marketing communications.

You may unsubscribe at any time by using the unsubscribe link included in our marketing emails or by contacting us.

Legal basis: Article 6(1)(a) GDPR — consent, unless another lawful basis is expressly permitted by applicable law.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

4.6 Advertising and advertising measurement

Subject to applicable law and your consent choices, we may use cookies, pixels and similar technologies to:

• measure advertising effectiveness;
• attribute purchases to advertising campaigns;
• understand advertising interactions;
• optimise campaigns;
• create advertising audiences;
• prevent repeatedly showing the same advertising;
• provide more relevant advertising; and
• measure conversions.

Providers may include:

• Google;
• Meta; and
• Shopify.

Legal basis: Article 6(1)(a) GDPR — consent where required.

4.7 Accounting, taxation and legal compliance

We process personal data where necessary to:

• comply with accounting obligations;
• maintain transaction records;
• comply with taxation requirements;
• comply with consumer-protection obligations;
• respond to lawful requests from public authorities;
• comply with court orders; and
• fulfil other legal obligations.

Legal basis: Article 6(1)(c) GDPR — compliance with a legal obligation.

4.8 Fraud prevention, disputes and legal claims

We may process and retain information to:

• identify suspected fraudulent orders;
• investigate suspicious activity;
• prevent payment abuse;
• respond to chargebacks;
• investigate complaints;
• resolve disputes;
• preserve evidence;
• enforce contracts;
• establish legal claims;
• exercise legal rights; and
• defend legal claims.

Legal basis: Article 6(1)(f) GDPR — our legitimate interests in preventing fraud, protecting our business and customers, resolving disputes and establishing, exercising or defending legal claims.

5. Shopify and Shopify Network Intelligence

Our Website and online store are hosted and operated using Shopify.

Shopify provides technology necessary to operate important parts of the Website, including:

• ecommerce hosting;
• customer accounts;
• shopping cart;
• checkout;
• order processing;
• security;
• ecommerce analytics; and
• related online-store functionality.

When you visit or make a purchase from our Website, Shopify collects and processes personal data in connection with providing these functions.

Shopify Network Intelligence

Shopify Network Intelligence is enabled for our online store.

When Shopify Network Intelligence is enabled, Shopify may securely use information about customer interactions with our Website together with information from interactions with:

• Shopify;
• other Shopify merchants; and
• other Shopify services,

to provide and improve certain advanced Shopify functionality referred to as Enhanced Services.

Enhanced Services may help Shopify and merchants:

• provide more customised shopping experiences;
• understand how customers interact with stores and Products;
• improve ecommerce functionality;
• provide analytics and measurement;
• improve fraud detection and security;
• measure advertising effectiveness; and
• where permitted by law and subject to required consent, provide or support more relevant advertising.

This means that information about your activity on our Website may be shared with Shopify and other relevant third parties, including parties located outside your country of residence, for the purpose of providing Shopify functionality and Enhanced Services.

Where Shopify processes personal data for its own purposes, Shopify is responsible for that processing in accordance with its own privacy documentation and applicable law.

You can read more about Shopify's processing of customer personal data in the:

Shopify Consumer Privacy Policy

You may also use the:

Shopify Privacy Portal

to learn about and exercise available rights relating directly to Shopify's processing of your personal data.

Consent and Shopify Network Intelligence

For customers in the European Economic Area, United Kingdom, Switzerland and other jurisdictions requiring consent, we use privacy controls intended to communicate relevant consent choices to Shopify.

Where our Shopify privacy settings and integrations operate as intended:

• if you do not consent to non-essential cookies or tracking technologies, relevant device data from our Website is marked so that Shopify Network Intelligence does not use it for non-essential purposes;
• if you withdraw consent, the withdrawal applies to future processing based on that consent;
• if you validly opt out of relevant data sharing or targeted advertising, Shopify can use that signal to restrict advertising-related use through Shopify Network Intelligence; and
• where applicable, a valid deletion request submitted through us may also result in deletion of relevant information from Shopify Network Intelligence.

Shopify may have its own legal bases for processing where Shopify acts independently. Please consult Shopify's Consumer Privacy Policy for further information.

6. Cookies and Similar Technologies

The Website uses cookies and similar technologies, which may include:

• cookies;
• pixels;
• tags;
• local storage;
• customer-event technologies; and
• other online identifiers.

These technologies may be used for different purposes.

6.1 Strictly necessary technologies

Certain technologies are necessary to:

• operate the Website;
• maintain security;
• provide shopping-cart functionality;
• operate checkout;
• authenticate customer accounts;
• remember privacy choices; and
• provide functionality specifically requested by you.

Where legally classified as strictly necessary, these technologies do not require consent.

6.2 Analytics technologies

Subject to applicable consent requirements, analytics technologies help us:

• measure traffic;
• understand Website usage;
• evaluate Website performance;
• analyse customer journeys; and
• improve the Website.

6.3 Advertising technologies

Subject to applicable consent requirements, advertising technologies may help us:

• measure advertising performance;
• attribute conversions;
• personalise advertisements;
• create advertising audiences; and
• optimise advertising.

6.4 Managing your cookie choices

Where required by applicable law, you can accept, reject or customise non-essential cookies and similar technologies through the cookie banner or Cookie Preferences / Cookie Settings tool available on the Website.

You may change or withdraw your choices at any time.

Withdrawal applies to future processing and does not affect processing that was lawful before withdrawal.

You may also delete or restrict cookies through your browser settings.

Blocking strictly necessary cookies may affect certain Website functions, including cart, account or checkout functionality.

7. Microsoft Clarity

We use Microsoft Clarity, a website-behaviour analytics tool provided by Microsoft.

Clarity helps us understand how visitors interact with the Website and allows us to identify:

• navigation problems;
• confusing page elements;
• technical issues;
• Product-page usability issues;
• cart and checkout friction; and
• opportunities to improve the Website.

For customers in the European Economic Area, United Kingdom and Switzerland, Microsoft's relevant entity may include:

Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
Ireland

7.1 How Clarity works

Clarity may provide:

• aggregated behavioural analytics;
• heatmaps; and
• reconstructed session replays.

A session replay is not a conventional video recording.

Clarity reconstructs activity on a webpage using information about Website structure and visitor interactions.

Clarity does not require access to your camera or microphone for this purpose.

7.2 Information processed by Clarity

Depending on our configuration, your consent choices and Microsoft's functionality, Clarity may process information such as:

• pseudonymous user identifiers;
• project identifiers;
• session identifiers;
• page identifiers;
• IP address;
• approximate geographic region;
• browser;
• device;
• operating system;
• screen dimensions;
• browser-window dimensions;
• language;
• referring page;
• pages visited;
• navigation paths;
• timestamps;
• clicks;
• taps;
• scrolling;
• mouse movements;
• selections;
• page visibility;
• website-performance information;
• script or image errors;
• diagnostic information;
• page structure and layout information;
• Product views;
• cart interactions; and
• ecommerce events made available through integrations.

We may use this information to analyse Website use and improve our online store.

7.3 Sensitive information and masking

Microsoft Clarity masks sensitive information in input fields.

Information entered into input boxes and selected through dropdown fields is masked by Clarity.

Masked information is not intended to be transmitted to Clarity.

We do not intentionally configure Clarity to collect passwords, full payment-card information, private customer-service communications or other information unnecessary for website-behaviour analytics.

7.4 Clarity consent mode

For users in the EEA, United Kingdom and Switzerland, Microsoft requires an appropriate consent signal before Clarity uses cookies for its full cookie-based functionality.

Our privacy controls are intended to ensure that Clarity cookies are used only where the necessary consent has been provided.

If the necessary consent is not provided:

• Clarity cookies are not used for that visitor; and
• some Clarity functionality and measurement are limited.

Depending on Microsoft's current technical implementation, individual page views or limited interaction information may still be processed without persistent Clarity cookies, but separate page views may not be linked into a continuing identified session.

We do not use Clarity's no-consent functionality to circumvent your privacy choices.

You may change or withdraw your analytics consent through our Cookie Preferences / Cookie Settings tool.

7.5 Clarity retention

Microsoft determines the retention periods applied within the Clarity platform.

Microsoft currently states that standard playback data is generally retained for approximately 30 days, while certain aggregated click or heatmap data and labelled or favourited sessions may be retained for up to approximately nine months.

Microsoft's technical practices may change over time. Current information is available in the official Microsoft Clarity documentation.

Further information about Microsoft's privacy practices is available in the Microsoft Privacy Statement.

8. Google Analytics and Google Advertising

Subject to applicable consent requirements, we may use Google analytics and advertising products provided by Google Ireland Limited and related Google entities.

Depending on our configuration, Google may process information such as:

• IP address;
• approximate location;
• browser information;
• device information;
• operating system;
• language;
• online identifiers;
• pages viewed;
• Products viewed;
• campaign information;
• website interactions;
• cart events;
• checkout events;
• purchase events;
• transaction value; and
• currency.

We may use Google technologies to:

• measure Website use;
• understand traffic sources;
• measure advertising effectiveness;
• analyse conversions;
• improve the Website; and
• where consent has been provided, support remarketing or personalised advertising.

Google may process information for its own purposes in accordance with the Google Privacy Policy.

Google advertising preferences can be managed through Google Ads Settings.

Legal basis: Article 6(1)(a) GDPR — consent where required.

9. Meta – Facebook and Instagram

Subject to applicable consent requirements, we may use advertising technologies provided by Meta Platforms Ireland Limited and related Meta entities.

These may include:

• Meta Pixel;
• Advanced Matching; and
• Conversions API.

We use these technologies to help:

• measure advertising performance;
• attribute purchases to advertising;
• understand interactions with our Website;
• optimise advertising campaigns;
• create advertising audiences; and
• show relevant advertisements on Facebook and Instagram.

Depending on our configuration, information made available to Meta may include:

• pages visited;
• Products viewed;
• cart events;
• checkout events;
• purchase events;
• transaction value;
• currency;
• transaction identifiers;
• browser information;
• device information;
• IP address;
• cookie and advertising identifiers; and
• contact identifiers such as an email address or telephone number in hashed form where matching functionality is enabled.

Information may be transmitted through browser-based technologies or server-side technologies such as Conversions API.

Meta may process information for its own purposes in accordance with its own privacy documentation.

More information is available in the Meta Privacy Policy.

Advertising choices may be managed through Meta Ad Preferences.

Legal basis: Article 6(1)(a) GDPR — consent where required.

10. Payment Providers

We use third-party payment providers to securely process payments.

When you choose a payment method, relevant personal data may be provided directly to or processed by:

• the payment provider;
• financial institutions;
• banks;
• card networks;
• payment-authentication services; and
• fraud-prevention providers.

Those providers may process your information under their own privacy policies and legal obligations.

We receive only information reasonably necessary to confirm and administer your payment and order.

11. Shipping and Delivery Providers

To deliver Products, we may disclose necessary personal data to:

• postal operators;
• courier companies;
• parcel-locker providers;
• freight providers;
• customs or import intermediaries where applicable; and
• other logistics providers.

Information disclosed may include:

• recipient name;
• delivery address;
• telephone number;
• email address;
• order or shipment reference;
• package information; and
• other information necessary to complete or manage delivery.

These providers receive only information reasonably necessary for their role in delivering, tracking, returning or handling the shipment.

12. Other Parties With Whom We May Share Personal Data

We do not disclose personal data arbitrarily.

We may share relevant information with the following categories of recipients where reasonably necessary.

Ecommerce and technology providers

Including:

• Shopify;
• website-service providers;
• hosting providers;
• IT providers;
• security providers; and
• customer-support providers.

Analytics and advertising providers

Including:

• Google;
• Meta;
• Microsoft; and
• Shopify.

Professional advisers

Where necessary, we may provide relevant information to:

• accountants;
• auditors;
• insurers;
• legal advisers;
• consultants; and
• professional claims or debt-recovery providers.

Public authorities

Where required or permitted by law, we may provide relevant personal data to:

• courts;
• regulators;
• tax authorities;
• law-enforcement authorities;
• customs authorities; and
• other competent public bodies.

Legal claims and disputes

We may disclose relevant information to persons or organisations where reasonably necessary to:

• investigate fraud;
• respond to a chargeback;
• resolve a dispute;
• enforce a contract; or
• establish, exercise or defend a legal claim.

Business transactions

If all or part of OÜ Top Textile is subject to a sale, merger, acquisition, restructuring, financing transaction or transfer of business, relevant information may be disclosed to potential counterparties and professional advisers subject to appropriate confidentiality and data-protection safeguards.

13. Sale, Sharing and Targeted Advertising

We do not sell your personal data for monetary consideration.

However, privacy laws in some jurisdictions use broader definitions of terms such as:

• “sale”;
• “sharing”; and
• “targeted advertising”.

Certain disclosures of online identifiers, browsing information or advertising information to Shopify, Meta, Google or other advertising providers may therefore be legally classified as a “sale”, “sharing” or use for “targeted advertising” even where no money is paid in exchange for your personal data.

Where applicable law gives you the right to opt out, we provide the required privacy choices.

If available in your jurisdiction, you may use our Your Privacy Choices / Data Sharing Opt-Out page to submit the relevant opt-out choice.

Where supported and legally required, our Website may also recognise Global Privacy Control (GPC) signals.

14. International Data Transfers

Some of our technology, payment, ecommerce, advertising and analytics providers may process personal data outside Estonia or outside the European Economic Area.

This may include processing in:

• other EEA countries;
• the United States;
• Canada; and
• other countries where a provider, its affiliates or subprocessors operate.

Where personal data is transferred outside the EEA and an appropriate safeguard is required, transfers may rely on mechanisms such as:

• an adequacy decision adopted by the European Commission;
• European Commission-approved Standard Contractual Clauses;
• participation in an applicable recognised data-transfer framework; or
• other legally recognised transfer safeguards.

Where appropriate, additional contractual, technical or organisational safeguards may also be used.

You may contact us for further information regarding safeguards relevant to a particular transfer.

15. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for related legitimate purposes.

The appropriate retention period depends on:

• the type of information;
• the purpose for which it was collected;
• contractual obligations;
• accounting obligations;
• legal requirements;
• security considerations;
• fraud-prevention requirements;
• limitation periods; and
• whether a dispute or legal claim exists or is reasonably anticipated.

Accounting and transaction records

Accounting source documents and other records required to reconstruct business transactions are generally retained for seven years from the end of the relevant financial year, in accordance with applicable Estonian accounting requirements.

Order records

Order, payment-confirmation, delivery, return, exchange and refund information may be retained during the customer relationship and afterwards for applicable accounting, taxation, consumer-protection, warranty, contractual and legal limitation periods.

Customer-service communications

Customer-service communications may be retained for a reasonable period where necessary to:

• administer an order;
• demonstrate information provided to a customer;
• resolve a complaint;
• handle a return;
• investigate fraud;
• respond to a chargeback; or
• establish, exercise or defend legal claims.

Customer accounts

Customer-account information may be retained while the account remains active and for a reasonable period afterwards, except where longer retention is required or justified.

Marketing information

Marketing contact information is processed until you withdraw consent, unsubscribe, the information is no longer necessary or we determine through periodic review that continued retention is no longer appropriate.

Records of consent and withdrawal may be retained for longer where reasonably necessary to demonstrate compliance with applicable law.

Security and fraud-prevention information

Technical, security and fraud-prevention information may be retained for a period proportionate to the relevant security, fraud-prevention or operational need.

Disputes, complaints, chargebacks and legal claims

If an order, payment, complaint, return, chargeback, suspected fraud, investigation or other dispute is pending or reasonably anticipated, we may retain information relevant to the matter beyond our usual retention period where reasonably necessary and legally permitted.

Relevant information may be retained:

• while the matter is being investigated;
• until the matter is finally resolved; and
• where appropriate, until applicable limitation or legal-claim periods have expired.

When personal data is no longer required, we delete or anonymise it unless further retention is required or permitted by law.

Backup copies may remain for a limited period until overwritten or deleted according to our providers' normal backup processes.

16. Your Data Protection Rights

Depending on applicable law and subject to relevant conditions and exceptions, you may have the right to:

• obtain confirmation of whether we process personal data relating to you;
• access your personal data;
• receive a copy of your personal data;
• request correction of inaccurate information;
• request completion of incomplete information;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• withdraw consent at any time where processing is based on consent;
• receive eligible personal data in a structured, commonly used and machine-readable format;
• have eligible data transmitted to another controller where applicable;
• lodge a complaint with a data-protection supervisory authority; and
• benefit from protections relating to certain decisions based solely on automated processing.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

17. Exercising Your Rights

For requests relating to processing carried out by OÜ Top Textile / Mirtel Design, contact:

contact@mirteldesign.com

Please describe your request clearly enough for us to understand what you are requesting.

Identity verification

To protect personal data against unauthorised disclosure, alteration or deletion, we may request information reasonably necessary to verify your identity.

We will not intentionally request more information than reasonably necessary for verification.

Response time

We respond to valid requests within the period required by applicable law.

Under GDPR this is normally within one month of receiving the request.

Where a request is particularly complex or where numerous requests have been received, the response period may be extended where permitted by law.

Where an extension applies, we will provide the information required by applicable law.

18. Manifestly Unfounded or Excessive Requests

Data-protection rights are generally exercised free of charge.

However, where permitted by applicable law, if a request is manifestly unfounded or excessive, particularly because of its repetitive character, we may:

• charge a reasonable fee taking into account the administrative costs of responding to the request; or
• refuse to act on the request.

We will assess the circumstances of each request individually.

We will rely on this exception only where we reasonably consider that the legal requirements for doing so have been met.

Where required by law, we will explain why we have declined to act and provide information about available complaint or judicial-remedy rights.

19. Limits to Data-Protection Rights

Data-protection rights are not absolute.

Depending on the circumstances and applicable law, we may be required or permitted to retain or continue processing certain information despite a request for deletion or objection.

For example, this may apply where information is necessary:

• to comply with a legal obligation;
• for accounting or taxation purposes;
• to prevent or investigate fraud;
• to resolve an active dispute;
• to respond to a chargeback;
• to establish, exercise or defend legal claims;
• to protect the rights and freedoms of another person; or
• where another statutory exception applies.

We may also be unable to fulfil certain rights in relation to pseudonymous information where we cannot reasonably identify the individual to whom that information relates.

20. Rights Relating Directly to Shopify

Because Shopify Network Intelligence is enabled, Shopify may independently process certain information relating to customer interactions for Shopify's own Enhanced Services and other purposes described by Shopify.

You therefore have privacy rights directly with Shopify in relation to processing for which Shopify is responsible.

More information is available in the:

Shopify Consumer Privacy Policy

You can also exercise available Shopify privacy choices through the:

Shopify Privacy Portal

These rights are separate from your rights relating to processing carried out by OÜ Top Textile.

21. Additional Rights in Certain Jurisdictions

Some jurisdictions provide additional privacy rights.

Depending on where you live, these may include rights relating to:

• targeted advertising;
• sale of personal data as legally defined;
• sharing of personal data;
• profiling;
• automated decision-making; or
• appealing certain privacy decisions.

Where such laws apply to us and to you, we will provide the notices and privacy controls required by applicable law.

Where available, relevant choices may be provided through:

• Cookie Preferences;
• Your Privacy Choices;
• Data Sharing Opt-Out;
• Shopify Privacy Portal; or
• another privacy-control mechanism displayed on the Website.

22. Automated Decision-Making and Fraud Prevention

OÜ Top Textile does not intentionally use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you.

However, payment, fraud-prevention, ecommerce or security providers may use automated systems to identify:

• suspicious payments;
• potential fraud;
• unusual transaction patterns;
• account misuse; or
• security risks.

A transaction may therefore be flagged, delayed, subject to additional authentication, reviewed or declined according to the applicable provider's systems, contractual terms and legal obligations.

Where appropriate, we may review information reasonably necessary to protect our customers, payments and business.

23. Whether You Must Provide Personal Data

You are generally free to decide whether to provide personal data.

However, certain information is necessary to allow us to:

• accept an order;
• enter into a sales contract;
• process payment;
• deliver Products;
• provide tracking;
• create a requested customer account;
• process a return or exchange;
• issue a refund; or
• comply with legal obligations.

If required information is not provided, we may be unable to process or fulfil your order or provide the requested functionality.

Providing information for marketing, non-essential analytics and personalised advertising is voluntary where consent is required.

Refusing or withdrawing consent to non-essential analytics or advertising does not prevent you from purchasing Products or using the essential functions of the Website.

24. Security

We use reasonable and appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unlawful disclosure;
• accidental loss;
• alteration;
• destruction; and
• misuse.

Depending on the system and type of processing, safeguards may include:

• access controls;
• authentication;
• encryption in transit;
• confidentiality requirements;
• system monitoring;
• fraud-prevention measures;
• established ecommerce and payment providers; and
• backups.

No website, internet transmission or electronic storage system can be guaranteed to be completely secure.

You are responsible for keeping your own device, email account and account-access methods secure.

If you suspect unauthorised use of your Mirtel Design account or an order placed in your name, please contact us.

25. Children's Privacy

The Website primarily sells professional workwear and is not specifically designed or directed at children.

We do not knowingly collect children's personal data for behavioural advertising or marketing in circumstances where doing so would be prohibited by applicable law.

If you believe personal data relating to a child has been provided to us unlawfully, please contact us so that we can investigate and take appropriate action.

26. Third-Party Websites

The Website may contain links to websites or services operated by third parties.

We do not control the privacy practices of independent third parties.

When you leave our Website or interact directly with another service, that provider's own privacy policy, cookie policy, terms and security practices may apply.

We encourage you to review relevant third-party privacy information before providing personal data.

27. Complaints

If you believe we have processed your personal data unlawfully or incorrectly, you may contact us so that we can investigate and respond.

You also have the right to lodge a complaint with a competent data-protection supervisory authority.

For OÜ Top Textile, the Estonian supervisory authority is:

Andmekaitse Inspektsioon
Estonian Data Protection Inspectorate

Tatari 39
10134 Tallinn
Estonia

Email: info@aki.ee
Website: aki.ee

You may also have the right to complain to the competent supervisory authority in your habitual place of residence, place of work or place of the alleged infringement.

28. Changes to This Privacy Policy

We may update this Privacy Policy from time to time where necessary to reflect changes in:

• our Website;
• Products;
• ecommerce functionality;
• business practices;
• service providers;
• Shopify functionality;
• Shopify Network Intelligence;
• analytics technologies;
• advertising technologies;
• legal requirements; or
• privacy practices.

The current version will be published on this page with an updated “Last updated” date.

Where required by law, we will provide additional notice or obtain renewed consent before a material change takes effect.

29. Contact Us

For questions, privacy requests or concerns regarding this Privacy Policy or OÜ Top Textile's processing of personal data, contact:

OÜ Top Textile (Mirtel Design)
Raua 55
10120 Tallinn
Estonia

Registry code: 11034048
VAT number: EE100902626

Email: contact@mirteldesign.com
Phone: +372 5553 7102

Website: mirteldesign.com