Balti Jaama Turg Privacy Policy

The Privacy Policy applies to the use of the Astri.ee environment (hereinafter referred to as the Online Store), the purchase of gift cards, and the processing of data collected by Astri Group shopping centers (hereinafter referred to as the Center). The Online Store is operated by Astri Internet OÜ (registration code 12555312, address Lääneringtee 39, Tartu 50501), while the Centers are operated by different legal entities. You can find the list of Centers and their operators here. For clarity and simplicity, the administrators of the Online Store and Centers belonging to the Astri Group are referred to as Astri in these Privacy Policy terms. Astri is the data controller of the collected personal data. The Privacy Policy describes how Astri processes (including collects, uses, discloses, stores, transfers, deletes, etc.) personal data. Information about your rights as a data subject is also provided. Please read the Privacy Policy carefully before submitting any data, using services, or entering into agreements. The Privacy Policy is inseparably linked to the Terms of Use of the Online Store https://astri.ee/kasutustingimused/. In matters not regulated by the Privacy Policy, Astri follows the applicable legal acts.

1.1. Identification data and general information – first and last name,
personal identification code, gender, online store username;
1.2. Contact information – postal address, email, phone number;
1.3. Consumer behavior data – preferred parcel machines, preferred
payment methods, preferred centers, etc.;
1.4. Purchase data – receipt numbers, campaign codes, bank account
number, orders made, gift card usage locations, etc.;
1.5. Customer feedback – ratings, email statistics, etc.;
1.6. Digital data in the online store – web cookies, log information,
etc.

2.1 Astri collects personal data when the user (for the purposes of these privacy terms, the user is both the user of the Online Store and the visitor of the Center): 

2.1.1. registers an Astri ID account (hereinafter referred to as the account); 

2.1.2. updates account information; 

2.1.3. makes searches; 

2.1.4. orders a gift card; 

2.1.5. participates in campaigns (for example, coupon campaigns organized in the Centers); 

2.1.6. participates in the loyalty program; 

2.1.7. provides information via Astri Group customer support. 

2.2. Astri collects cookies from all Website visitors (including non-users).

3.1 Astri processes the user's first name, phone number, address (if you choose delivery by courier), and email address primarily for the sale and delivery of gift cards, i.e., for the preparation, conclusion, and fulfillment of the contract, as well as for resolving any disputes arising from the contract.

3.2 If the user has provided personal data to Astri, the user may also voluntarily grant Astri the right to send information about Astri’s (including the Online Store and various Centers) products and services (direct marketing offers). In this case, Astri processes the user's personal data based on consent for making offers, including personalized offers. The user can give this consent during registration or later via their account at https://astri.ee/account/ (hereinafter via their account). For the purpose of providing better offers, the user may add additional information to their account, such as gender, personal identification code, etc. Giving consent for direct marketing offers is voluntary, and the user has the right to withdraw their consent at any time via their account. This means that processing will be stopped from the moment consent is withdrawn.

3.3 Astri may also process personal data on the basis of consent in other cases (for example, for participation in loyalty programs or campaigns), in which case the purpose of processing will be specified during the collection of consent. Any consent given for processing is voluntary and can be withdrawn at any time. This means that processing will be stopped from the moment consent is withdrawn.

3.4 Astri processes personal data to fulfill obligations arising from legal acts. These obligations mainly arise from the European Union General Data Protection Regulation, the Personal Data Protection Act, the Law of Obligations Act, and other applicable legislation. For example, in connection with obligations arising from legal acts, Astri processes the user's purchase data, which is necessary, among other things, for fulfilling accounting obligations.

3.5 Astri processes personal data based on Astri’s legitimate interests, including for business purposes and for security reasons (detection and prevention of fraud). For example, Astri has a legitimate interest in retaining user data for the duration of the limitation period for claims arising from the contract to protect its rights. Astri may also process consumer behavior data based on legitimate interest. Astri collects data about the user's preferred payment methods, parcel machines and postal addresses, viewed offers and searches, campaign participation, and other consumer behavior in order to provide the user with the most convenient shopping experience and personalized service. In each such case, Astri thoroughly assesses whether its interests in processing outweigh the user's interests and rights. If Astri finds that the processing is justified, it implements adequate measures to ensure the protection of the user's rights, including fairness, impartiality, and accuracy of processing.

4.1 According to legal acts, Astri has both the right and the obligation to retain the collected personal data. Astri does not retain personal data longer than necessary for fulfilling obligations to the user, obligations arising from legal acts, or for asserting or defending Astri's legal claims, except where the user has given consent for longer retention and processing of the data.

4.2 Astri generally retains data related to the user's account and purchases for as long as the account remains active and for three years and three months after the account has been deleted. If Astri has reason to believe that the user has deliberately breached obligations towards Astri, Astri may retain the user's data for ten years and three months after the account has been deleted. You can submit a request to delete your account through your account in the online store.

4.3 Astri retains your account for 5 years after your last purchase (active account), unless you have explicitly requested the deletion of the account. If you have not made any purchases within 5 years, Astri will send you an inquiry to check your account's activity. If you do not respond to the inquiry within the specified time, Astri will assume your account is inactive and may delete your account.

4.4 Astri retains accounting source documents, including personal data contained therein, for seven years from the end of the financial year in which the transaction was recorded in the accounting register based on the source document.

4.5 If you wish to receive additional information regarding the retention of your data, please submit a request through your account.

5.1 Astri transmits personal data to the extent and in the form necessary to fulfill the purposes listed in the privacy policy. Astri may transmit personal data to authorized processors who need access to the data in order to provide services to Astri. Data disclosure takes place so that Astri can fulfill contracts (orders) concluded with the user. 

5.2 As a rule, Astri ensures the processing and storage of data within the territory of the European Union, except for the user's email address, for which the user has given consent to receive direct marketing offers. Astri may also use authorized processors whose servers are located outside the European Union. In doing so, Astri ensures the comprehensive security of your personal data, based on, among other things, the EU-US Privacy Shield Framework or by applying other data protection measures required by law. 

5.3 Astri also discloses personal data if Astri is obligated to do so by law. Such an obligation to disclose data may arise, for example, at the lawful request of authorities. 

6.1 Astri processes personal data in balance with the user's rights and freedoms and in accordance with applicable legislation. 

6.2 The user has the right to obtain information about the types and sources of collected personal data, as well as the purposes for which the data is used. The user can view the collected data on their account page in the online store. The user has the right to obtain copies and extracts of the personal data processed by Astri. The user has the right to request the transfer of personal data, including the transfer of personal data to another data controller. The requested data will be provided by email in a machine-readable file. 

6.3 If the data is incorrect or inaccurate, the user has the right to request the data to be supplemented or corrected. 

6.4 The user has the right to request the deletion of personal data. The user's data will not be deleted and processing will not be terminated if this would conflict with the obligation to process personal data or if there is another basis for continuing the processing. Termination of personal data processing may hinder the provision of the service. In particular, the user has the right to request the termination of personal data processing and deletion of data if: the personal data is no longer needed for the purpose for which Astri processed it; the user withdraws their consent for processing and there is no other legal basis for processing the personal data; the user objects to the processing of personal data and there are no overriding legitimate grounds for processing; the personal data has been processed unlawfully; the personal data must be deleted to comply with a legal obligation. 

6.5 Please submit all questions and requests related to the processing of personal data via your account. If you do not have an online store account or are unable to use it for any reason (for example, if you cannot log in), you can contact Astri by email at astri@astri.ee. Astri will respond to submitted questions and requests within one month at the latest. Disputes will be resolved through negotiations. 

6.6 If the user believes that Astri has violated their rights and the dispute could not be resolved through negotiations, the user has the right to contact the Data Protection Inspectorate or a competent court. 

7.1 Astri collects cookies from all website visitors (including non-users). Cookies are small text files that are stored on your device (computer, phone, tablet, etc.) via your web browser when you visit the website. Cookies are primarily used to ensure the proper and efficient functioning of the website and to provide a more convenient and personalized user experience. Cookies collect information about the use of the website and store data on your device to help you log into your account, remember the contents of your shopping cart when shopping in the online store, and analyze your visits to our website. Cookies do not collect data from your device. 

7.2 When you first visit the website, you will be informed about the use of cookies. You can disable the use of cookies at any time by changing your browser settings. To remove cookies previously installed on your device, you need to change your browser settings or manually delete the cookies. You can disable the use of all cookies in your browser. If you disable the use of cookies, some parts of the website may not function properly, and your use of the website may be disrupted. 

7.3 Astri's website uses session cookies and persistent cookies. Session cookies are stored on your device during your browser session and are deleted from your device after you close your browser. Persistent cookies are stored on your device between browser sessions. Persistent cookies allow your preferences or actions on the website to be remembered. Persistent cookies remain on your device after closing your browser and persist until you delete them from your browser. 

7.4 Astri's website uses the following types of cookies: necessary cookies, analytical cookies, and third-party cookies. Necessary cookies are used to ensure the proper and secure operation of the website; they are essential for using the website and for certain functions to work. Analytical cookies collect information about how many visitors our website has, from where visitors arrive, etc. Analytical cookies enable us to improve the overall user experience. Third-party cookies allow us to present personalized and relevant advertisements, which the visitor may also see later when visiting other websites. 

7.5 Additionally, please note that Astri's website contains links to various public social media channels of Astri Group and online store partners, as well as third-party websites. Astri is not responsible for the content or security of third-party websites; the owners of those websites are responsible for their security. If you visit any third-party websites or social media pages, please review the privacy terms of the specific website. 

7.6 If you post messages, pictures, comments, or share Astri's social media posts on Astri's public social media pages, please remember that information on public social media channels can be accessed by any user or visitor of that particular social media channel. We recommend making sure in advance that the information you share on social media is information you wish to disclose. 

Astri reserves the right to make changes to the privacy policy. The terms may be changed primarily (but not exclusively) to comply with data protection legislation. Changes will be published in the online store. The terms valid at the time of the transaction apply to the transaction. 

These privacy terms have been published as of 18.06.2025.