Privacy policy

Who processes the data

The controller of personal data on andija.com is the NIKA association of the disabled (Invaliidide Assotsiatsioon NIKA), registration number 80307400, Ahtri 10a, Tallinn, Estonia. The association runs the Andija shop, the pilgrimages of the Andcross centre and the acceptance of prayer notes and donations.

Contact on any question about your data: the form on the Contacts page or phone +372 5660 5859.

What data we collect

• when you order: name, delivery address, email, phone, the order contents and the payment method;
• when you submit a prayer note: your name and email and the names of those to be commemorated;
• when you make a donation: name, email and the amount;
• when you apply for a trip: name, contacts, the trip, the number of participants and what you tell us about your needs;
• when you write through a form or create an account: what you enter in the form, your email and password (the password is stored only in encrypted form);
• when you subscribe to the newsletter: your email;
• technical data: the IP address and browser data in server logs and, only with your consent, analytics data (see the cookie policy).

Why we use it and on what grounds

• to fulfil an order, deliver a prayer note, accept a donation and arrange a trip: the contract with you (GDPR art. 6(1)(b));
• to keep accounting records of orders and payments: a legal obligation (art. 6(1)(c));
• to answer your question and protect the site against abuse: our legitimate interest (art. 6(1)(f));
• the newsletter and analytics: your consent (art. 6(1)(a)), which you can withdraw at any time.

Names in prayer notes

The names in a prayer note show your religious beliefs, so they are special category data (GDPR art. 9). We process them only with your explicit consent, which you give with a separate checkbox before paying for the note. The names are passed only to the monastery where the note is submitted. We keep them for 24 months after the note is delivered, then remove the names from the order; the amount and the date remain.

Who receives the data

• the postal service or courier: the name, address and phone for delivery;
• payment providers (the bank, PayPal and the card payment processor): the data needed for the payment; we do not see or store your card details;
• the monastery: only the names from a prayer note;
• hosting, email and newsletter service providers that process the data on our instructions;
• Google (Google Analytics): only with your consent to analytics cookies.

We do not sell personal data and do not pass it on for advertising. Some service providers (for example, PayPal or Google) may process data outside the EU; in that case the transfer is based on the European Commission's standard contractual clauses or an adequacy decision.

How long we keep the data

• orders and payment documents: 7 years, as required by the Estonian Accounting Act;
• names in prayer notes: 24 months after the note is delivered;
• trip requests and messages from forms: 3 years after the last contact;
• the account: until you delete it or ask us to delete it;
• the newsletter: until you unsubscribe (the link is in every letter);
• the record of your cookie consent: 24 months.

Your rights and contacts

You can request a copy of your data, correct or delete it, restrict its processing, object to it, receive the data in a machine-readable form and withdraw your consent. Write to us through the form on the Contacts page; we reply within one month. In your personal account you can change your details yourself; the link to delete the account and the data is on the account details page.

If you believe that we process your data unlawfully, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the supervisory authority of your country.