Privacy policy

Last updated: March 10, 2026

This Privacy Policy describes how Vireo Beverages OÜ (“Omppis”, “we”, “us”, or “our”) collects, uses, and discloses your personal information when you visit, use our services, or make a purchase from our Shopify-powered online store (the "Services"), or otherwise communicate with us.

1. Data Controller

Vireo Beverages OÜ is the data controller responsible for your personal information.

  • Address: Kesklinna linnaosa, Tornimäe tn 5, 10145 Tallinn, Estonia

  • Registry Code: 17422113

  • Email: rafael@omppis.com (Please include “Privacy” in the subject line)

2. Personal Information We Collect

Depending on how you interact with our Services, we collect the following categories of information:

  • Contact & Identity Data: Name, billing address, shipping address, email address, and phone number. For B2B customers: Company name and VAT number.

  • Financial Information: Payment confirmation and transaction details. Note: We do not store full payment card numbers. All payments are processed securely by our providers (Shopify Payments, Stripe, Revolut).

  • Account Information: Username, hashed password, and account preferences.

  • Transaction Information: Products viewed, items in cart, purchase history, returns, and cancellations.

  • Technical & Usage Data: IP address, device information, browser type, and information on how you navigate our website (collected automatically via cookies and similar technologies).

  • Communications: Information included in support inquiries or contact forms.

3. Why We Process Your Data (Legal Bases)

Under the GDPR, we rely on the following legal bases:

  • Contract (Art. 6(1)(b) GDPR): To fulfill your orders for beverages, process payments, and manage your customer account.

  • Legal Obligation (Art. 6(1)(c) GDPR): To comply with tax, accounting, and consumer protection laws.

  • Legitimate Interests (Art. 6(1)(f) GDPR): To prevent fraud, ensure website security, and improve our product offerings.

  • Consent (Art. 6(1)(a) GDPR): For marketing communications (newsletters) and non-essential cookies (Analytics/Marketing).

4. How We Share Your Information

We disclose your personal information to third parties who perform services on our behalf:

  • Shopify: Our primary platform provider for hosting, checkout, and data processing.

  • Payment Processors: Stripe (via Shopify Payments) and Revolut for secure transaction handling.

  • Shipping & Logistics: Posti, Itella, or Omniva to deliver our beverages to you in Finland and Estonia.

  • Business Operations: Enty for accounting and compliance support.

  • Marketing & Analytics: Google Analytics, Meta Pixel, and TikTok Pixel (subject to your cookie consent).

  • Legal Authorities: When required by law or to protect our legal rights.

5. Relationship with Shopify

Our store is hosted by Shopify Inc. Shopify processes your information to provide and improve the Services. Please note that your data may be transmitted and stored outside of the EEA (e.g., in the US). We and Shopify rely on recognized transfer mechanisms, such as the European Commission's Standard Contractual Clauses (SCCs), to ensure your data remains protected.

6. Cookies and Similar Technologies

We use cookies to enhance your shopping experience:

  • Necessary Cookies: Required for core functions like secure login, shopping cart, and fraud prevention.

  • Analytics & Marketing Cookies: With your consent, we use these to understand site usage and show relevant advertising. You can manage your preferences via our cookie banner.

7. Data Retention

We retain your personal information only as long as necessary:

  • Account Data: Until you request deletion or your account becomes inactive.

  • Order & Invoicing Data: Retained for several years as required by Estonian tax and accounting laws.

  • Marketing Data: Until you withdraw your consent (e.g., unsubscribe from "tasty emails").

8. Your Rights (GDPR)

Depending on your residence (EEA/UK), you have the following rights:

  • Access, Deletion, and Correction: You can request a copy of your data or ask us to delete/fix it.

  • Portability: Request to move your data to another service.

  • Object/Restrict: Object to processing based on legitimate interests or restrict certain types of processing.

  • Withdraw Consent: Opt-out of marketing at any time.

To exercise these rights, please contact us at the email provided above.

9. Security and Children's Data

  • Security: We apply technical measures to protect your data, but please be aware that no transmission over the internet is 100% secure.

  • Children: Our Services are not intended for children under 16. We do not knowingly collect data from children.

10. Complaints

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority:

  • Estonia: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)

  • Finland: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices (e.g., new payment methods or logistics partners). The "Last updated" date at the top will indicate the latest version.