Privacy policy
Last updated: 10 November 2026
1. Controller
Anderson Beer OÜ, registration number 12663384, Tähe 112a, 50107 Tartu, Estonia, is the controller. Privacy enquiries and rights requests: info@andersonbeer.com.
2. Information and purposes
- Purchases and delivery: name, email, phone, billing and delivery details, selected parcel point, basket, products and payment status, to enter into and perform the contract, provide support and handle returns (GDPR Article 6(1)(b)).
- Legal obligations: invoices, accounting and tax records, and information necessary for age checks where applicable (Article 6(1)(c)). Age verification does not automatically involve keeping a copy of identification.
- Newsletter: subscribed email, optional form information and consent record, to send offers with consent (Article 6(1)(a)). Unsubscribe through any newsletter or by contacting us. Essential order-related messages continue independently.
- Shop analytics: with consent, page and product views, button clicks, basket additions, checkout steps and completed purchases. Pärdik uses pseudonymous identifiers, page paths without query parameters and product/order summary data. Its analytics events do not store form contents, names, emails, delivery addresses or payment-card details (Article 6(1)(a)).
- Security and claims: necessary technical logs and correspondence to prevent fraud, protect systems and establish or defend claims, based on our legitimate interest in secure services and protecting rights (Article 6(1)(f)).
Required checkout information is necessary to process and deliver orders. Without it, we may be unable to fulfil your purchase. Newsletter and optional analytics consent are not conditions of purchase.
3. Service providers and transfers
We use Shopify for our shop, Sender for newsletters, MRPeasy for order and invoice management, and our Pärdik system for orders, shipping and consent-based analytics. Payment and delivery providers selected at checkout receive necessary information; shipping may involve Montonio, SmartPosti and Omniva. Hosting, IT and accounting providers receive information necessary for their tasks, as do authorities where required by law.
Shopify may act as an independent controller for some processing. See its Consumer Privacy Policy and Privacy Portal. Transfers outside the European Economic Area must rely on an applicable adequacy decision or other GDPR safeguards, such as standard contractual clauses. Contact us for information about applicable safeguards.
4. Cookies and choices
Necessary cookies and browser storage support the basket, checkout, security, age declaration and privacy preferences. Optional analytics starts with consent. You can change your choice in the shop’s cookie/privacy settings. You may block or delete cookies in your browser, although this can affect the basket and checkout. Withdrawal of consent does not affect earlier lawful processing.
5. Retention and security
Accounting source documents are retained for seven years from the end of the relevant financial year. Other order and correspondence records are kept as necessary for performance and applicable claim limitation periods. Active newsletter subscriptions last until withdrawal; necessary consent evidence or suppression records may be retained to prove consent and prevent further messages. Pärdik analytics events are retained for up to 90 days. Access is restricted by job responsibilities, with appropriate technical and organisational safeguards.
6. Your rights
Subject to applicable conditions, you may access, correct or erase your information, restrict processing, object to processing based on legitimate interests and obtain portable information in machine-readable form. Consent can be withdrawn at any time. You may always object to direct marketing. We generally respond within one month and may verify identity. Legal retention duties may prevent immediate deletion of some records.
You may complain to Estonia’s Data Protection Inspectorate or your local competent supervisory authority. We update this policy when our practices change and give notice where legally required.