Last updated: 1 September 2026

This Privacy Policy explains how Gimmel Studio OÜ ("Gimmel Sports", "we", "us") collects, uses and protects your personal data when you visit gimmelsports.com (the "Site"), place an order, or contact us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.

1. Controller

The controller responsible for your personal data is:

Gimmel Studio OÜ
Registry code: 16779161
Ahtri 12
15551 Tallinn
Estonia
Email: hello@gimmelsports.com

2. What data we collect

Order and account data. When you place an order or create an account we collect your name, billing and shipping address, email address, phone number, the products you order (including any personalisation details such as names, numbers or artwork you supply), your order history, and payment information. Payment card details are processed directly by our payment providers; we never see or store your full card number.

Communication data. When you contact us by email, chat or social media we keep the content of the communication, your contact details and any attachments (for example photos you send for a guarantee claim).

Device and usage data. When you browse the Site we automatically collect technical information such as your IP address, browser type and version, device type, operating system, time zone, language, referring page, the pages you view, the products you look at, and how you interact with the Site. This is collected through cookies, log files, pixels and similar technologies (see section 8).

Marketing data. If you sign up to our newsletter or accept marketing, we keep your email address, your consent record and information about which emails you open and click.

Team and business orders. For team orders we collect the contact details of the person placing the order and the names, numbers and sizes of players where these are needed for personalisation. The person placing the order is responsible for having the right to share this information with us.

We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

3. Why we use your data and on what legal basis

Purpose Data used Legal basis
Processing and delivering your order, including production of custom items, payment, shipping, invoicing and customs paperwork Order data Performance of a contract (Art. 6(1)(b) GDPR)
Handling returns, exchanges, withdrawal requests and guarantee claims Order and communication data Performance of a contract; legal obligation (Art. 6(1)(b) and (c))
Answering your questions and providing customer support Communication data Performance of a contract; legitimate interest in serving customers (Art. 6(1)(b) and (f))
Keeping accounting and tax records Order data Legal obligation (Art. 6(1)(c)), including the Estonian Accounting Act and VAT law
Preventing fraud and securing the Site Order and device data Legitimate interest in protecting our business and customers (Art. 6(1)(f))
Sending you order updates and service emails (order confirmation, shipping notification, returns information) Order data Performance of a contract (Art. 6(1)(b))
Sending you our newsletter and marketing emails Marketing data Your consent (Art. 6(1)(a)), which you can withdraw at any time; for existing customers, legitimate interest in marketing similar products, with the right to object at any time
Measuring how the Site is used and improving it Device and usage data Consent for non-essential cookies (Art. 6(1)(a)); legitimate interest for aggregated statistics
Showing you relevant advertising on other platforms (for example Meta or Google) Device and usage data, hashed email Consent (Art. 6(1)(a))
Establishing, exercising or defending legal claims Any relevant data Legitimate interest (Art. 6(1)(f))

4. Who we share your data with

We share personal data only where necessary, with the following categories of recipients:

  • E-commerce platform: Shopify International Ltd. (Ireland) and Shopify Inc. (Canada), which host the Site and store order and customer data. Shopify's privacy policy is available at www.shopify.com/legal/privacy.
  • Payment providers: Shopify Payments, PayPal and other payment methods offered at checkout, which process your payment and screen for fraud.
  • Carriers and logistics partners: the postal services and couriers that deliver your order, which receive your name, address, phone number and email for delivery and customs purposes.
  • Production partners: the workshops that manufacture custom products receive the personalisation details needed for your order (names, numbers, artwork), but not your contact details unless required for direct shipping.
  • Email and marketing tools: our email service providers (currently the email tools integrated with Shopify), used to send order emails and, with your consent, newsletters.
  • Analytics and advertising services: Google (Google Analytics, Google Ads) and Meta (Facebook and Instagram pixel and ads), used only with your cookie consent.
  • Accounting and professional advisers: our accountants, and where necessary lawyers or auditors, bound by confidentiality.
  • Authorities: tax authorities, customs authorities, courts or law enforcement where we are legally required to disclose data or to protect our rights.

We do not sell your personal data.

5. International transfers

Some of our service providers are located outside the European Economic Area, in particular Shopify (Canada and United States), Google and Meta (United States). Where data is transferred outside the EEA we rely on an adequacy decision of the European Commission (for Canada, and for US companies certified under the EU-US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses, together with additional safeguards where required. You can ask us for more information about these safeguards at hello@gimmelsports.com.

6. How long we keep your data

  • Order, invoice and payment records: 7 years after the end of the financial year in which the order was placed, as required by the Estonian Accounting Act.
  • Guarantee claims and returns: for the duration of the legal guarantee period plus the limitation period for claims, normally 3 years after the claim is closed.
  • Customer account: until you delete your account or after 3 years of inactivity, after which the account is deleted and only the order records described above are kept.
  • Customer support correspondence: 3 years after the last contact.
  • Marketing consent and newsletter data: until you withdraw consent or unsubscribe, and up to 3 years of inactivity.
  • Device and analytics data: according to the cookie lifetimes in section 8, and in aggregated form after that.

When data is no longer needed it is deleted or anonymised.

7. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you and receive a copy.
  • Rectify inaccurate or incomplete data.
  • Erase your data ("right to be forgotten") where there is no legal reason for us to keep it.
  • Restrict processing in certain circumstances.
  • Data portability: receive the data you provided to us in a structured, commonly used, machine-readable format.
  • Object to processing based on legitimate interests, and to direct marketing at any time.
  • Withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal.
  • Not be subject to automated decision-making with legal or similarly significant effects. We do not make such decisions, except for automated fraud screening at checkout carried out by our payment providers, which you can challenge by contacting us.

To exercise any of these rights, email hello@gimmelsports.com. We may ask you to confirm your identity. We will respond within one month, extendable by two further months for complex requests.

You can unsubscribe from marketing emails at any time using the link at the bottom of each email.

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee, info@aki.ee). You may also complain to the data protection authority in your own EU country of residence.

8. Cookies and similar technologies

We use cookies and similar technologies on the Site.

Strictly necessary cookies keep the Site working: your shopping cart, checkout, login, security and cookie preferences. These do not require consent.

Analytics cookies (Google Analytics, Shopify analytics) help us understand how visitors use the Site so that we can improve it. Data is collected in aggregated or pseudonymised form.

Marketing cookies (Meta pixel, Google Ads) let us measure our advertising and show you relevant ads on other platforms.

Analytics and marketing cookies are set only if you accept them in the cookie banner when you first visit the Site. You can change or withdraw your choice at any time via the cookie settings link in the footer of the Site, and you can delete cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the Site from working.

We do not currently respond to browser "Do Not Track" signals, since there is no common standard for them; please use the cookie settings instead.

You can also opt out of interest-based advertising directly with the platforms:

  • Meta: www.facebook.com/settings/?tab=ads
  • Google: www.google.com/settings/ads/anonymous
  • Digital Advertising Alliance opt-out portal: optout.aboutads.info

9. Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections (TLS) across the Site, PCI-DSS compliant payment processing through our payment providers, access controls, and limiting access to personal data to those who need it. No system is completely secure, so if you have reason to believe your interaction with us is no longer secure, please contact us immediately.

10. Links to other websites

The Site may contain links to other websites and social media platforms. We are not responsible for their privacy practices. Please read their privacy policies.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. The current version is always available on the Site, with the date of the last update at the top. Material changes will be announced on the Site or by email where appropriate.

12. Contact

For any questions about this Privacy Policy or your personal data:

Gimmel Studio OÜ
Ahtri 12
15551 Tallinn
Estonia
hello@gimmelsports.com