Last updated: 22 August 2026
1. Controller and contact details
The controller for customer and online-store data processed through MyRoseDreams is:
XS Design OÜ
Estonian registry code: 11676456
Registered address: Mooni tee 6-31, Viimsi alevik, Viimsi vald, Harju maakond 74001, Estonia
Email: info@myrosedreams.com
Phone: +372 5625 0307
No data protection officer has been appointed. Privacy requests can be sent to the email address above.
2. Data we process
Depending on how you use the website, we process:
- identity and contact data: name, email address and telephone number;
- order and delivery data: products, quantity, order number, billing and delivery address, postal code, city, country, order status, carrier and tracking information;
- payment data: payment status, amount, currency, payment method reference and refund information. Full card details are processed by the payment provider and are not stored by MyRoseDreams;
- account data: login identifier, account settings and order history if you create an account;
- communications: customer-service, withdrawal, complaint and refund correspondence;
- technical and security data: IP address, browser/device information, timestamps, security events and necessary cookie identifiers;
- consent and preference data: cookie choices and, only where separately requested, marketing consent.
Most data comes directly from you. Payment status, fulfilment, shipment and security information may also be received from our payment, printing, delivery and security providers.
3. Why we process data and our legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Creating, confirming and fulfilling an order; payment, printing, delivery, customer service, withdrawal and refund | Identity, contact, order, delivery, payment status and communications | Performance of a contract or steps requested before entering a contract (GDPR Article 6(1)(b)) |
| Accounting, tax records and responding to lawful requests | Order, transaction and required identity data | Legal obligation (Article 6(1)(c)) |
| Protecting the store, preventing abuse and fraud, diagnosing faults and establishing or defending legal claims | Technical, security, order and relevant communication data | Legitimate interests (Article 6(1)(f)): secure and reliable operation and protection of legal rights, balanced against your rights |
| Optional analytics, advertising or marketing communications | Only the data covered by the specific choice | Consent (Article 6(1)(a)), which can be withdrawn at any time |
4. Required checkout information
Email, name, complete delivery address, postal code, city, country and telephone number are required to accept payment, identify the order, print the journal and deliver it through Lulu Direct and the carrier. If required information is not provided, the order cannot be completed or delivered. Optional marketing consent is not required for a purchase.
5. Recipients and service providers
We disclose only the data necessary for the relevant service. Current categories and providers include:
- Zone Media OÜ — website hosting, database and related infrastructure in the EU/EEA;
- WooPayments and Stripe — payment processing, authentication, fraud prevention, refunds and payouts. The payment provider may act as a processor or an independent controller for parts of its regulated service;
- Lulu Press, Inc. / Lulu Direct — printing and fulfilment. Lulu receives the order, recipient name, email, telephone number, delivery address and journal details necessary to produce and ship the order;
- postal and courier providers selected through the fulfilment service — delivery address, recipient contact and tracking information;
- website security, email, backup and support providers used in the WordPress store, including the configured SMTP provider and Wordfence/Defiant security services, to the extent they process logs, security events or communications;
- Automattic/Jetpack, Google and Pinterest services only to the extent a connected feature is enabled and, where required, you have consented through the cookie banner;
- public authorities and professional advisers where disclosure is legally required or necessary to establish or defend legal claims.
WooCommerce core stores order data in the MyRoseDreams WordPress database. It does not by itself mean that every order is separately sent to Automattic; data is sent only through the connected services actually used.
6. International transfers
Website hosting data handled by Zone for this service is kept in the EU/EEA according to Zone’s published data-protection terms. Some payment, fulfilment, security, analytics or marketing providers may process data in the United States or another country outside the EEA.
Where a transfer outside the EEA occurs, it is based on an applicable European Commission adequacy decision, including the EU–US Data Privacy Framework for a certified recipient, or on another safeguard such as the European Commission’s Standard Contractual Clauses. The former EU–US Privacy Shield is not used. Information about the safeguard relevant to your data, or a copy where available, can be requested at info@myrosedreams.com.
7. Retention
- Order, invoice and accounting records: seven years from the end of the relevant financial year where required by Estonian accounting law.
- Customer account profile: until the account is deleted or the service is discontinued; order records that must be retained by law remain restricted for the applicable statutory period.
- Customer-service, withdrawal, refund and complaint correspondence: while the matter is active and generally up to three years after closure, or longer when needed for an unresolved dispute or legal claim.
- Cookie and marketing choices: until consent is withdrawn or the relevant consent record is no longer needed to demonstrate compliance. Cookie-specific periods are listed in the Cookie Policy.
- Security and server logs: for the shortest period reasonably needed to investigate faults, abuse and security events, according to the configured service retention.
- Zone application snapshots used for this site: up to 14 days under the current hosting snapshot rotation.
Data is deleted, anonymised or access-restricted when the applicable period or purpose ends, unless a longer period is required by law or an ongoing claim.
8. Cookies, analytics and marketing
Necessary cookies are used to operate the store, cart, checkout, security and consent settings. Optional analytics, embedded media and advertising technologies are blocked until the relevant consent is given through the Complianz banner. You can change or withdraw optional cookie consent at any time through the website’s cookie settings. See the Cookie Policy for the current cookie and provider list.
Marketing email, if offered, uses a separate voluntary choice and includes an unsubscribe method. Refusing or withdrawing marketing consent does not affect an order.
9. Your rights
Subject to the conditions in the GDPR, you may request access to your data, correction, erasure, restriction, data portability, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting earlier lawful processing.
Send a request to info@myrosedreams.com. We may ask for proportionate information to verify identity. We normally respond within one month.
10. Automated decisions and profiling
MyRoseDreams does not make decisions producing legal or similarly significant effects solely by automated means. Payment and security providers may automatically assess transactions for fraud or security purposes under their own notices and safeguards.
11. Complaints
Please contact us first so we can address the concern. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): aki.ee, email info@aki.ee, or to the supervisory authority in your EU/EEA country of residence.
12. Changes
We update this notice when the store’s data flows or legal requirements change. The current version and date are published on this page. Material changes will be highlighted where appropriate.
Version: 22 August 2026.