Privacy policy
Last updated: 17 August 2026
This Privacy Policy explains how Bricks24 collects, uses, stores and otherwise processes personal information when you visit our online store, place an order, communicate with us or otherwise use our services.
The Bricks24 online store is operated by:
Constant Invest OÜ
Registry code: 17364114
Address: Uuspere tee 8/3-10, 76916 Tiskre küla, Harku vald, Harju maakond, Estonia
Email: info@bricks24.eu
Phone: +372 5917 7750
For the purposes of applicable data protection law, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Constant Invest OÜ is the data controller in relation to personal information processed in connection with the Bricks24 online store, unless otherwise stated.
Bricks24 is powered by Shopify, which provides the technical e-commerce platform used to operate the store.
1. PERSONAL INFORMATION WE PROCESS
Depending on how you interact with Bricks24, we may process the following categories of personal information.
Contact and identification information
This may include:
- your first and last name;
- billing address;
- delivery address;
- email address; and
- telephone number.
Order and transaction information
This may include:
- products ordered or purchased;
- order number;
- order date;
- purchase price;
- delivery method and delivery information;
- returns, refunds or cancellations;
- payment method;
- payment status;
- transaction references; and
- information necessary to process or verify a payment.
Bricks24 does not receive or store your online banking credentials or complete payment card details when these are processed directly by a bank, Maksekeskus AS or another payment service provider.
Account information
If customer accounts are available and you choose to create one, we may process information connected with your account, such as your contact information, account preferences, order history and account credentials.
Passwords and similar authentication information are processed through the technical systems used to provide the account functionality and are not intended to be accessible to Bricks24 in plain-text form.
Communications
If you contact us, we may process the information contained in your correspondence, including customer service requests, complaints, return requests and other communications.
Device and website usage information
When you use our website, certain technical information may be collected automatically, including:
- IP address;
- browser and device information;
- operating system;
- website interaction information;
- pages viewed;
- approximate location derived from technical information;
- cookie and similar technology identifiers; and
- information concerning how and when the website is used.
The information actually collected depends on the technologies, cookies and services enabled on the Bricks24 website and on your privacy and cookie choices.
2. HOW WE COLLECT PERSONAL INFORMATION
We may collect personal information:
- directly from you when you place an order, create an account, contact us, request a return or otherwise provide information to us;
- automatically when you access or use the Bricks24 website;
- from Shopify, which provides the technical platform for our online store;
- from Maksekeskus AS and other payment providers in connection with payment processing and payment confirmation;
- from delivery and courier service providers in connection with fulfilment and delivery;
- from service providers acting on our behalf; and
- where necessary and lawful, from other third parties involved in providing our services.
3. PURPOSES AND LEGAL BASES FOR PROCESSING
We process personal information only where we have a lawful basis for doing so.
Performance of a contract
We process personal information where necessary to enter into or perform a sales contract with you.
This includes processing necessary to:
- receive and process your order;
- process and confirm payment;
- fulfil and deliver your order;
- communicate with you about your order;
- process returns, refunds and cancellations;
- handle warranty or conformity issues; and
- provide customer service connected with your purchase.
Compliance with legal obligations
We may process and retain personal information where necessary to comply with legal obligations applicable to Constant Invest OÜ.
This includes, in particular:
- accounting and taxation obligations;
- consumer protection requirements;
- responding to legally valid requests from public authorities; and
- complying with other obligations imposed by applicable Estonian or European Union law.
Legitimate interests
Where permitted by law, we may process personal information where this is necessary for our legitimate interests or those of a third party and those interests are not overridden by your rights and freedoms.
These legitimate interests may include:
- operating and protecting the Bricks24 website;
- preventing fraud, abuse and security incidents;
- maintaining records necessary to establish, exercise or defend legal claims;
- improving our customer service and business operations;
- troubleshooting technical problems; and
- protecting the property, rights and security of Bricks24 and our customers.
Consent
Where processing requires your consent, we process your personal information on the basis of that consent.
This may apply, for example, to certain:
- marketing communications;
- advertising technologies;
- analytics technologies; and
- non-essential cookies.
Where processing is based on consent, you may withdraw your consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
4. PAYMENT PROCESSING AND MAKSEKESKUS AS
Payments made through Bricks24 may be mediated by Maksekeskus AS.
Payment takes place in a secure payment environment outside the Bricks24 online store, including, depending on the payment method selected, in the secure environment of the relevant bank or payment service provider.
Constant Invest OÜ is the data controller for personal information processed in connection with the Bricks24 online store.
Personal information necessary to execute, administer, confirm or reconcile payments is transmitted to Maksekeskus AS.
To the extent that Maksekeskus AS processes personal information on behalf of Constant Invest OÜ for the purpose of providing payment processing services to Bricks24, Maksekeskus AS acts as a data processor.
Maksekeskus AS may also process certain personal information as an independent data controller where this is necessary for Maksekeskus AS to comply with its own legal or regulatory obligations or otherwise where it independently determines the purposes and means of processing in accordance with applicable law.
Information transmitted in connection with a payment may include, depending on the payment method:
- customer identification and contact information necessary for the transaction;
- order amount;
- transaction reference;
- payment method;
- payment status;
- bank or payment account information processed by the payment provider; and
- other information necessary for completing or administering the transaction.
Bricks24 does not have access to the customer's online banking credentials or complete payment card details processed in the secure environment of the bank or payment service provider.
5. SHOPIFY
The Bricks24 online store is powered by Shopify.
Shopify provides the infrastructure and technical services that enable us to operate the online store and may process personal information concerning your access to and use of the store.
When Shopify processes customer personal information on behalf of Constant Invest OÜ in order to provide its e-commerce services, Constant Invest OÜ acts as the controller and Shopify acts as a processor.
Information submitted through the Bricks24 online store may therefore be transmitted to and processed by Shopify and its authorised subprocessors where necessary to provide the Shopify platform and related services.
Certain optional or enhanced Shopify services may involve Shopify processing personal information for purposes for which Shopify acts as a separate controller. Where such services are enabled, the applicable Shopify privacy information and privacy controls may also apply.
6. DELIVERY AND OTHER SERVICE PROVIDERS
We disclose personal information only where reasonably necessary for the purposes described in this Privacy Policy or where otherwise required or permitted by law.
Recipients may include:
- Maksekeskus AS and other payment service providers, for payment processing;
- parcel delivery, postal and courier companies, for delivery of orders;
- Shopify and its authorised subprocessors, for operation of the online store;
- IT, hosting, security and technical service providers, where necessary to operate and protect our systems;
- accounting and professional advisers, where necessary for accounting, legal or regulatory purposes; and
- public authorities or courts, where disclosure is required by applicable law or a legally valid request.
Delivery providers receive only the information reasonably necessary to deliver the order, such as the recipient's name, delivery address or parcel-machine information, telephone number, email address and shipment information.
We do not disclose personal information to third parties merely for purposes unrelated to operating Bricks24 unless we have an appropriate legal basis to do so.
7. MARKETING COMMUNICATIONS
Bricks24 may send marketing emails, newsletters or promotional communications where permitted by applicable law.
Where prior consent is required, marketing communications will be sent only after you have provided that consent.
Where permitted by law, we may also use contact details obtained in connection with a previous purchase to market our own similar products, provided that you were given a clear opportunity to refuse such use when the contact information was collected and are given a simple and free opportunity to opt out in every marketing communication.
You may opt out of marketing communications at any time by:
- using the unsubscribe mechanism included in the marketing email; or
- contacting info@bricks24.eu.
Opting out of marketing communications does not prevent Bricks24 from sending non-marketing communications necessary in connection with an order, payment, return, delivery, account or customer service request.
8. COOKIES AND SIMILAR TECHNOLOGIES
Bricks24 and the service providers used to operate the store may use cookies and similar technologies.
These technologies may be used for purposes including:
- enabling essential website functionality;
- remembering preferences;
- maintaining shopping cart and checkout functionality;
- security and fraud prevention;
- understanding website performance and usage;
- analytics; and
- advertising or marketing, where enabled.
Cookies that are strictly necessary for the functioning of the website may be used without consent where permitted by law.
Where consent is legally required for analytics, advertising or other non-essential technologies, such technologies will be used according to the choices made through the applicable cookie or privacy controls.
You can manage applicable cookie preferences through the privacy or cookie controls provided on the Bricks24 website and, where applicable, through your browser settings.
9. DATA RETENTION
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, or for as long as required by law.
Different categories of personal information may therefore have different retention periods.
Accounting and transaction records
Personal information contained in accounting records, invoices and other documents that must be retained under Estonian accounting law is generally retained for seven years from the end of the financial year in which the relevant transaction was recorded, unless a longer retention period is required by law.
Orders and contractual records
Order and contractual information may be retained for as long as necessary to perform the contract and thereafter for the period necessary to establish, exercise or defend legal claims.
Where the same information also forms part of accounting documentation, it may be retained for the longer legally required accounting period.
Customer service, complaints and disputes
Customer service correspondence, complaints and information concerning disputes may be retained for as long as necessary to resolve the matter and, where appropriate, thereafter for the period necessary to establish, exercise or defend legal claims.
Customer accounts
If customer accounts are available, information associated with an account may be retained while the account remains active and thereafter only for as long as necessary for legal, contractual, security or record-keeping purposes.
Deletion of an account does not require Bricks24 to delete information that we are legally required or otherwise lawfully entitled to retain.
Marketing information
Information used for consent-based direct marketing is retained until:
- you withdraw your consent;
- you unsubscribe;
- the relevant marketing purpose ends; or
- continued processing is otherwise no longer lawful.
Where necessary, we may retain a limited suppression record documenting that you have opted out so that we can respect your preference in the future.
Security and fraud-prevention information
Information required for website security, fraud prevention or investigation of incidents is retained only for as long as reasonably necessary for those purposes, unless a longer period is required for a legal claim or legal obligation.
When personal information is no longer required, it will be deleted, anonymised or otherwise handled in accordance with applicable law.
10. INTERNATIONAL TRANSFERS
Some service providers used by Bricks24, including providers involved in operating the Shopify platform, may process personal information in countries outside Estonia or the European Economic Area.
Where personal information is transferred outside the European Economic Area to a country that has not been recognised as providing an adequate level of protection, the transfer must be protected by an appropriate transfer mechanism recognised under applicable data protection law, such as approved contractual safeguards, unless another lawful basis for the transfer applies.
Shopify and its service providers may process personal information internationally in connection with operating the Shopify platform.
11. SECURITY
We use appropriate technical and organisational measures intended to protect personal information against:
- unauthorised or unlawful access;
- disclosure;
- alteration;
- loss;
- destruction; and
- other unlawful processing.
We also require service providers processing personal information on our behalf to protect that information in accordance with applicable data protection requirements and relevant contractual obligations.
No method of electronic transmission or storage can be guaranteed to be completely secure. You should therefore avoid sending particularly sensitive or confidential information through unsecured communication channels unless necessary.
12. YOUR DATA PROTECTION RIGHTS
Subject to the conditions and limitations provided by applicable law, you may have the right to:
- request confirmation as to whether we process your personal information;
- access personal information we hold about you;
- request correction of inaccurate or incomplete personal information;
- request deletion of your personal information;
- request restriction of processing;
- object to processing based on legitimate interests;
- object at any time to processing for direct marketing purposes;
- receive certain personal information in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller;
- withdraw consent at any time where processing is based on consent; and
- lodge a complaint with a competent data protection supervisory authority.
The right to deletion is not absolute. For example, we may retain information where processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.
Similarly, other rights may be subject to limitations provided by applicable law.
To exercise your rights, contact:
We may need to request information reasonably necessary to verify your identity before acting on a request.
We will respond within the timeframe required by applicable data protection law.
13. COMPLAINTS
If you have questions or concerns about how Bricks24 processes your personal information, please contact us first at:
You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
If you reside in another EEA country, you may also have the right to lodge a complaint with the competent data protection supervisory authority in your country of residence, place of work or the place where the alleged infringement occurred.
14. CHILDREN'S PERSONAL INFORMATION
The Bricks24 online store is intended for persons who have the legal capacity required to make purchases or who use the store with the involvement or permission of a parent or legal guardian where required by law.
We do not intentionally request personal information from children where such processing is not necessary or lawful.
If you are a parent or legal guardian and believe that a child has provided personal information to Bricks24 inappropriately, please contact info@bricks24.eu.
15. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes to:
- our services;
- payment or delivery providers;
- technology used by the Bricks24 store;
- our data-processing practices; or
- applicable legal or regulatory requirements.
The current version will be published on the Bricks24 website and the “Last updated” date will be changed accordingly.
Where required by law, we will provide additional notice of material changes.
16. CONTACT INFORMATION
For questions about this Privacy Policy, the processing of personal information or the exercise of your data protection rights, contact:
Bricks24 / Constant Invest OÜ
Registry code: 17364114
Uuspere tee 8/3-10
76916 Tiskre küla
Harku vald, Harju maakond
Estonia
Email: info@bricks24.eu
Phone: +372 5917 7750
For the purposes of applicable data protection law, Constant Invest OÜ is the controller of personal information processed in connection with the Bricks24 online store, except where another party acts as an independent controller for its own processing activities.