Privacy Policy of the Põhjala Order Portal

Version 2026-10-16

1. Controller

Põhjala Brewing AS, registry code 12208941, Peetri tn 5, 10415 Tallinn, Estonia(“Põhjala”, “we”) is the controller of the personal data described here. Contact for all privacy questions and requests: order@pohjalabeer.com.

2. Whose data

People who use the order portal (the “Portal”) on behalf of our business customers, and contact persons of those customers.

3. What data we process

• Account data: name, work email, company name, country, password (stored only as a salted scrypt hash), account status and the company in our records your account is linked to.
• Security data: whether two-factor login is on, the authenticator key (stored encrypted), recovery codes (stored only as hashes).
• Activity data: logins and failed logins, the IP address they came from, when the stock list was opened, orders sent, changes to your account, and when you accepted these terms.
• Order data: the products, quantities, references and notes in orders you send, and the orders, quotations and invoices of your company in our ERP system.
• Email: the service emails we send you (confirmations, password resets, order copies, security notices).

4. Why we process it and on what legal basis

• To provide your account and the Portal and to handle your company’s orders - performance of the contract with your company and our legitimate interest in serving our business customers (GDPR Art. 6(1)(b) and (f)).
• To keep the Portal secure, prevent misuse and protect our confidential business information, including detecting automated or excessive access - our legitimate interest (Art. 6(1)(f)).
• To keep business and accounting records - our legal obligations (Art. 6(1)(c)).

We do not use Portal data for advertising, we do not sell it, and we make no automated decisions with legal effects about you.

5. Cookies and similar technologies

The Portal uses only what it needs to work: a session cookie that keeps you logged in (and protects forms), a load-balancing cookie set by our hosting provider, and your browser’s local storage to keep an unfinished order on your own device. We use no analytics, tracking or advertising cookies, so we do not ask for cookie consent.

6. Who else processes the data

Põhjala staff who handle sales and customer accounts, and these service providers acting on our instructions:

The data is stored in the European Union. Where a provider may access it from outside the European Economic Area, the transfer is protected by the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. We may also disclose data where the law requires it.

7. How long we keep it

• Account and security data: until the account is deleted (you can do it yourself in Settings, or ask us). We may delete accounts that have not been used for three years.
• IP addresses and email addresses in the activity log: 12 months, then removed automatically.
• Orders and other business records: as long as accounting law requires - in Estonia seven years from the end of the financial year - also after an account is deleted. They are your company’s records; your name is removed from the Portal’s copy when you delete your account.

8. Your rights

You have the right to access your data and receive it in a portable format, to have it corrected or erased, to restrict or object to its processing, and to withdraw any consent. In Settings you can download your data and delete your account yourself; for anything else write to order@pohjalabeer.com. You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the data protection authority of your own country.

9. Security

All traffic is encrypted (HTTPS). Passwords are hashed, two-factor login is available, access is limited to staff who need it, and we log and rate-limit access to the Portal.

10. Changes

We may update this policy. The version in force is always on this page; for material changes we ask users to confirm at their next login.