BATCH 01Reserve your Founder number for €10, refundable and taken off your Lokka System. Reservers get 24 hours early access on Sun 18 Oct.RESERVE
ENDE

Privacy Policy

Last updated: 13 Oct 2026

1. Introduction

Grindest OÜ ("Lokka", "we", "us"), registered in Estonia (registry code 14400401, Sõbra tn 12, 50107 Tartu, Estonia), runs the Lokka shop at lokkasystem.eu. Grindest OÜ is not registered for VAT.

This Privacy Policy explains what personal data we collect when you visit the site, reserve or order a Lokka System, or contact us, how we use it, and what rights you have. You can reach us at support@lokkasystem.eu.

2. Information you give us

  • Orders: your name, email address, shipping address and phone number, collected by Stripe Checkout when you pay, plus what you order and the paint brands and colour choices you enter. The phone number is for the carrier.
  • Reservations: your email address, the €10 payment and the single-use code we send you.
  • Withdrawals and returns: what you enter in the withdrawal form, and photos you send us of a damaged parcel.
  • Support: what you write to us by email and our replies.
  • Waitlist: what you enter in the waitlist form, run by {{WAITLIST_PROVIDER}}.

3. Information collected automatically

  • Analytics data: page views, clicks on the reserve and order buttons, the size you pick, and paid orders and reservations (amount, size, country), via PostHog (see Website analytics and cookies). Never your name or email address.
  • Session recordings, only if you accept them: how you move through the pages (clicks, scrolling, page changes), via PostHog. Anything you type into a form is hidden, and your reservation code is blocked.
  • Device information: browser type, operating system, screen size and IP address.
  • Approximate location: your country, derived from your IP address by our host Vercel to show the right delivery information. We do not store it.
  • Server logs: Vercel records technical data such as IP addresses when you visit the site.

4. Cookies and local storage

  • lokka_consent (localStorage): records your cookie choice so we do not ask again. Strictly necessary. It stays until you change your choice or clear your browsing data.
  • ph_* cookie and ph_* session storage (PostHog): a random identifier that lets us recognise returning visits, and a tab identifier that ends when you close the tab. Not linked to your name or email address. Set only after you accept analytics cookies; the cookie is kept for up to 1 year.
  • lokka_lang cookie: remembers the language you pick with the language switch. Set only when you use the switch, kept for 1 year.

5. How we use your information

  • Take, make and ship your order, and handle your €10 reservation (performance of the contract, Article 6(1)(b) GDPR)
  • Handle withdrawals, returns and guarantee claims, and answer your questions (performance of the contract)
  • Keep accounting records (legal obligation, Article 6(1)(c) GDPR, Estonian Accounting Act)
  • Send waitlist emails, only if you signed up (consent, Article 6(1)(a) GDPR)
  • Understand how the site is used (see Website analytics and cookies for the legal basis)
  • Prevent payment fraud, through Stripe (legitimate interests, Article 6(1)(f) GDPR)

6. Third-party services

We use these services to run the shop. We do not sell your personal data to any of them.

  • Stripe (Stripe Payments Europe): payments and fraud prevention. Your card details go straight to Stripe and never reach us.
  • Vercel: hosting of the site and server logs. Vercel may log your IP address and country for infrastructure purposes.
  • Resend: order emails, such as your reservation code and the acknowledgement of a withdrawal.
  • PostHog (EU cloud): analytics and session recordings. All analytics data stays in the European Union.
  • YouTube (Google): product videos are embedded in privacy-enhanced mode (youtube-nocookie.com) and load only when you press play. YouTube then receives your IP address and device information under its own privacy policy.
  • {{WAITLIST_PROVIDER}}: the waitlist form.
  • {{CARRIER}}: delivery. The carrier receives your name, shipping address and phone number.
  • {{ACCOUNTING_SERVICE}}: bookkeeping.
  • Fonts are hosted on our own site, so your browser makes no requests to font services.

7. Data sharing

We do not sell your personal data. We share it only with the services listed above, for the purposes described, and when the law, a court order or a public authority requires it.

8. Data security

The site runs over HTTPS. Card details go straight to Stripe. Our forms have spam protection, and every price is checked on our server before you pay. No method of sending data over the internet is 100% secure.

9. Data retention

  • Accounting records: 7 years, as the Estonian Accounting Act requires.
  • Other order data and withdrawal records: until the end of the legal guarantee period, 2 years after delivery.
  • Reservation data where no Lokka System is ordered: {{RESERVATION_RETENTION}}. The payment record is kept as an accounting record.
  • Waitlist data: until you unsubscribe or ask us to delete it.
  • Server logs: {{VERCEL_LOG_RETENTION}}.
  • Analytics data and session recordings: {{POSTHOG_RETENTION}}.
  • Your cookie choice (lokka_consent): until you change it or clear your browsing data.

10. Website analytics and cookies

We use PostHog to understand how visitors use the site. PostHog is EU-hosted and all data stays in the European Union.

Consent and cookieless mode: analytics cookies are enabled only after you accept them in our cookie banner. Until then, analytics runs in cookieless mode: nothing is stored on your device, and your visit cannot be recognised on a return visit. PostHog's server combines your IP address and browser details with a value that changes every day into a one-way identifier, so a visit can be counted without recognising you on another day.

What is stored: with your consent, one ph_* cookie with a random identifier, so we can recognise returning visits and keep a recording to one visit. It is not linked to your name or email address.

What we track: page views, clicks on the reserve and order buttons, the size you pick, and paid orders and reservations (amount, size, country). We create no personal profiles.

Session recordings: only after you accept, we record how you use the pages (clicks, scrolling, page changes) to find and fix what gets in the way. Anything you type into a form is hidden in the recording, and your reservation code is blocked. Without your consent no recording is made.

Legal basis: analytics cookies and session recordings are based on your consent (Article 6(1)(a) GDPR), which you can withdraw at any time below. Cookieless usage measurement is based on our legitimate interests (Article 6(1)(f) GDPR): we have assessed that this minimal, pseudonymous measurement is proportionate and does not override your interests or rights. You can object to it by emailing support@lokkasystem.eu. We honor the Global Privacy Control (GPC) browser signal and treat it as a decline.

What does not happen: no data goes to advertising networks, there is no cross-site tracking, and we build no profiles of visitors.

Changing your mind: you can enable or disable analytics cookies at any time with the controls below, also reachable from the Cookie Settings link in the site footer. Disabling removes the ph_* cookie and session storage from your browser.

11. Transfers outside the EEA

Stripe, Vercel and Resend may process data in the United States. Where this applies, the transfers rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses. You can ask us for details at support@lokkasystem.eu.

12. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to or restrict processing of your data
  • Data portability
  • Withdraw consent at any time
  • Complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data protection authority in the EU country where you live

13. Changes to this policy

We may update this Privacy Policy. The date at the top shows when it last changed.

14. Contact

To use your rights or ask about your data, email support@lokkasystem.eu or write to Grindest OÜ, Sõbra tn 12, 50107 Tartu, Estonia. We answer within one month.