Privacy Policy
Last updated: 14 October 2026
1. Who we are
ToteBagsPrint websites and services are operated by:
Dispak OÜ
Registry code: 10266012
VAT number: EE100327010
Registered address: Puuvilla tn 19, 10314 Tallinn, Estonia
Contact address: Pilvetee 6, 12618 Tallinn, Estonia
Represented by: Andres Männisalu (Management Board)
Dispak OÜ is the data controller responsible for the processing of personal data described in this Privacy Policy.
This Privacy Policy applies to ToteBagsPrint websites, country-specific domains and services operated by Dispak OÜ in Europe.
Privacy enquiries:
2. Information we collect
Depending on how you interact with us, we may collect information including:
- your name
- company name
- email address
- telephone number
- billing information
- delivery information
- country
- quotation request details
- product requirements
- order information
- transaction information
- artwork
- logos
- design files
- photographs
- documents and other files supplied by you
- communication history
- technical information such as IP address, browser information, device information and cookie identifiers where applicable
We collect only information that is reasonably necessary for the purposes described in this Privacy Policy.
3. Information received from business customers or resellers
In some cases, we may receive personal data about individuals, such as a named delivery contact, from our business customers or resellers rather than directly from that individual.
We process this information only where necessary to fulfil the relevant request or order and for the purposes described in this Privacy Policy.
4. Why we process personal data
We may process personal data in order to:
- respond to enquiries and quotation requests
- prepare quotations
- prepare artwork proofs
- communicate with prospective and existing customers
- process orders
- manufacture products
- deliver products
- manage payments
- issue invoices
- maintain accounting records
- provide customer service
- handle complaints and claims
- prevent misuse and fraud
- protect our legal rights
- comply with legal obligations
- maintain website security
- improve our services
- measure website usage where the required consent has been provided
- compile aggregated website statistics from web server logs, without cookies
- conduct marketing activities where permitted by law
5. Legal bases for processing
We process personal data using the appropriate legal basis depending on the purpose.
Pre-contractual measures
When you request a quotation, product information, proof or other action before placing an order.
Performance of a contract
When processing is necessary to manufacture, supply, deliver, invoice or otherwise fulfil an order.
Legal obligation
When information must be processed or retained to comply with accounting, taxation or other legal requirements.
Legitimate interests
Where processing is reasonably necessary for business operations, customer service, security, fraud prevention, business record keeping or the establishment, exercise or defence of legal claims, provided that our interests do not override your rights and freedoms.
Consent
Where applicable law requires consent, including certain analytics, advertising or marketing technologies.
Consent may be withdrawn at any time.
6. Quotation requests
When you submit a quotation request or contact us regarding a potential order, we use the information supplied by you to:
- understand your requirements
- prepare a quotation
- prepare artwork or proofs where relevant
- answer your questions
- communicate with you regarding the potential order
Processing necessary to respond to a quotation request or take steps towards a possible contract does not normally require separate marketing consent.
Providing certain information, such as your contact details and quotation requirements, is necessary for us to respond to your enquiry, prepare a quotation, or process an order. If this information is not provided, we may be unable to assist with your request.
7. Artwork and customer files
You may provide us with:
- logos
- trademarks
- artwork
- photographs
- designs
- text
- fonts
- other files or materials
These materials remain the property of their respective rights holders.
We use customer materials only to the extent reasonably necessary to:
- prepare quotations
- prepare artwork or proofs
- manufacture requested products
- deliver orders
- provide related customer service
By supplying materials to us, you confirm that you own the relevant rights or have obtained the necessary permission to use and reproduce them for the requested purpose.
We may refuse to process material that we reasonably believe is unlawful or clearly infringes third-party rights.
We will not use customer artwork, logos or completed products for advertising, portfolio or case-study purposes unless we have obtained appropriate permission from the customer.
8. How long we keep personal data
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and to comply with applicable legal requirements.
Quotation requests that do not result in an order, together with related artwork and files, may generally be retained for up to 18 months after the last substantive communication.
After that point, they are subject to deletion or review unless there is a continuing business or legal reason to retain them.
Artwork and design files connected with completed orders may be retained for longer where reasonably necessary to support repeat orders, customer service, warranty matters or the establishment, exercise or defence of legal claims.
Order-related records may be retained for longer where necessary for:
- accounting
- taxation
- contractual obligations
- warranty matters
- dispute resolution
- legal claims
- other legal obligations
Accounting and related business documents are retained for the period required under applicable law.
When information is no longer required, it will be deleted, anonymised or securely disposed of where reasonably practicable.
Web server logs containing IP addresses are deleted after 30 days. The aggregated statistics derived from them do not contain IP addresses.
9. Who we may share personal data with
Where necessary to provide our services, we may share relevant information with:
- printing and manufacturing partners
- delivery companies
- logistics providers
- hosting providers
- IT providers
- email providers
- communication service providers
- payment providers
- accounting providers
- analytics providers
- advertising providers where applicable and permitted
- professional advisers
- public authorities where required by law
We aim to disclose only the information reasonably necessary for the relevant purpose.
Where service providers process personal data on our behalf, appropriate contractual and data protection requirements are used where required.
10. Production partners and delivery companies
ToteBagsPrint works with third-party production and logistics partners.
Information may be provided to these partners where necessary to manufacture or deliver an order.
For example, this may include:
- company name
- contact name
- delivery address
- telephone number
- order information
- product specifications
- artwork
Only information reasonably necessary for production or delivery should be provided.
11. International data transfers
Some service providers may process information outside the European Economic Area.
Where personal data is transferred outside the EEA and the destination does not benefit from an applicable European Commission adequacy decision, appropriate safeguards are used where required by applicable law.
Such safeguards may include European Commission Standard Contractual Clauses or another legally recognised transfer mechanism.
12. Cookies and similar technologies
Our websites may use cookies and similar technologies.
Strictly necessary technologies may be used where required for website functionality, security or a service explicitly requested by the visitor.
Non-essential technologies, including certain analytics or marketing technologies, are activated only in accordance with applicable consent requirements.
More information is available in our Cookie Policy.
You can manage your preferences through Cookie Settings.
13. Analytics
Where enabled and where the required consent has been obtained, we may use analytics services to understand:
- how visitors use our website
- which pages are visited
- website performance
- technical errors
- general website usage patterns
Analytics technologies requiring consent will not be intentionally activated before the relevant consent has been provided.
Without cookies or tracking scripts, we also compile aggregated statistics from our web server logs, based on our legitimate interest in operating and improving the website. They show the pages visited, the country and city estimated from the IP address, the referring website, search engine or AI assistant (for example ChatGPT), the device type, and visits by search engine and AI crawlers. The statistics do not contain IP addresses, and nothing is stored on your device for this purpose.
With your Analytics consent, we remember in your browser tab which website, search engine or AI assistant brought you to our website and send this with your quotation request, so that we know which channels bring enquiries. You can withdraw consent at any time in Cookie Settings.
14. Marketing
We may contact existing or prospective business customers regarding our products or services where permitted by applicable law.
Where consent is legally required, we will obtain the required consent before sending the relevant marketing communication.
You may object to direct marketing at any time.
Marketing emails should include an appropriate method for opting out where required.
15. Your data protection rights
Depending on the circumstances and applicable law, you may have the right to:
- request information about how your personal data is processed
- request access to your personal data
- request correction of inaccurate data
- request deletion of personal data
- request restriction of processing
- object to certain processing
- request portability of certain personal data
- withdraw consent where processing is based on consent
Withdrawal of consent does not affect processing carried out lawfully before withdrawal.
Some rights are subject to legal conditions and exceptions.
To exercise your rights, contact:
We may request reasonable information to verify your identity before fulfilling a request.
16. Complaints
You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that your personal data has been processed in breach of applicable data protection law.
As Dispak OÜ is established in Estonia, the relevant Estonian supervisory authority is the Estonian Data Protection Inspectorate.
Depending on the circumstances, you may also have the right to contact another competent supervisory authority in the European Union or European Economic Area.
17. Security
We use appropriate technical and organisational measures designed to protect personal data from:
- unauthorised access
- unauthorised disclosure
- accidental loss
- alteration
- destruction
- other unlawful processing
No internet transmission or electronic storage system can be guaranteed to be completely secure.
18. Changes to this Privacy Policy
We may update this Privacy Policy if:
- our services change
- our suppliers or technology change
- our data processing activities change
- legal requirements change
The current version and its update date will be published on this page.
19. Contact
Dispak OÜ
Registry code: 10266012
Registered address: Puuvilla tn 19, 10314 Tallinn, Estonia
Contact address: Pilvetee 6, 12618 Tallinn, Estonia
Represented by: Andres Männisalu (Management Board)
Privacy enquiries: