Personal data

Personal data processing

Last updated: 10.08.2026

This page explains in more detail how Morra collects, uses, shares and retains personal data when you use morra.cc, create a Morra account, place an order, contact us or sign up to receive news from Morra.

It applies to the Morra webshop and related online customer services.

1. Who is responsible for your personal data?

The controller responsible for your personal data is:

Disaintekstiil OÜ
Registry code: 12565822
Riia 138c
50411 Tartu
Estonia

Morra is a brand operated by Disaintekstiil OÜ.

For questions about personal data or to exercise your privacy rights, contact us at hello@morra.cc.

2. What personal data do we process?

The information we process depends on how you interact with Morra.

Contact and identification information

This may include your:

• name;
• email address;
• telephone number;
• billing address;
• delivery address or selected parcel locker/pick-up point.

Order and transaction information

This may include:

• products ordered;
• order number and date;
• prices, discounts and order value;
• selected payment method and payment status;
• delivery method and delivery status;
• returns, exchanges and refunds;
• related transaction and accounting information.

Morra does not receive or store your full payment card details.

Morra account information

If you create a Morra account, we may process:

• your name and contact information;
• account login information;
• saved addresses and preferences;
• your order history;
• other information associated with your account.

Customer service information

When you contact us, we process the information necessary to respond to you. This can include your contact details, order information and the content of our correspondence.

Newsletter and marketing information

If you sign up for Morra news, we currently collect your email address and information about your subscription, consent and unsubscribe status.

Website and technical information

When you use morra.cc, we may process technical information such as:

• IP address;
• device and browser information;
• website activity and interactions;
• cookie and similar online identifiers;
• information about how you arrived at and use our website.

Where required, analytics and advertising information is processed only after you have given your consent.

3. Where do we get personal data from?

Most personal data comes directly from you, for example when you:

• place an order;
• create or update a Morra account;
• contact us;
• make a return or request a refund;
• sign up for Morra news;
• choose your cookie preferences.

We may also receive information from service providers involved in your transaction. For example, we may receive payment confirmation from our payment provider or delivery and tracking information from a delivery partner.

With your consent, information may also be collected automatically through analytics, advertising technologies and similar tools used on morra.cc.

4. Why do we process personal data?

We only process personal data where we have an appropriate legal basis. The main legal bases relevant to Morra are performance of a contract, compliance with a legal obligation, our legitimate interests and your consent. These correspond to the legal bases set out in GDPR Article 6.

Purpose	Personal data used	Legal basis	Retention
Processing and managing your order	Contact, billing, delivery, order and transaction information	Performance of a contract	Order records are generally retained for 7 years from the end of the relevant financial year
Processing payments	Order, payment method, transaction and payment-status information	Performance of a contract and legal obligation	Relevant transaction records are generally retained for 7 years from the end of the relevant financial year
Delivering your order	Name, email, telephone number, delivery address or pick-up location and order information	Performance of a contract	Necessary delivery data is processed for the delivery; relevant order records are retained as described above
Returns, exchanges and refunds	Contact, order, return, refund and payment information	Performance of a contract and legal obligation	Generally retained with the relevant order record
Creating and maintaining a Morra account	Name, email, account information, saved details and order history	Performance of a contract	Until the account is deleted or no longer required; order and accounting records may need to be retained separately
Customer support and handling claims	Contact details, order information and correspondence	Performance of a contract or legitimate interest	Normally up to 3 years after the matter is resolved, or longer where necessary for an ongoing claim or legal obligation
Accounting and statutory reporting	Order, transaction, invoice and payment information	Legal obligation	7 years from the end of the relevant financial year
Newsletter and email marketing	Email address and subscription/consent information	Consent	Until consent is withdrawn or you unsubscribe; necessary opt-out records may be retained afterwards
Website analytics	Online identifiers, device information and website usage	Consent	According to the relevant analytics and cookie settings described in our Cookie policy
Advertising and campaign measurement	Online identifiers and website/conversion activity	Consent	According to the relevant advertising and cookie settings described in our Cookie policy
Website security and prevention of misuse	IP address, technical logs and security information	Legitimate interest	For as long as reasonably necessary for security, troubleshooting and prevention of misuse
Establishing, exercising or defending legal claims	Relevant order, customer service, transaction and other information	Legitimate interest	For as long as necessary in relation to the relevant claim or applicable limitation period

Estonian accounting legislation requires accounting source documents and certain related business records to be retained for seven years from the end of the relevant financial year. The general limitation period for contractual claims under Estonian law is three years, which is why we use three years as the normal retention period for resolved customer-service matters where no longer period applies.

5. Our legitimate interests

Where we rely on legitimate interest, our interests may include:

• operating and protecting our webshop and information systems;
• preventing misuse, fraud and security incidents;
• responding to general enquiries and providing customer support;
• resolving complaints and disputes;
• establishing, exercising and defending our legal rights.

Before relying on legitimate interest, we consider whether our interest is necessary and whether your interests, rights or freedoms override it.

6. Payments

Payments on morra.cc are processed through Montonio and the relevant payment service providers.

Depending on the option you choose, payment methods may include:

• bank payments;
• payment cards;
• Apple Pay;
• Google Pay;
• N26;
• Revolut;
• Wise;
• MobilePay.

We provide the information necessary to initiate and identify your payment. In return, we receive information necessary to confirm and manage the transaction, such as payment status and transaction information.

Morra does not receive or store your full payment card details. Card details and other payment credentials are processed by the relevant payment service providers.

Those providers may also process personal data under their own privacy terms where they act independently in providing their services.

7. Delivery

To deliver your order, we provide the necessary personal data to the delivery provider selected for your order.

Depending on the destination and delivery method, this may include:

• Omniva;
• DPD;
• DHL.

The information normally shared includes your name, telephone number, email address, delivery address or selected collection point and information necessary to identify and deliver the parcel.

Delivery providers may also provide Morra with shipment, tracking and delivery-status information.

8. Newsletter and direct marketing

If you choose to receive Morra news, we process your email address for sending newsletters, product news and marketing communication.

Signing up is voluntary.

You can withdraw your consent at any time by using the unsubscribe link included in our marketing emails. After you unsubscribe, we will no longer use your email address to send you that marketing.

We may retain limited information about your unsubscribe request where necessary to ensure that your preference continues to be respected and to demonstrate compliance.

Withdrawing consent does not affect processing that took place before the consent was withdrawn.

Our newsletter service provider may process the information on our behalf. The specific provider may change and will be reflected in our current service-provider and privacy information where appropriate.

9. Analytics, advertising and cookies

Morra uses cookies and similar technologies to operate the website and, with your consent, understand website usage and measure our advertising.

Our planned analytics and advertising tools include:

• Google Analytics 4;
• Google Tag Manager;
• Google Ads;
• Meta Pixel;
• Microsoft Clarity.

Google Tag Manager is used to manage website tags and integrations. Analytics and advertising technologies that require consent are not intended to be activated until the relevant consent has been given.

You can accept, reject or change your choices through Morra’s cookie settings.

Our separate Cookie policy provides more detailed information about the individual technologies, providers, purposes and retention periods used on morra.cc.

10. Who may receive your personal data?

We only disclose personal data where it is necessary for a defined purpose.

Recipients may include:

• payment providers, banks, card payment providers and digital wallet providers;
• delivery and logistics partners;
• webshop, hosting, IT and technical service providers;
• business software and system-integration providers;
• accounting and financial service providers;
• newsletter and email service providers;
• analytics and advertising service providers;
• professional advisers such as legal advisers where necessary;
• public authorities or other parties where disclosure is required by law.

Where service providers process personal data on our behalf, we require them to process the information in accordance with applicable data-protection requirements.

With your consent, providers such as Google, Meta and Microsoft may receive online identifiers and information about your interactions with morra.cc for analytics, advertising or campaign measurement purposes.

11. Transfers outside the European Economic Area

Some of the technology and service providers used by Morra may process personal data outside the European Economic Area (EEA) or make it accessible from other countries.

Where personal data is transferred outside the EEA, the transfer must comply with GDPR requirements for international transfers. Depending on the recipient and destination, safeguards may include:

• an adequacy decision adopted by the European Commission;
• European Commission-approved Standard Contractual Clauses;
• another lawful transfer mechanism permitted by the GDPR.

13. How long do we keep personal data?

We do not use one retention period for all personal data.

The retention period depends on:

• why the information was collected;
• whether it remains necessary to provide a service;
• legal retention requirements;
• applicable limitation periods;
• whether the information is required for an ongoing dispute or legal claim.

In particular, order and accounting records required to document Morra transactions are retained for seven years from the end of the financial year in which the relevant transaction was recorded. This reflects the retention period established by the Estonian Accounting Act.

If you delete your Morra account, information needed purely for maintaining the account can be deleted. However, deletion of the account does not automatically mean that order, transaction or other information that we are legally required or otherwise entitled to retain can also be deleted.

13. Automated decision-making

Morra does not make decisions about customers based solely on automated processing where those decisions produce legal effects or similarly significantly affect the customer.

We may use automated systems to support ordinary webshop functions, such as processing orders, payments, delivery information, analytics or marketing, but these do not constitute solely automated decision-making of the kind described above.

14. Your rights

Depending on the circumstances and the legal basis for processing, you may have the right to:

• access your personal data and receive information about how it is processed;
• correct inaccurate or incomplete information;
• request deletion of personal data where there is no longer a legal basis for keeping it;
• request restriction of processing in certain circumstances;
• object to processing based on legitimate interests;
• receive certain personal data in a portable format where the processing is automated and based on consent or a contract;
• withdraw your consent at any time where processing is based on consent.

These rights are established in GDPR Articles 15–21 and are subject to the conditions and exceptions contained in the GDPR. For example, the right to deletion does not require us to delete information that we must retain to comply with a legal obligation or that is necessary for legal claims.

To exercise any of these rights, contact hello@morra.cc.

We may ask for additional information where reasonably necessary to verify your identity before providing or changing personal data.

15. Deleting your Morra account

You can ask us to delete your Morra account by contacting hello@morra.cc.

When an account is deleted, we will remove or anonymise account information that we no longer need to retain.

Certain information connected with previous orders may remain in our systems where it must be retained for accounting, legal or claims-related purposes.

16. Protecting your personal data

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.

Access to personal data is limited according to business need, and our service providers are expected to apply appropriate safeguards to the information they process.

No online system can guarantee absolute security, but we regularly review the systems and services used to operate Morra and take reasonable measures to protect the information entrusted to us.

17. Questions, requests and complaints

For questions about this page, the processing of your personal data or your privacy rights, contact:

Morra
Disaintekstiil OÜ
Registry code: 12565822
Riia 138c
50411 Tartu
Estonia
hello@morra.cc

If you believe that your personal data has been processed unlawfully, you also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or, where applicable, another competent supervisory authority.

18. Changes to this information

We may update this information when our services, systems, service providers or legal requirements change.

The current version will always be available on morra.cc. The date at the top of this page shows when it was last updated.