Privacy policy
PRIVACY POLICY FOR THE CUSTOMER REGISTER OF JUHLABOKSI A&A OY
1. Data Controller
Juhlaboksi A&A Oy
Business ID: 3430103-9
Oulu, Finland
2. Contact Person for Data Protection Matters
Managing Director
Ann-Helen Piri
Oulu, Finland
Phone: +358 50 3823102
Email: info@juhlaboksi.fi
3. Name of the Register
Juhlaboksi A&A Oy Customer Register
4. Legal Basis and Purpose of Processing Personal Data
The primary legal basis for processing personal data in the customer register is the customer relationship between Juhlaboksi A&A Oy and its customers. Personal data is processed for the purpose of managing and maintaining customer relationships.
Juhlaboksi Oy processes personal data for the following purposes:
- Providing, developing, maintaining, delivering, invoicing, and reporting on the products and services selected and ordered by customers.
- Customer relationship management, sales, marketing, communications, customer support, and customer service.
- Developing and maintaining our business operations, products, and services.
- Informing customers about our products and services and promoting sales.
- Business-related communication with our partners.
The processing of personal data is based on our legitimate interests in responding to your inquiries, providing efficient services, and maintaining our business relationship with you in accordance with Article 6(1)(f) of the General Data Protection Regulation (GDPR).
5. What Personal Data We Collect
The types of personal data we collect depend on how you interact with our website and use our services. When we refer to "personal data," we mean information that identifies you, relates to you, describes you, or can reasonably be linked to you.
Information you provide directly
The personal data you provide directly through our services may include:
- Contact information, such as your name, postal address, telephone number, and email address.
- Order information, including your name, billing address, shipping address, payment confirmation, email address, and telephone number.
- Account information, such as your username, password, security questions, and other information used to secure your account.
- Customer support information, including any information you choose to include when communicating with us through our services.
Certain features of our services may require you to provide specific personal information. You may choose not to provide this information, but doing so may prevent you from using certain features.
Information collected automatically
We may automatically collect certain information about your interaction with our services ("Usage Data"). To do this, we may use cookies, pixels, and similar technologies ("Cookies").
Usage Data may include:
- How you use our website and your account
- Device information
- Browser information
- Network connection information
- IP address
- Other information about your interactions with our services
Information obtained from third parties
We may also receive information about you from third parties, including vendors and service providers acting on our behalf. These may include:
- Companies that support our website and services, such as Shopify.
- Payment processors that collect payment information (such as bank account details, credit or debit card information, and billing address) in order to process your payment, fulfill your order, and provide the requested products or services under our contract with you.
When you visit our website, open or click emails we send, or interact with our services or advertisements, we or our partners may automatically collect certain information using online tracking technologies such as pixels, web beacons, software development kits (SDKs), third-party libraries, and cookies.
All personal data obtained from third parties is processed in accordance with this Privacy Policy.
6. Data Retention Period
Personal data stored in the customer register is retained for the period required by the Finnish Accounting Act (1336/1997). The minimum retention period is six (6) years, in accordance with Section 2:10.2 of the Finnish Accounting Act.
7. Regular Sources of Information
Personal data is collected directly from the data subject.
8. Principles of Data Protection
Customer register data is stored on the e-commerce platform maintained by Shopify International Limited. The data is protected on Shopify's firewall-secured servers, and its security is ensured through the following measures:
Information Security: All customer data is protected using industry-standard security practices.
Access Control: Access to customer data is restricted to employees who require it for the performance of their duties.
Data Encryption: Personal data is encrypted both during transmission and while stored, protecting it from unauthorized access.
Security Policies: Shopify follows strict security policies covering both physical and digital security.
You can read Shopify's Security Statement here.
Our payment service provider is Paytrail Oyj (Business ID: 2122839-7).
Paytrail Oyj is a licensed payment institution. You can read Paytrail's Privacy Policy here and Flatpay ApS's Privacy Policy here.
We comply with the EU General Data Protection Regulation (GDPR).
9. How We Share Personal Data
In certain circumstances, we may disclose your personal data to third parties for the performance of a contract, legal obligations, or other purposes described in this Privacy Policy. Such circumstances may include the following:
- Vendors and other third-party service providers that perform services on our behalf, such as IT administration, payment processing, data analytics, customer support, cloud storage, order fulfillment, and delivery.
- Business and marketing partners who provide services and advertising. These partners process your personal data in accordance with their own privacy policies.
- When you instruct us or authorize us to share specific information with third parties, for example, to deliver products to you or when using social media widgets or login integrations.
- Our business partners and internally within our organization where necessary to support our legitimate business interests.
- In connection with business transactions, such as mergers or bankruptcy proceedings, to comply with legal obligations (including responding to court orders, warrants, or similar legal requests), to enforce our Terms of Service, or to protect our rights, our services, or the rights of our users or others.
We do not use or disclose sensitive personal data without your consent, nor do we use such data to infer your personal characteristics.
With your consent, we may share personal data for advertising and marketing purposes as described in this Privacy Policy.
Third-Party Websites and Links
Our website may contain links to websites or online platforms operated by third parties. If you follow links to websites that are not operated by us or our partners, you should review their privacy policies, security practices, and terms of use.
We are not responsible for the privacy practices, security, accuracy, completeness, or reliability of third-party websites.
Information you choose to share on public or semi-public platforms, including third-party social media services, may be visible to other users of those services without restriction.
The inclusion of links to third-party websites does not imply our endorsement of their content, owners, or operators, except where explicitly stated.
10. Right of Access
You have the right to request access to the personal data stored about you in the Juhlaboksi A&A Oy Customer Register.
Requests for access must be submitted in accordance with Section 12 of this Privacy Policy.
11. Right to Rectification, Erasure, and Restriction of Processing
You have the right to request that the Data Controller correct inaccurate or incomplete personal data concerning you.
You also have the right to request the deletion of personal data that is no longer necessary or whose processing is based solely on your consent. Please note that this right does not apply to all personal data processed under a contractual relationship or on the basis of our legitimate interests.
In addition, you have the right to request the restriction of processing in accordance with the General Data Protection Regulation (GDPR).
Requests concerning these rights must be submitted in accordance with Section 12 of this Privacy Policy.
12. Contact Information
For all matters relating to the processing of personal data and the exercise of your rights, please contact the person identified in Section 2.
We recommend contacting us by email.
Where necessary, the Data Controller may request additional information or clarification before processing your request. We may also verify your identity before taking any action concerning your personal data.
13. Cookies
Like many websites, we use cookies on our website.
More information about the cookies used by Shopify to operate our online store is available at:
https://www.shopify.com/legal/cookies
We use cookies to improve and optimize our website and services, including remembering your preferences and activities, performing analytics, and better understanding how visitors interact with our website.
We may also allow third-party service providers to use cookies on our website to help personalize services, products, and advertisements both on our website and on other websites.
Most web browsers automatically accept cookies by default. However, you can configure your browser to remove or reject cookies.
Please note that disabling or deleting cookies may negatively affect your user experience. Certain features and services may no longer function properly or may become unavailable.
Blocking cookies may also not completely prevent the sharing of information with third parties, such as our advertising partners.
PRIVACY POLICY FOR THE MARKETING REGISTER OF JUHLABOKSI A&A OY
1. Data Controller
Juhlaboksi A&A Oy
Business ID: 3430103-9
Oulu, Finland
2. Contact Person for Matters Concerning the Register
Managing Director Ann-Helen Piri
Oulu, Finland
Phone: +358 50 3823102
Email: info@juhlaboksi.fi
3. Name of the Register
Juhlaboksi A&A Oy Marketing Register
4. Legal Basis and Purpose of Processing Personal Data
The processing of personal data in the marketing register is based on our legitimate interest arising from the customer relationship.
By subscribing to the newsletter, the data subject demonstrates an interest in the activities of Juhlaboksi A&A Oy and voluntarily provides a basis for registration. When subscribing, the data subject may reasonably expect that their personal data will be processed for customer communications related to the newsletter.
We may use your personal data for marketing and promotional purposes, including sending marketing, advertising, and promotional communications by email, text message, or post, and displaying targeted advertisements for products or services on Facebook and Instagram.
This may include using your personal data to better personalize our Services and the advertising displayed on our Website and on other websites.
If you reside in the European Economic Area, the legal basis for these processing activities is our legitimate interest in marketing and selling our products in accordance with Article 6(1)(f) of the General Data Protection Regulation (GDPR).
5. Personal Data Contained in the Register
The following information may be stored about the data subject:
- Name
- Date of birth
- Address
- Telephone number
- Email address
A data subject may be registered simultaneously in both the Juhlaboksi A&A Oy customer register and the marketing register.
Personal data may also be transferred internally from the marketing register to the customer register when a customer relationship is established.
We also use personal data for remarketing, meaning that advertisements may be targeted at users who have previously visited our Website. Data may be shared with Meta, including Facebook and Instagram, for advertising targeting purposes.
No special categories of personal data are stored in the marketing register.
6. Retention Period of Personal Data
Personal data stored in the marketing register is retained for as long as the data subject remains subscribed to the newsletter.
7. Regular Sources of Information
The personal data stored in the register is obtained directly from the data subject.
8. Regular Disclosure of Data and Transfers Outside the European Union or European Economic Area
Personal data is not disclosed or transferred to third parties.
9. Principles for Protecting the Register
All information concerning users that is collected in electronic systems is kept confidential. Any electronic transfers of personal data are carried out using encrypted protocols.
Documents containing personal data that are processed manually are stored in a manner that prevents unauthorized access. Such documents are destroyed by shredding when they are no longer required.
10. Right of Access
The data subject has the right to request information about the personal data stored about them in the Juhlaboksi A&A Oy marketing register.
Requests for access must be submitted in accordance with Section 13 of this Privacy Policy.
11. Right to Rectification, Erasure, and Restriction of Processing
The data subject has the right to request that the Data Controller correct inaccurate or incorrect personal data concerning them.
The data subject also has the right to request the deletion of personal data that is no longer necessary.
Requests concerning the exercise of these rights must be submitted in accordance with Section 13 of this Privacy Policy.
12. Right to Withdraw Consent and Object to Processing
The data subject has the right to unsubscribe from the newsletter associated with the marketing register. When the subscription is cancelled, all personal data relating to the data subject will be removed from the register.
The data subject also has the right to object to the processing of personal data based on legitimate interests. In such cases, the Data Controller may no longer process the data subject's personal data.
This does not apply where the Data Controller can demonstrate compelling and legitimate grounds for the processing. If no such grounds exist, the data subject's personal data will be completely removed from the marketing register.
Requests concerning the exercise of these rights must be submitted in accordance with Section 13 of this Privacy Policy.
13. Contact
For all matters relating to the processing of personal data and the exercise of the data subject's rights, the data subject should contact the person identified in Section 2.
Contact should primarily be made electronically.
Where necessary, the Data Controller may request additional written information or clarification concerning the exercise of the data subject's rights.