Privacy policy

Privacy Policy

This privacy policy explains how we process personal data on our website and online store. We comply with the General Data Protection Regulation (GDPR) of the European Union and applicable national data protection legislation.

1. Data Controller

Organization name: Your Finnish Friends Ry
Business ID: 3277533-7
Email: yourfinnishfriends@protonmail.com

2. Purpose and Legal Basis for Processing Personal Data

We process personal data for the following purposes:

2.1. Contact form submissions

Processed data: Name, email address, phone number, and any other information provided in the message.
Purpose: Responding to inquiries.
Legal basis: Consent of the data subject or legitimate interest (handling inquiries).

2.2. Customer information from store orders

Processed data: Name, address, email address, phone number, order details, payment details.
Purpose: Processing orders, delivering products and services, managing customer relationships.
Legal basis: Performance of a contract (order processing) and compliance with legal obligations (e.g., accounting).

2.3. Contact information collected from public sources for advocacy communications

Processed data: Name, company/organization name, phone number, email address.
Purpose: Association communications.
Legal basis: Legitimate interest (association marketing).

2.4. Newsletter subscribers' information

Processed data: Email address, any other information provided by the subscriber (e.g., name, interests).
Purpose: Sending newsletters, providing current information and marketing materials.
Legal basis: Consent of the data subject (subscribing to the newsletter).

3. Retention Period for Personal Data

Personal data is retained only for as long as necessary to fulfill the purposes described in this privacy policy or as required by law.

3.1. Contact form data

Retained until the matter of the inquiry is resolved, or for a maximum of 12 months.

3.2. Order data

Retained in accordance with accounting laws for at least six years after the end of the fiscal year.

3.3. Marketing data

Retained as long as marketing activities are targeted unless the data subject objects to the processing.

3.4. Newsletter subscriber data

Retained as long as the subscriber is on the mailing list or until they cancel their subscription.

4. Data Disclosures and Transfers

We do not disclose personal data to third parties without appropriate consent or a legal reason, except in the following cases:

Service providers (e.g., payment services, shipping companies) involved in order processing.
Disclosures required by law to authorities.

Data is not transferred outside the EU or European Economic Area without appropriate safeguards in accordance with the GDPR.

5. Data Subject's Rights

Data subjects have the following rights concerning the processing of their personal data:

5.1. Right of access

Data subjects have the right to inspect the data collected about them.

5.2. Right to rectification

Incorrect or incomplete data can be corrected upon request.

5.3 Right to be forgotten

In certain situations, data subjects have the right to request the deletion of their data.

5.4. Right to object

Data subjects have the right to object to the processing of their data for marketing purposes.

5.5. Right to data portability

Data subjects have the right to receive their data in a machine-readable format and transfer it to another data controller.

5.6. Right to file a complaint with a supervisory authority

If a data subject believes that the processing of their personal data violates data protection regulations, they have the right to file a complaint with the data protection authority.