Privacy Policy

We process personal data carefully and in accordance with the EU General Data Protection Regulation (GDPR).

Controller
Saara Ruskola
Email: info@saararuskola.com

Contact Person for Data Protection
All requests and questions related to data protection: info@saararuskola.com

Data Collected
We collect information necessary for operating the online store and processing orders, such as:
• name
• address
• email address
• phone number
• country and language
• order details and purchase history
• payment transaction information
• IP address and technical log data (e.g., for security and service functionality)

For business customers additionally: 
• company name
• business ID
• VAT number

Purpose of Processing
Personal data is used for:
• processing and delivering orders
• customer service
• payment processing
• fulfilling legal obligations (e.g., accounting)
• developing the online store and ensuring security
• marketing (only with consent)

Legal Basis
Processing of personal data is based on:
• contract (fulfilling the order)
• legal obligation
• consent (e.g., marketing)
• legitimate interest (e.g., service development, maintaining security, preventing misuse)

Data Disclosure and Processors
Data is disclosed only to service providers essential for operating the online store, such as:
• e‑commerce platform
• payment service providers
• shipping and logistics services
• email and marketing tools
• analytics and technical services
Service providers process data only for agreed purposes.

Transfer of Data Outside the EU/EEA
Some service providers (e.g., Shopify and payment services) may process data outside the EU/EEA. In such cases, GDPR-compliant safeguards are used, such as the European Commission’s Standard Contractual Clauses (SCC).

Retention Periods
Personal data is stored only as long as necessary:
• accounting material: as required by accounting legislation
• customer data: typically 2–5 years from the last purchase
• marketing consents: until consent is withdrawn
• customer service messages: up to 2 years after the matter is resolved

Rights of the Data Subject
You have the right to:
• access your data
• request correction of data
• request deletion of data
• restrict processing
• object to processing
• transfer data to another system
• withdraw consent at any time
• lodge a complaint with a supervisory authority
To exercise these rights, contact: info@saararuskola.com

Cookies and Tracking
The online store uses cookies and similar technologies. Cookies are used for:
• enabling site functionality (necessary cookies)
• shopping cart and order processing
• analytics (e.g., understanding site usage)
• targeted marketing (only with consent)
Non-essential cookies are activated only with user consent.

Data Security
We protect personal data using technical and organizational measures, such as:
• secure servers and encrypted data transfer (HTTPS/TLS)
• restricted access rights
• secure payment solutions

Right to Lodge a Complaint
You have the right to file a complaint with the Office of the Data Protection Ombudsman if you believe your personal data has been processed unlawfully. More information: www.tietosuoja.fi