Privacy policy

Privacy Policy

Eumer Finland Oy – web store customers, newsletter subscribers and customer service

EU General Data Protection Regulation (2016/679), Articles 13 and 14, and the Finnish Data Protection Act (1050/2018)

Updated: 28 October 2026

1. Controller and contact details

Eumer Finland Oy (Business ID 2113834-0)
Kalkuttaantie 10, 29900 Merikarvia, Finland
Data protection enquiries: info@eumer.fi

2. Who this policy applies to

This policy applies to individuals whose personal data Eumer Finland processes in connection with consumer customer relationships:

web store customers, both those who have created a customer account and those who order without one (as a guest)
newsletter subscribers
people who contact customer service
website users with regard to cookies
people who write product reviews
winners of social media giveaways

3. Personal data processed

Basic information: name, delivery and billing address, phone number, email address
Customer account information (if the customer has created an account): username and password, and account settings
Order information: products ordered, prices, order and delivery history, selected delivery and payment method
Payment transaction information: payment status and reference. Card details or online banking credentials are not stored in Eumer Finland’s systems.
Marketing permissions and opt-outs, such as newsletter subscriptions and unsubscriptions
Customer service messages, complaints and returns
Technical data: IP address, browser and device information, and cookie data in accordance with cookie consent
Product reviews: name or nickname, email address and the content of the review. The name or nickname and the review are displayed publicly in the web store; the email address is not. The reviewer’s email address is not used for marketing.
Giveaway winners: social media username and the name and address needed to deliver the prize

4. Purposes and legal bases of processing

Processing orders, deliveries, payments, returns and complaints: performance of a contract (Art. 6(1)(b))
Maintaining customer accounts: performance of a contract (Art. 6(1)(b))
Accounting and other statutory obligations: legal obligation (Art. 6(1)(c))
Customer service and responding to enquiries: contract or legitimate interest (Art. 6(1)(b) and (f))
Newsletter and electronic direct marketing: consent (Art. 6(1)(a)). Marketing of our own similar products to existing customers is based on legitimate interest, with the option to opt out in every message.
Web store development, statistics and information security: legitimate interest (Art. 6(1)(f))
Analytics and marketing cookies: consent (Art. 6(1)(a)) via the cookie banner
Publishing product reviews and related communication: consent (Art. 6(1)(a)), given by the reviewer when submitting the review
Social media giveaways and prize delivery: legitimate interest (Art. 6(1)(f)) and delivery of the prize in accordance with the giveaway rules

Legitimate interest here refers to the customer relationship between Eumer Finland and the customer and its management. Providing personal data is a prerequisite for placing an order; without it, the order cannot be delivered.

5. Sources of data

The individual themselves, when placing an order, creating a customer account, subscribing to the newsletter, writing a product review or contacting us
Social media services (e.g. Instagram or Facebook), when a giveaway winner provides their delivery details in a private message
Payment service Svea: payment transaction status
Carriers Posti and Matkahuolto: shipment tracking information
Website cookies and technical logs

6. Recipients of data

Personal data is not sold or disclosed to third parties for marketing purposes. The data is processed by service providers required for operating the web store:

Refox: web store and ERP system (browser-based cloud service). Processes data on behalf of Eumer Finland.
Svea: payment processing. Svea also processes payment transaction data as an independent controller (e.g. for invoice and instalment payments) under its own terms.
Posti and Matkahuolto: parcel delivery and delivery notifications. The carrier receives the information needed for delivery: name, address, phone number and email.
Brevo: sending newsletters to subscribers.
Microsoft (Microsoft 365): email and customer service communication.
Meta (Instagram, Facebook): communication in social media giveaways. Meta also processes messages sent through its service as an independent controller under its own terms.
Google: website visitor analytics and marketing targeting and measurement (Google Analytics, Google Tag Manager, Google Ads and Google Marketing Platform). Only with cookie consent.
Authorities: only where required by law.

Eumer Finland has concluded the agreements required by the GDPR with the service providers that process data on its behalf.

7. Transfers of data outside the EU or EEA

Some service providers (Microsoft, Meta and Google) may also process data outside the EU, for example in the United States. In such cases, the transfer is safeguarded in accordance with the GDPR, for example through the EU–US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

8. Retention periods

Order, payment and invoice data (accounting records): at least 6 years from the end of the financial year, in accordance with the Accounting Act
Customer account: until the account is deleted, or 3 years after the last login or order, after which the account is deleted
Guest customer data: according to order processing, complaint and return periods, and the accounting retention period
Newsletter subscription: until the subscriber unsubscribes
Marketing opt-out: for as long as compliance with the opt-out requires
Customer service messages: 2 years from the closing of the matter, unless the data forms part of the accounting records
Product reviews: for as long as the review is published in the web store. The reviewer may request deletion of their review at any time.
Giveaway winners’ messages and delivery details: the message thread is deleted once the prize has been shipped
Cookie data: per cookie, as stated in the cookie banner

Unnecessary data is regularly deleted or anonymised.

9. Data security

The web store and ERP system is a browser-based cloud service used over an encrypted connection.
Systems are accessed with personal usernames and passwords.
Only those Eumer Finland employees who need personal data for their work have access to it.
Payment details, such as card numbers, are processed by the payment service Svea and are not stored in Eumer Finland’s systems.
Employees who process personal data are bound by confidentiality.

10. Automated decision-making and profiling

Eumer Finland does not make automated decisions about customers that have legal or similarly significant effects. The payment service Svea may make a credit decision for invoice or instalment payments under its own terms.

11. Your rights

You have the right to:

know what data about you is processed and receive a copy of it
request correction of inaccurate or incomplete data
request erasure of your data, unless a statutory obligation, such as accounting, requires it to be retained
request restriction of processing
object to processing based on legitimate interest
prohibit direct marketing at any time
withdraw your consent at any time, without affecting the lawfulness of prior processing
receive the data you have provided in a machine-readable format and transfer it to another controller

Requests should be sent to info@eumer.fi. We will respond within one month at the latest. We may ask you to verify your identity before disclosing or changing data.

You can also unsubscribe from the newsletter via the link at the end of each newsletter.

12. Right to lodge a complaint

If you believe that the processing of your personal data violates data protection legislation, you may lodge a complaint with the supervisory authority: Office of the Data Protection Ombudsman, www.tietosuoja.fi/en.

13. Cookies

The website uses cookies and other similar technologies, such as the browser’s local storage. Cookies are small text files stored in the user’s browser.

Necessary cookies enable the website’s basic functions, such as the shopping cart, logging in to a customer account and delivery time estimates. They do not require consent. Necessary cookies remain in the browser for 15 minutes to 24 months, unless the user deletes them via the browser settings.
Analytics and marketing cookies are used only with consent. They are used to monitor website use, popular products, trends and sales, and to target marketing. The services in use are Google Analytics, Google Tag Manager, Google Ads (including Google Display Network) and Google Marketing Platform (formerly DoubleClick).

Consent can be given, changed or withdrawn at any time via the cookie banner.

14. Changes to this policy

Eumer Finland may update this policy, for example when legislation or our services change. The current version is always available in the web store.