Privacy

Last updated 12 November 2026

Who is responsible for your data

Legal business name, business ID Y-tunnus, Turku, Finland. Questions about your data: email.

What we collect and why

• Name, delivery address, email and phone number, to deliver your order and contact you about it.
• What you ordered and what you paid, to fulfil the order and keep the bookkeeping the law requires.
• Messages you send us, to answer them.

The legal bases are our contract with you, our legal obligations, and our legitimate interest in preventing fraud.

We do not collect or store your card details. Payment happens on Stripe's page.

Who receives your data

• Stripe Payments Europe Ltd (Ireland) processes your payment.
• Gelato (Norway) and its production partners make your order, and the delivery company brings it to you. They receive your name, address, contact details and order contents.
• Hosting provider, e.g. Cloudflare serves this website.

Some of these companies may process data outside the EEA. When they do, they use safeguards approved by the EU, such as standard contractual clauses. We never sell your data.

How long we keep it

Order and payment records are kept for six years after the end of the financial year, as Finnish accounting law requires. Other messages are deleted within 12 months.

Cookies and storage

This site sets no tracking or advertising cookies. Your bag is saved in your own browser's storage and is never sent to us. Stripe sets its own cookies on the checkout page to prevent fraud. Add analytics here if you turn any on

Photos on the wall

We only pin up a photo if you tag us or send it to us and agree to it being shown. Ask and we take it down.

Your rights

You can ask to see, correct or delete your data, to restrict or object to how we use it, and to receive a copy of it. Email us and we answer within one month. You can also complain to the Office of the Data Protection Ombudsman.