Privacy policy
Updated: 3 November 2026
Varusteleka Oy processes personal data in the operation of its online store, retail store and customer service, and in sales to business customers (B2B) and public sector customers (B2G). In this policy, B2B customers means business customers and B2G customers means public authority customers. This policy explains what data we process, for what purposes and on what legal basis, how long we keep it and what rights you have. It has been written in accordance with the EU General Data Protection Regulation (2016/679).
If you want to restrict the use of your data, you can do so in the cookie settings at the bottom of the page or by contacting info@varusteleka.com.
Contents
- General
- Controller and contact details
- What data we process and where it comes from
- What we use data for and on what basis
- How we protect data
- How long we keep data
- Who we disclose data to
- Do we transfer data outside the EU and EEA
- Cookies and other tracking
- Profiling and customer segmentation
- Your rights
- How you can control the use of your data
- Privacy rights of US residents
- Changes to this policy
1. General
In this policy, a customer means a natural person who browses or orders from our online store at varusteleka.com, shops at our Konala store or contacts our customer service, as well as a contact person or representative acting on behalf of a B2B or B2G customer. The policy also covers contact persons of prospective B2B and B2G customers in connection with requests for quotation, sales negotiations and other customer communication.
Scope of this policy. This policy covers the online store, the retail store and customer service, as well as the processing of contact persons' personal data in B2B and B2G sales, such as requests for quotation, offers, contract and order management and customer relationship management.
We process the following kinds of data:
- data you give us yourself (for example when placing an order)
- data generated by your use of the service (for example order history and browsing data)
- data derived through analytics (for example product recommendations)
- data we receive about contact persons of B2B and B2G customers in the course of managing the customer relationship
We process only the data needed for each purpose. What you do in our service affects what data of yours we process.
2. Controller and contact details
The controller is:
Varusteleka Oy, Business ID 2082907-8, Hankasuontie 11 A, 00390 Helsinki, Finland
Questions and requests concerning data protection and the processing of personal data: info@varusteleka.com
Our online store runs on the Shopify platform. Shopify processes personal data on our behalf to provide the service and partly also for its own purposes in accordance with its own privacy policy. To the extent that Shopify processes data for its own purposes, it is itself responsible for that processing and for related requests under its own privacy policy. Shopify's consumer privacy policy is available at privacy.shopify.com.
3. What data we process and where it comes from
When you create a customer account
Name, email address and phone number. If you sign in with a third-party login service, we also process the email address and identifier used for signing in.
When you place an order
Delivery and billing address, chosen delivery method, chosen payment method and payment transaction identifier, ordered products and their prices, order date and communication related to the order. We do not store payment card numbers in our own systems; the payment transaction goes through the payment service provider.
For orders delivered outside the EEA, we also process the data required for customs clearance.
Data given for marketing
If you subscribe to the newsletter, we process your email address and language preference. If you subscribe to SMS marketing, we process your phone number for this purpose.
A phone number given for marketing is separate from the number given with an order: the order number is used to handle delivery, and no marketing is sent to it without separate permission. Email and SMS marketing consents are separate. Subscribing to one does not mean subscribing to the other, and you can withdraw one without affecting the other.
Data generated by use of the service
Browsing and usage data in the online store, shopping cart events, device identifiers and IP address, and data collected through cookies. Your cookie settings control the collection of this data.
In other contexts
Customer service communication (email and chat), product reviews, wishlist items, back-in-stock notifications, loyalty programme events and survey responses when you take part in a survey.
Invoice and instalment payment methods
If you choose invoice or instalment payment, the payment method provider may ask for your personal identity code to check your credit information. The check is carried out by the payment method provider, which acts as an independent controller in that respect under its own privacy policy. You will see that policy when choosing the payment method.
Contact persons of B2B and B2G customers
When you act on behalf of a B2B or B2G customer, we process data about you that is needed to manage the customer relationship: your name, work contact details, organisation, job title and role in the customer relationship, as well as data and communication related to enquiries, requests for quotation, offers, negotiations, contracts, orders, deliveries and invoicing. Organisation data falls within the scope of this policy to the extent that it relates to an identified or identifiable person.
We do not store personal identity codes in our customer register.
Special categories of personal data
We do not collect or process special categories of personal data, such as data concerning health, beliefs or trade union membership.
Sources of data
The main source is you. Some data is generated by use of the service, and some is derived through analytics. We may also receive data from the invoice and instalment payment provider in connection with processing the payment method. We may also receive data on contact persons of B2B and B2G customers from the organisation you represent, for example when it names a contact person for an order or contract.
Minors
Our services are not intended for children, and we do not knowingly collect personal data from anyone under 16. If you are the parent or guardian of a child who has given us personal data, contact info@varusteleka.com and we will delete the data.
4. What we use data for and on what basis
We process data to perform a contract, to meet legal obligations, on the basis of your consent or on the basis of our legitimate interest. The basis varies by purpose, and the tables below state it purpose by purpose.
Online store and orders
| Purpose | Data categories | Legal basis |
|---|---|---|
| Creating and maintaining a customer account | Name, email, phone number, account settings | Contract |
| Signing in and authentication | Account data, sign-in events | Contract |
| Order processing and delivery | Contact details, delivery, payment and order data | Contract; for accounting, legal obligation |
| Order and delivery confirmations and other communication about the order | Email, phone number, order data | Contract |
| Returns, exchanges and cancellations | Contact details, order and return data | Contract |
| Warranty and service cases | Contact details, order and product data | Contract; for product liability, legitimate interest |
| Wishlist and back-in-stock notifications | Email, selected products | Contract |
| Product reviews | Nickname, review content | Consent |
| Credit check for invoice and instalment payment | Data is passed to the payment method provider, which acts as an independent controller in that respect | Contract (payment method chosen by the customer) |
| Customs and export | Recipient details, data required for customs clearance | Legal obligation |
| Store sales and pick-ups | Contact details, purchase transaction | Contract |
We process contact person data of organisational customers on the basis of our legitimate interest. Marketing, cookies and profiling follow the bases and your choices described in the relevant sections.
Customer service
| Purpose | Data categories | Legal basis |
|---|---|---|
| Customer service by email and chat | Contact details, message content, order data | Legitimate interest (managing the customer relationship) |
| Product safety notices and recalls | Email, order data | Legal obligation (General Product Safety Regulation (EU) 2023/988) |
| Handling data subject requests | Contact details, content of the request | Legal obligation |
Marketing
| Purpose | Data categories | Legal basis |
|---|---|---|
| Newsletter (Finnish, English, German, Polish) | Email, language preference, marketing permissions | Consent |
| SMS marketing | Phone number, order data, marketing permissions | Consent (separate from email consent) |
| Personalisation of content and product recommendations | Browsing and purchase data, derived interest data | Consent |
| Targeting advertising on other websites | Browsing data, device identifiers | Consent |
| Loyalty programme | Customer identifier, points, purchase history | Contract (programme terms) |
Analytics and service development
| Purpose | Data categories | Legal basis |
|---|---|---|
| Website usage analytics | Browsing and usage data, device identifiers | Consent |
| Customer segmentation and profiling | Purchase history, interest data, browsing data | Legitimate interest; for browsing data, consent |
| Business reporting and assortment development | Order and sales data, pseudonymised in customer analytics | Legitimate interest |
| Customer satisfaction and feedback surveys | Email, responses | Legitimate interest; responding is voluntary |
Security and fraud prevention
| Purpose | Data categories | Legal basis |
|---|---|---|
| Website protection and bot protection | IP address, request logs | Legitimate interest |
| Prevention of misuse and fraud | Order, payment and delivery data | Legitimate interest; partly legal obligation |
| Accounting and order archiving | Order and payment data | Legal obligation (Finnish Accounting Act 1336/1997) |
Where the basis is legitimate interest, we have weighed our interest against your rights and freedoms. You have the right to object to such processing (section 11).
B2B and B2G sales
| Purpose | Data categories | Legal basis |
|---|---|---|
| Handling requests for quotation and offers, and sales negotiations | Contact person's name, work contact details, organisation, role and related communication | Legitimate interest (dealing with organisational customers and conducting sales) |
| Managing contracts, orders, deliveries and customer relationships | Contact person's name, work contact details and role, and contract, order, delivery and transaction data | Legitimate interest (performing the contract made with the organisation and managing the customer relationship) |
| Invoicing, payment monitoring and accounting | Billing contact's details, invoicing references, and invoice and payment data | Legitimate interest (invoicing and receivables management); for accounting, legal obligation |
| Handling complaints, contractual disputes and legal claims | Contact details and the contract, order and communication data needed to resolve the matter | Legitimate interest (resolving the matter and establishing, exercising or defending legal claims) |
Use of artificial intelligence
We use AI-based tools as part of providing and developing our service. Examples include making customer service more efficient (such as classifying messages and features that assist in drafting replies), creating product recommendations, content drafts and translations, and detecting misuse and fraud. In AI-based tools we process your personal data only to the extent the purpose in question requires, and the same data protection principles and safeguards apply to them as to the other processing described in this policy. AI is not used for automated decision-making that would have legal effects on you or similarly significant effects.
5. How we protect data
We use only service providers with whom we have concluded a data processing agreement. Where the location of a service can be chosen, we have chosen the EU.
Our practical safeguards:
- Multi-factor authentication in all administrative systems
- Role-based access control, meaning each employee sees only the data their work requires
- Pseudonymisation in analytics: in customer analytics, direct identifiers such as the email address are replaced with an identifier. Identifiers in clear text are used in reporting only for invoicing and receivables monitoring, and only those who need them have access
- Encrypted connections when transferring data
- Staff training and confidentiality obligations
- Partners' maintenance access is restricted on the same principles and bound by contract
- A process for handling security incidents, under which we assess incidents and, where necessary, notify the supervisory authority and data subjects
6. How long we keep data
We keep data for as long as it is needed for the purpose for which it was collected, or for as long as the law requires. If the same data is used for several purposes, the longest retention period applies.
We delete or anonymise your customer data when you have not placed an order or opened or clicked our marketing messages for five years. Deletions are carried out regularly, at least once a year. Deletion does not apply to order, contract or accounting data that is kept separately and for which there is still a basis for retention.
Order data is kept for ten years. Product liability and warranty cases may arise after a long delay. If your customer data has been deleted or anonymised before then, the order remains in our systems without data that would link it to you.
Online store and orders
| Purpose | Retention period |
|---|---|
| Customer account | For the duration of the customer relationship. The data is deleted or anonymised when the customer has not placed an order or opened or clicked marketing messages for five years |
| Order and delivery data | 10 years from processing of the order |
| Accounting records | 6 years from the end of the financial year in which the order was processed |
| Communication about the order (confirmations, delivery notifications) | In line with the retention period of customer data |
| Wishlist and back-in-stock notifications | Until you delete them yourself or your customer data is deleted |
| Published product reviews | Not deleted automatically. We delete a review at your request |
Customer service
| Purpose | Retention period |
|---|---|
| Customer service communication and chat conversations | 5 years from the last contact |
Marketing
| Purpose | Retention period |
|---|---|
| Newsletter subscriber data | For as long as the consent is valid |
| SMS marketing subscriber data | For as long as the consent is valid |
| Record of opting out of marketing (email and SMS) | In line with the 5-year inactivity rule, so that the opt-out stays in effect. The opt-out record must be kept, because without it we cannot make sure we do not message you again. We delete it earlier if you ask us to delete all your data |
| Marketing profile and segments | In line with the retention period of customer data |
| Loyalty programme events | In line with the retention period of customer data |
Analytics and security
| Purpose | Retention period |
|---|---|
| Web analytics | 14 months |
| Analytics and reporting environment | Five full calendar years on a rolling basis |
| Data collected with cookies | Per cookie. Exact durations can be found in the cookie settings |
| Technical logging and bot protection | Short-term |
Contact data and documents of B2B customers
| Data category | Retention basis and period |
|---|---|
| Contact person's work contact details and role | For the duration of the customer relationship |
| Requests for quotation, offers and negotiation communication that did not lead to a contract | For the duration of the offer or negotiation process and any necessary follow-up. |
| Contract documents and related essential communication | For the contract term and for handling obligations or claims after it. |
| Order, delivery and accounting data | Order and delivery data: 10 years from processing of the order. Accounting data: 6 years from the end of the financial year of the order. |
Contact data and documents of B2G customers
For the retention and deletion of public authority customers' personal data, we follow retention periods and deletion practices agreed with each customer. Unnecessary personal data, such as names and email addresses included in orders, is deleted in line with these practices when it is no longer needed for processing the order, delivery or handling warranty matters. Data necessary to meet legal obligations or to handle legal claims is kept only as long as that purpose requires.
7. Who we disclose data to
We disclose data only to the extent necessary to provide the service or required by law. Our partners may use the data only for the agreed purpose.
Recipient categories:
- The e-commerce platform on which the store runs
- Our online store development partner, which has maintenance access to the store for development work
- Marketing partners with restricted access to the online store and the customer communication system for carrying out marketing
- Payment service providers and payment method providers, depending on the payment method you choose
- Invoice and instalment payment providers, which carry out the credit check and act as independent controllers in that respect
- Logistics partners and carriers for delivering orders
- Providers of customer service and customer relationship management systems, which we also use to manage contact data, sales enquiries and accounts of B2B and B2G customers
- Providers of email marketing and customer communication
- The SMS service provider for sending marketing and service messages
- The loyalty programme provider
- Analytics and advertising partners, to the extent you have given cookie consent. Disclosure is based on cookies and similar identifiers
- Cloud service and analytics partners that maintain our reporting environment
- Providers of AI services whose tools we use in analytics, content creation and customer service
- Financial administration and debt collection partners
- Authorities, when required or permitted by law. We will also inform you of a data request where the law allows
If Varusteleka is sold or its business is reorganised, personal data may transfer to the new owner.
Links to third-party websites
Our services may contain links to third-party websites and social media platforms. We are not responsible for the content, privacy or security of those websites. When you go to such a website, please read its privacy and usage terms separately. Information you share on third-party platforms may be visible to other users under the platform's own practices.
8. Do we transfer data outside the EU and EEA
Yes, partly. Some of our service providers are based in the United States, the United Kingdom or Canada, and their maintenance and support may take place outside the EEA. Where the location of a service can be chosen, we have chosen the EU, but this does not remove all transfers.
When data is transferred outside the EEA, the transfer is based on one of the following:
- United Kingdom: the European Commission's adequacy decisions, renewed on 19 December 2025 and valid until 27 December 2031. An adequacy decision means that no separate safeguard is needed for the transfer.
- United States: the EU–US Data Privacy Framework where the service provider is certified under it, or standard contractual clauses approved by the European Commission together with any necessary supplementary measures.
- Canada: the European Commission's adequacy decision concerning commercial organisations, under which no separate safeguard is needed for the transfer.
- Other countries: a Commission adequacy decision for the destination country or standard contractual clauses with supplementary measures.
9. Cookies and other tracking
We use cookies and similar technologies, such as the browser's local storage and server-side tracking. Cookies are small files used to recognise the browser and keep the service running.
We use a consent tool to manage cookies. Non-essential cookies are blocked until you accept them. You can change or withdraw your consent at any time in the cookie settings at the bottom of the page.
Cookies fall into four categories:
- Necessary cookies enable the basic functions of the site, such as the shopping cart, signing in and secure payment. These cannot be switched off, because the service does not work without them
- Preference cookies remember your choices, such as language and currency
- Statistics cookies tell us how the site is used so that we can develop it
- Marketing cookies enable advertising to be targeted and measured
This policy describes the purposes, bases and retention periods. Technical details of cookies, such as names, providers and durations, can be found in the cookie settings and in the cookie declaration, which updates automatically.
10. Profiling and customer segmentation
We use profiling and customer segmentation so that we can recommend products that interest you and target our communication sensibly. Here we explain openly what this means.
What profiling and segmentation are
Profiling means the automated analysis of your data, resulting in an estimate of which products and content are likely to interest you.
Segmentation means dividing customers into groups based on shared characteristics or purchasing behaviour. The same customer can belong to several groups.
Profiling and segmentation do not lead to automated decision-making that would have legal effects on you or similarly significant effects. No one is denied service or charged a different price on the basis of profiling.
What it is based on
The legal basis is legitimate interest: we want to understand our customer base so that we can recommend more relevant products and develop our assortment. To the extent that profiling is based on browsing data or cookies, it also requires your cookie consent. If you do not give cookie consent, this data is not collected or used.
Receiving marketing communication always requires separate consent. You can also receive the newsletter without profiling, in which case the content is not targeted to you.
What data is used
| Data category | Example |
|---|---|
| Purchase history | Products and product groups purchased, delivery and payment method |
| Basic customer data | Length of customer relationship, country and language preference |
| Interests | Product group interests derived from purchase history |
| Browsing data* | Products and product listings viewed |
| Marketing communication data** | Opens and clicks |
| Product reviews and survey responses | Reviews and responses you have given |
* Requires cookie consent. ** Requires marketing consent.
We do not obtain data for profiling from third-party registers or other external sources. Nor do we disclose individual-level profile or segment data to others.
How you can control it
You have the right to object to profiling and segmentation at any time (Article 21 GDPR) by contacting info@varusteleka.com. After you object, your data will not be used for these purposes. You can use the service normally, but content and recommendations will not be targeted to you.
You can separately block collection based on browsing data in the cookie settings.
11. Your rights
If you live in the EU or EEA, you have the following rights. They are not conditional, but in some situations the law restricts how they can be exercised, and we will always tell you if something cannot be done.
- Right of access. You are told whether we process your data and receive a copy of the data we process.
- Right to rectification. We correct inaccurate data and complete incomplete data.
- Right to erasure. We delete your data when there is no longer a basis for processing it. We cannot delete data that we are legally obliged to keep (for example accounting records) or that we need for handling a legal claim.
- Right to object to processing based on legitimate interest when you have a reason relating to your particular situation. You can always object to direct marketing, without giving a reason.
- Right to restrict processing in the situations set out in Article 18 GDPR.
- Right to data portability in a machine-readable format to the extent that processing is based on consent or contract.
- Right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
How to exercise your rights
Send your request to info@varusteleka.com. Describe what you want in enough detail for us to identify you and find the right data. We may need to verify your identity before carrying out the request.
We respond within one month. If the request is exceptionally extensive, we may extend the deadline, and we will tell you if we do.
Exercising your rights is free of charge, and we will not treat you differently because you use them.
Right to lodge a complaint
If you consider that we process your data unlawfully, you can lodge a complaint with the supervisory authority in your country. In Finland this is the Office of the Data Protection Ombudsman: visiting address Lintulahdenkuja 4, 00530 Helsinki; postal address P.O. Box 800, 00531 Helsinki; email tietosuoja@om.fi; phone +358 29 566 6700; tietosuoja.fi. We would also appreciate hearing from you, so that we can correct the error.
12. How you can control the use of your data
- Cookie settings at the bottom of the page: you can change or withdraw your cookie consent at any time
- The unsubscribe link at the end of every marketing email
- Stopping SMS marketing by replying STOP or in the way stated in the message. This stops only text messages, not email
- Email info@varusteleka.com: access, rectification, erasure, objection to profiling and other requests
Even if you withdraw your marketing permissions, we will still send messages related to your orders, such as order confirmations and delivery notifications. To contact persons of B2B and B2G customers we may also send necessary messages related to requests for quotation, negotiations, contracts, invoicing and managing the customer relationship. These messages are not used to get around a marketing opt-out.
13. Privacy rights of US residents
If you live in the United States, you may have the right under applicable state privacy law to access your personal data, request its correction or deletion, receive a portable copy of your data, and opt out of the sale of your personal data, sharing as defined in California law, and the use of your data for targeted advertising or for profiling in furtherance of certain significant decisions. Whether and to what extent these rights apply depends on the applicable law and its exemptions. You can send requests related to this policy, and any appeal of a decision on your request, to info@varusteleka.com. This section does not limit your rights under the EU General Data Protection Regulation where it applies to the processing of your personal data.
Sharing for targeted advertising. When you accept marketing cookies, your browsing data is shared with advertising partners for the purpose of targeted advertising. Under the definitions in California law this counts as "sharing" personal information. You can opt out by switching marketing cookies off in the cookie settings at the bottom of the page.
We do not sell personal information for monetary consideration. We do not knowingly sell or share the personal information of persons under 16 years of age.
You may authorise an agent to make a request on your behalf, in which case we will ask for proof of the authorisation.
14. Changes to this policy
We update this policy when our services, practices or the law change. We publish the updated policy on this page and change the update date. We will notify registered customers separately of significant changes.
Contact
Questions and requests concerning data protection: info@varusteleka.com