Privacy Policy

Acnova Oy — Tuusula, Suomi

This Privacy Policy describes how Acnova Oy processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and Finnish data protection legislation.

We may process the following categories of data:

• First and last name

• Company name

• Email address

• Phone number

• Shipping and billing address

• Order data

• Purchase history

• Messages sent via forms or chat

• Analytics data (where consent is given)

• IP address (hashed for cookie consent logging)

We process personal data on the following legal bases:

• Performance of a contract (orders, delivery, payments)

• Legal obligation (accounting and tax compliance)

• Legitimate interest (website security, fraud prevention)

• Consent (analytics, marketing, cookies)

We use Google Analytics 4 to analyze website usage. Analytics is enabled only after user consent. Before consent, analytics cookies are not loaded. Google Consent Mode v2 is used.

Cookie consent logs are stored for 365 days in a protected form (IP and User-Agent are hashed using a salt).

Provider:

Google Ireland Limited.

Payments are processed via Stripe and Paytrail. Payment providers act as independent data controllers with respect to payment information.

We use delivery services including PostNord. Personal data is shared only to the extent necessary to deliver your order.

Service and transactional messages. When you place an order, we send you the messages needed to fulfil it — order confirmation, proforma invoice, invoice, payment notification and credit note. We send these on the basis of the performance of our contract with you (Article 6(1)(b) GDPR) and to comply with our legal obligations, including bookkeeping (Article 6(1)(c) GDPR). These are not marketing, they do not require your separate consent, and they cannot be switched off for as long as your order is active.

Marketing messages. Newsletters, offers and reminders about an order you have not completed (abandoned cart) are sent only on the basis of the consent you give at checkout, or under the provisions on direct marketing to existing customers in the Finnish Act on Electronic Communications Services (Laki sähköisen viestinnän palveluista 917/2014, section 200). Every marketing message includes a one-click unsubscribe link, and once you unsubscribe we will not send you any further marketing. Our emails are delivered via Google Workspace.

After your order has been delivered, we may also thank you and invite you to leave a review of your purchase (including through our review partner Trustpilot). These e-mails are sent on the same basis — direct marketing to existing customers (§ 200) — and, like all marketing messages, contain a one-click unsubscribe link.

We use the Trustpilot service (Trustpilot A/S, Denmark, EU) to collect reviews. On our behalf, your name, e-mail address and order contents are shared with it in order to send you an invitation to leave a review. Trustpilot acts as a data processor under a data processing agreement; Acnova Oy remains the data controller.

We may use WhatsApp Business API (Meta) for communications. Data may be transferred outside the EU in accordance with GDPR transfer mechanisms.

We use Odoo LiveChat to handle user inquiries.

Google reCAPTCHA is used to protect forms.

The website may contain embedded content (YouTube, maps) which may collect data when you interact with it.

Use of Cloudflare (CDN and site protection)

Our website uses Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) as a reverse proxy, content delivery network (CDN), web application firewall (WAF) and protection against DDoS attacks and malicious bots. All traffic between your device and our website passes through Cloudflare's network.

As our sub-processor, Cloudflare processes the visitor's IP address, request metadata (including the page address, browser type and version, referrer and request headers) and Cloudflare's technical cookies. Because Cloudflare acts as a reverse proxy and terminates the encrypted (TLS) connection, the content of the traffic is technically accessible to Cloudflare at the moment of processing. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in the security, availability and performance of the website.

Processing takes place across Cloudflare's global network, including servers in the United States, which constitutes a transfer of personal data outside the EEA. The transfer relies on the European Commission's Standard Contractual Clauses (SCCs) incorporated into Cloudflare's Data Processing Addendum (DPA), with supplementary measures; in addition, Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. More information: https://www.cloudflare.com/cloudflare-customer-dpa/ ; https://www.cloudflare.com/gdpr/subprocessors/ ; https://www.cloudflare.com/privacypolicy/ .

Order data is retained for periods required by accounting and tax laws. Marketing data is retained until consent is withdrawn. Cookie consent logs are retained for 365 days.

Some service providers may process data outside the EU. Transfers are based on Standard Contractual Clauses and the EU–US Data Privacy Framework (where applicable).

You have the right to:

• Access your personal data

• Request rectification

• Request erasure

• Restrict processing

• Withdraw consent

• Lodge a complaint with the Finnish Data Protection Ombudsman

Acnova Oy

Email:

[email protected]

Phone:

+358 9 424 513 15