Privacy Policy

Acnova Oy — Tuusula, Suomi

This Privacy Policy describes how Acnova Oy processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and Finnish data protection legislation.

Where our systems are hosted. Acnova's application infrastructure and persistent application data (customer accounts, orders, invoices, uploaded documents and backup copies) are hosted in Helsinki, Finland (EU). acnova.eu is delivered through Cloudflare's global network, which acts as our reverse proxy and security layer (see the part on Cloudflare in section 11 and section 13). A plain-language overview of what is and is not processed in Finland is available at acnova.eu/data-residency.

We may process the following categories of data:

• First and last name

• Company name

• Email address

• Phone number

• Shipping and billing address

• Order data

• Purchase history

• Messages sent via forms or chat

• Analytics data (where consent is given)

• Data for advertising in Meta services (if you consent to marketing, see section 4): page and product views, additions to the cart, orders placed and form submissions, identifiers from the pixel cookies, IP address and browser information

• IP address (to protect the website and forms against spam and bots, see sections 10 and 11; in the cookie consent log only in hashed form)

We process personal data on the following legal bases:

• Performance of a contract (orders, delivery, payments)

• Legal obligation (accounting and tax compliance)

• Legitimate interest (website security, fraud prevention)

• Consent (analytics, marketing including the Meta Pixel, cookies); you can withdraw it at any time via the “Cookie settings” link in the website footer

We use Google Analytics 4 to analyze website usage. Analytics is enabled only after user consent. Before consent, analytics cookies are not loaded. Google Consent Mode v2 is used.

Cookie consent logs are stored for 365 days in a protected form (IP and User-Agent are hashed using a salt).

Provider:

Google Ireland Limited.

If you consent to analytics, Acnova’s server may itself send Google Analytics the fact that an order has been paid (the order or invoice number, the amount and the products), linked to your browser’s Google Analytics identifier. For this purpose, when you proceed to payment, we may store this identifier for no longer than 30 days; it is deleted once the data has been sent or it has been decided not to send it. Without consent to analytics, this is not sent. So that a purchase is not sent after you withdraw your consent to analytics, the consent cookie may contain a random number for your decision that contains no information about you; in that case, the number is stored in the cookie consent log together with the decision itself.

Meta Pixel

If you have switched on “Marketing” in the cookie banner or accepted all cookies, the Meta Pixel, a tool of Meta Platforms Ireland Limited, runs on the website. We use it to measure the effectiveness of our advertising in Meta services (for example Facebook and Instagram) and to show Acnova ads to people who have visited our website (retargeting).

Until you give your consent, no Meta code is loaded, no data is sent to Meta and no pixel cookies are set. If you have not given consent but pixel cookies or pixel entries in browser storage remain on your device from earlier visits, the website deletes them.

The pixel sends the following events to Meta:

• page view

• product page view: public item number, product name, price excluding VAT and currency (the price only if it is shown to you)

• adding a product to the cart: public item number, product name, quantity, amount excluding VAT and currency

• successful submission of a form on the website (for example the contact form or a PRO account request): only the type of form, without the data you entered

• placing an order (once payment is confirmed or an order to be paid by invoice is created): public item numbers and quantities of the products, total number of items, amount excluding VAT and currency, and the order or invoice number — only as a technical event identifier, so that one purchase is not counted twice

With each event, Meta receives, in particular, the pixel ID, the address of the page and of the page you came from, the time of the event, the screen size, the values of the _fbp and _fbc cookies and — as with any request from your browser to a server — your IP address and browser information. Meta may match this data with your Meta account, if you have one.

Your name, email address, phone number and postal address are not sent to Meta: advanced matching is not used, and the pixel’s automatic collection of data from pages is switched off. Internal reference numbers are not sent to Meta either: only public item numbers and the order or invoice number.

The _fbp and _fbc pixel cookies are stored on your device for 90 days from the last update. The Meta script may also save its own technical entries in browser storage (localStorage) under the acnova.eu domain — multiFbc, lastExternalReferrer and lastExternalReferrerTime: for example, which site you came from (Facebook, Instagram, another site or none) and when, and information about a click on a Meta ad link. Meta may receive this information together with the pixel events. Like the pixel cookies, these entries are created only with your consent to “Marketing”; if you refuse or withdraw consent, the website deletes them together with the _fbp and _fbc cookies. Details about the pixel’s cookies and entries, and about when the pixel sends no events, are in our Cookie Policy.

We and Meta Platforms Ireland Limited are jointly responsible (joint controllers under Article 26 GDPR) for collecting data through the pixel on our website and transmitting it to Meta. Under our agreement with Meta, we inform you about this processing and obtain your consent, while Meta ensures your rights regarding the data that Meta stores after the transmission. You can exercise your rights with us or with Meta. The essence of the agreement: facebook.com/legal/controller_addendum.

Meta further processes this data as an independent controller under its own privacy policy: facebook.com/privacy/policy. Meta retains the data received through the pixel under its own rules. Meta may transfer this data outside the EEA, including to the United States — see section 13.

Legal basis: Art. 6(1)(a) GDPR — consent. Storing and reading the pixel cookies on your device also requires your consent under section 205 of the Finnish Act on Electronic Communications Services (917/2014).

You can withdraw your consent at any time: click the “Cookie settings” link in the website footer, switch off “Marketing” and save your choice. The Meta Pixel then immediately stops sending data and is no longer loaded, and the website deletes the pixel cookies (_fbp, _fbc) and the pixel’s entries in browser storage from your device. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Payments are processed via Stripe and Paytrail. Payment providers act as independent data controllers with respect to payment information.

To deliver your order, we share the recipient's details with the chosen carrier: name, delivery address or pickup point, email and phone number.

To whom. The carriers we use are Shipit Oy Ab, PostNord Oy. They act as data processors on our behalf and use the data solely for delivery and its notifications (e.g. an SMS «your parcel is ready for pickup»).

Legal basis. Art. 6(1)(b) GDPR — the processing is necessary to perform the order contract. No separate consent is required.

How long. Contact details (email, phone) are removed from the order when you request deletion of your account. The recipient's name and delivery address are kept for the statutory accounting retention period, as they are part of the record chain of the fulfilled order (Art. 17(3)(b) GDPR).

Service and transactional messages. When you place an order, we send you the messages needed to fulfil it — order confirmation, proforma invoice, invoice, payment notification and credit note. We send these on the basis of the performance of our contract with you (Article 6(1)(b) GDPR) and to comply with our legal obligations, including bookkeeping (Article 6(1)(c) GDPR). These are not marketing, they do not require your separate consent, and they cannot be switched off for as long as your order is active.

Marketing messages. Newsletters, offers and reminders about an order you have not completed (abandoned cart) are sent only on the basis of the consent you give at checkout, or under the provisions on direct marketing to existing customers in the Finnish Act on Electronic Communications Services (Laki sähköisen viestinnän palveluista 917/2014, section 200). Every marketing message includes a one-click unsubscribe link, and once you unsubscribe we will not send you any further marketing. Our emails are delivered via Google Workspace.

After your order has been delivered, we may also thank you and invite you to leave a review of your purchase (including through our review partner Trustpilot). These e-mails are sent on the same basis — direct marketing to existing customers (§ 200) — and, like all marketing messages, contain a one-click unsubscribe link.

We use the Trustpilot service (Trustpilot A/S, Denmark, EU) to collect reviews. On our behalf, your name, e-mail address and order contents are shared with it in order to send you an invitation to leave a review. Trustpilot acts as a data processor under a data processing agreement; Acnova Oy remains the data controller.

We use the WhatsApp Business API (Meta) and Telegram for contact. In both channels you are answered by the AI assistant Hanna — see section 9. Data may be transferred outside the EEA, see section 13.

In the chat on our website, as well as on WhatsApp and Telegram, you are talking to Hanna — an AI assistant of Acnova Oy. This is not a human. We say so in the very first message and in the chat header. You can ask for a human colleague at any time — just say so: the conversation is handed to a person, and Hanna stops.

What is processed. The text of your messages and earlier messages in the same conversation; files you attach yourself; your interface language and the page you wrote from. Name, email and, if needed, phone — only what you give us yourself.

Why and on what basis. Solely to answer your question and handle your request. The legal basis is Art. 6(1)(b) GDPR — steps taken at your own request before a contract. No separate consent is required or collected for this. The newsletter is a separate matter: it is sent only on separate consent confirmed by a link in an email.

Who else sees the conversation. For Hanna to answer, the text of the conversation is passed to our AI model provider — Anthropic PBC, which acts as our sub-processor under a data processing agreement. Acnova Oy remains the controller of your data. Processing takes place in the United States; the transfer is based on the European Commission's Standard Contractual Clauses (SCC) — see section 13 for details. Under the provider's terms, your conversation is not used to train its models.

What the model never sees. Enquiries about health — a skin reaction, a burn, a rash, seeing a doctor — are never passed to the external model at all: a human takes over immediately. This is special-category data (Art. 9 GDPR), and we chose not to send it out even for a second.

How long we keep it. We keep the conversation for as long as it is needed to handle your request. If an order or invoice grows out of the conversation, that data falls under the periods in section 12.

How to delete it. Write to [email protected] — we will delete your contact details and scrub them from the conversation text without undue delay, and in any case within a month (Art. 12(3) GDPR). The conversation itself may remain in anonymised form — without your name, email or phone. We also keep a record of what was shown to you and what you answered (Art. 7(1) GDPR): that is our obligation, and your contact details have been removed from it.

If you have an account, you can do the same yourself: the "My data" section shows exactly what we hold about you, until when we must keep it, and has a button to request erasure.

We do not use Google reCAPTCHA or any other third-party CAPTCHA to protect our forms, and we do not load third-party scripts for this purpose: the checks are carried out on our own servers. Separately, all traffic to the website passes through Cloudflare, which protects the website against malicious bots and may in some cases show a security check (see section 11 and our Cookie Policy).

To protect our forms, we use, depending on the form:

• a hidden field that people do not see and leave empty

• a signed timestamp that the server issues when the form is opened (it contains no personal data): it is used to check that the form was not sent faster than a person could have filled it in

• a limit on the number of submissions from one IP address: currently no more than 8 submissions within 10 minutes

The only personal data used for this protection is your IP address, which we use to count submissions. A form rejected as spam is not saved; information about the rejection, including the IP address, may be recorded in our technical log. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in the security of the website.

The submission counter is kept only briefly. For some forms, it stores not the IP address itself but a hash of it calculated using a salt, and entries older than one day are deleted automatically every day. For other forms, the counter is kept in temporary memory and deletes itself after 10 minutes.

Some pages of the website — for example the home page, the contact page and the “Pickup locations” and “Find a Specialist” pages — contain embedded Google Maps. A map is loaded only if you have switched on “Maps (Google Maps)” in the cookie banner or accepted all cookies, or once, if you click the “Show map” button on a particular page; until then, your browser does not contact Google for the map. When a map is loaded, Google receives your IP address, information about your browser and device and the address of the page in which the map is embedded, and may set or read its own cookies under its domains. The legal basis is your consent (Art. 6(1)(a) GDPR). For details, see our Cookie Policy.

Use of Cloudflare (CDN and site protection)

Our website uses Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) as a reverse proxy, content delivery network (CDN), web application firewall (WAF) and protection against DDoS attacks and malicious bots. All traffic between your device and our website passes through Cloudflare's network.

As our sub-processor, Cloudflare processes the visitor's IP address, request metadata (including the page address, browser type and version, referrer and request headers) and Cloudflare's technical cookies. Because Cloudflare acts as a reverse proxy and terminates the encrypted (TLS) connection, the content of the traffic is technically accessible to Cloudflare at the moment of processing. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in the security, availability and performance of the website.

Processing takes place across Cloudflare's global network, including servers in the United States, which constitutes a transfer of personal data outside the EEA. The transfer relies on the European Commission's Standard Contractual Clauses (SCCs) incorporated into Cloudflare's Data Processing Addendum (DPA), with supplementary measures; in addition, Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. More information: https://www.cloudflare.com/cloudflare-customer-dpa/ ; https://www.cloudflare.com/gdpr/subprocessors/ ; https://www.cloudflare.com/privacypolicy/ .

Accounting data — 10 years. We keep orders, invoices, payments and related documents for 10 years from the end of the financial year in which the document arose. Each group company acts as controller for its own clients' documents: Acnova Oy for the invoices and orders of its own (Finnish and other) clients, YDE Areal Est OÜ for the invoices and orders of its own Estonian clients. The same retention period applies to both companies' documents.

The law requires less: the Finnish Accounting Act (kirjanpitolaki 1336/1997, ch. 2 § 10) requires 10 years for accounting books and 6 years for source documents; the Estonian Accounting Act (raamatupidamise seadus § 12) requires at least 7 years. We deliberately chose one common, longer period — it is simpler, and it guarantees we never delete what we are required to keep.

While the period runs, we cannot delete these records on request — this is expressly provided for by Art. 17(3)(b) GDPR (processing is necessary for compliance with our legal obligation). But their processing is restricted (Art. 18 GDPR): such records are excluded from marketing, analytics and recommendations and exist only for legal purposes. Once the period expires, they are deleted in the normal way. You can check the exact date for your own data yourself, in your account under "My data".

Everything else. Marketing data — until consent is withdrawn. Cookie consent logs — 365 days. Chat conversations — see section 9.

Technical website data. In the cookie consent logs, the IP address and browser data are stored only in hashed form; entries older than 365 days are deleted automatically every day. Entries of the form submission counter (section 10) older than one day are also deleted automatically every day, and for some forms the entry deletes itself after 10 minutes. Meta Pixel cookies (_fbp, _fbc) are stored on your device for 90 days from the last update; Meta retains the data received through the pixel under its own rules (section 4).

Some of our providers process data outside the EEA. We name them directly so you know who is involved:

— Anthropic PBC (USA) — the AI model behind the assistant Hanna. The text of the conversation and any files you attach are transferred (section 9). — Cloudflare, Inc. (USA) — website protection and delivery. Exactly what is transferred and on what basis is detailed in section 11. — WhatsApp / Meta — conversations in the WhatsApp channel (section 8). — Meta Platforms Ireland Limited / Meta Platforms, Inc. (USA) — the Meta Pixel, if you have consented to marketing (section 4). Meta Platforms Ireland Limited, as an independent controller, transfers the data to Meta Platforms, Inc. in the USA; according to Meta, this transfer is based on the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses (SCC). — Google Ireland Limited — analytics, email service and maps (sections 4, 7, 11); within the Google group, data may be processed outside the EEA.

Basis for transfer: the European Commission's Standard Contractual Clauses (SCC), included in the data processing agreements with our providers; where applicable, a provider's certification under the EU-U.S. Data Privacy Framework applies additionally.

You may request a copy of the safeguards applied (the transfer contract terms) from us at [email protected] — we are required to provide it (Art. 13(1)(f) and Art. 15(2) GDPR).

This does not apply to transfers within the Meta group for the pixel: they are carried out by Meta itself as an independent controller, which applies the safeguards itself, so we do not hold copies of them. Information about them is in Meta’s privacy policy: facebook.com/privacy/policy.

You have the right to:

• Access your personal data

• Request rectification

• Request erasure

• Restrict processing

• Withdraw consent

• Lodge a complaint with the Finnish Data Protection Ombudsman

Acnova Oy

Email:

[email protected]

Phone:

+358 9 424 513 15