Privacy Policy

Acnova Oy — Tuusula, Suomi

This Privacy Policy describes how Acnova Oy processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and Finnish data protection legislation.

We may process the following categories of data:

• First and last name

• Company name

• Email address

• Phone number

• Shipping and billing address

• Order data

• Purchase history

• Messages sent via forms or chat

• Analytics data (where consent is given)

• IP address (hashed for cookie consent logging)

We process personal data on the following legal bases:

• Performance of a contract (orders, delivery, payments)

• Legal obligation (accounting and tax compliance)

• Legitimate interest (website security, fraud prevention)

• Consent (analytics, marketing, cookies)

We use Google Analytics 4 to analyze website usage. Analytics is enabled only after user consent. Before consent, analytics cookies are not loaded. Google Consent Mode v2 is used.

Cookie consent logs are stored for 365 days in a protected form (IP and User-Agent are hashed using a salt).

Provider:

Google Ireland Limited.

Payments are processed via Stripe and Paytrail. Payment providers act as independent data controllers with respect to payment information.

To deliver your order, we share the recipient's details with the chosen carrier: name, delivery address or pickup point, email and phone number.

To whom. The carriers we use are Shipit Oy Ab, PostNord Oy. They act as data processors on our behalf and use the data solely for delivery and its notifications (e.g. an SMS «your parcel is ready for pickup»).

Legal basis. Art. 6(1)(b) GDPR — the processing is necessary to perform the order contract. No separate consent is required.

How long. Contact details (email, phone) are removed from the order when you request deletion of your account. The recipient's name and delivery address are kept for the statutory accounting retention period, as they are part of the record chain of the fulfilled order (Art. 17(3)(b) GDPR).

Service and transactional messages. When you place an order, we send you the messages needed to fulfil it — order confirmation, proforma invoice, invoice, payment notification and credit note. We send these on the basis of the performance of our contract with you (Article 6(1)(b) GDPR) and to comply with our legal obligations, including bookkeeping (Article 6(1)(c) GDPR). These are not marketing, they do not require your separate consent, and they cannot be switched off for as long as your order is active.

Marketing messages. Newsletters, offers and reminders about an order you have not completed (abandoned cart) are sent only on the basis of the consent you give at checkout, or under the provisions on direct marketing to existing customers in the Finnish Act on Electronic Communications Services (Laki sähköisen viestinnän palveluista 917/2014, section 200). Every marketing message includes a one-click unsubscribe link, and once you unsubscribe we will not send you any further marketing. Our emails are delivered via Google Workspace.

After your order has been delivered, we may also thank you and invite you to leave a review of your purchase (including through our review partner Trustpilot). These e-mails are sent on the same basis — direct marketing to existing customers (§ 200) — and, like all marketing messages, contain a one-click unsubscribe link.

We use the Trustpilot service (Trustpilot A/S, Denmark, EU) to collect reviews. On our behalf, your name, e-mail address and order contents are shared with it in order to send you an invitation to leave a review. Trustpilot acts as a data processor under a data processing agreement; Acnova Oy remains the data controller.

We use the WhatsApp Business API (Meta) and Telegram for contact. In both channels you are answered by the AI assistant Hanna — see section 9. Data may be transferred outside the EEA, see section 13.

In the chat on our website, as well as on WhatsApp and Telegram, you are talking to Hanna — an AI assistant of Acnova Oy. This is not a human. We say so in the very first message and in the chat header. You can ask for a human colleague at any time — just say so: the conversation is handed to a person, and Hanna stops.

What is processed. The text of your messages and earlier messages in the same conversation; files you attach yourself; your interface language and the page you wrote from. Name, email and, if needed, phone — only what you give us yourself.

Why and on what basis. Solely to answer your question and handle your request. The legal basis is Art. 6(1)(b) GDPR — steps taken at your own request before a contract. No separate consent is required or collected for this. The newsletter is a separate matter: it is sent only on separate consent confirmed by a link in an email.

Who else sees the conversation. For Hanna to answer, the text of the conversation is passed to our AI model provider — Anthropic PBC, which acts as our sub-processor under a data processing agreement. Acnova Oy remains the controller of your data. Processing takes place in the United States; the transfer is based on the European Commission's Standard Contractual Clauses (SCC) — see section 13 for details. Under the provider's terms, your conversation is not used to train its models.

What the model never sees. Enquiries about health — a skin reaction, a burn, a rash, seeing a doctor — are never passed to the external model at all: a human takes over immediately. This is special-category data (Art. 9 GDPR), and we chose not to send it out even for a second.

How long we keep it. We keep the conversation for as long as it is needed to handle your request. If an order or invoice grows out of the conversation, that data falls under the periods in section 12.

How to delete it. Write to [email protected] — we will delete your contact details and scrub them from the conversation text without undue delay, and in any case within a month (Art. 12(3) GDPR). The conversation itself may remain in anonymised form — without your name, email or phone. We also keep a record of what was shown to you and what you answered (Art. 7(1) GDPR): that is our obligation, and your contact details have been removed from it.

If you have an account, you can do the same yourself: the "My data" section shows exactly what we hold about you, until when we must keep it, and has a button to request erasure.

Google reCAPTCHA is used to protect forms.

The website may contain embedded content (YouTube, maps) which may collect data when you interact with it.

Use of Cloudflare (CDN and site protection)

Our website uses Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) as a reverse proxy, content delivery network (CDN), web application firewall (WAF) and protection against DDoS attacks and malicious bots. All traffic between your device and our website passes through Cloudflare's network.

As our sub-processor, Cloudflare processes the visitor's IP address, request metadata (including the page address, browser type and version, referrer and request headers) and Cloudflare's technical cookies. Because Cloudflare acts as a reverse proxy and terminates the encrypted (TLS) connection, the content of the traffic is technically accessible to Cloudflare at the moment of processing. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in the security, availability and performance of the website.

Processing takes place across Cloudflare's global network, including servers in the United States, which constitutes a transfer of personal data outside the EEA. The transfer relies on the European Commission's Standard Contractual Clauses (SCCs) incorporated into Cloudflare's Data Processing Addendum (DPA), with supplementary measures; in addition, Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. More information: https://www.cloudflare.com/cloudflare-customer-dpa/ ; https://www.cloudflare.com/gdpr/subprocessors/ ; https://www.cloudflare.com/privacypolicy/ .

Accounting data — 10 years. We keep orders, invoices, payments and related documents for 10 years from the end of the financial year in which the document arose. Each group company acts as controller for its own clients' documents: Acnova Oy for the invoices and orders of its own (Finnish and other) clients, YDE Areal Est OÜ for the invoices and orders of its own Estonian clients. The same retention period applies to both companies' documents.

The law requires less: the Finnish Accounting Act (kirjanpitolaki 1336/1997, ch. 2 § 10) requires 10 years for accounting books and 6 years for source documents; the Estonian Accounting Act (raamatupidamise seadus § 12) requires at least 7 years. We deliberately chose one common, longer period — it is simpler, and it guarantees we never delete what we are required to keep.

While the period runs, we cannot delete these records on request — this is expressly provided for by Art. 17(3)(b) GDPR (processing is necessary for compliance with our legal obligation). But their processing is restricted (Art. 18 GDPR): such records are excluded from marketing, analytics and recommendations and exist only for legal purposes. Once the period expires, they are deleted in the normal way. You can check the exact date for your own data yourself, in your account under "My data".

Everything else. Marketing data — until consent is withdrawn. Cookie consent logs — 365 days. Chat conversations — see section 9.

Some of our providers process data outside the EEA. We name them directly so you know who is involved:

— Anthropic PBC (USA) — the AI model behind the assistant Hanna. The text of the conversation and any files you attach are transferred (section 9). — Cloudflare, Inc. (USA) — website protection and delivery. Exactly what is transferred and on what basis is detailed in section 11. — WhatsApp / Meta — conversations in the WhatsApp channel (section 8). — Google Ireland Limited — analytics and email service (sections 4, 7); within the Google group, data may be processed outside the EEA.

Basis for transfer: the European Commission's Standard Contractual Clauses (SCC), included in the data processing agreements with our providers; where applicable, a provider's certification under the EU-U.S. Data Privacy Framework applies additionally.

You may request a copy of the safeguards applied (the transfer contract terms) from us at [email protected] — we are required to provide it (Art. 13(1)(f) and Art. 15(2) GDPR).

You have the right to:

• Access your personal data

• Request rectification

• Request erasure

• Restrict processing

• Withdraw consent

• Lodge a complaint with the Finnish Data Protection Ombudsman

Acnova Oy

Email:

[email protected]

Phone:

+358 9 424 513 15