Privacy Policy

1. Data Controller Identification

The entity responsible for processing personal data under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Finnish Data Protection Act (1050/2018) is:

2. Categories of Personal Data Collected

We process personal data only when strictly necessary to fulfill technical, communication, or regulatory requirements. We collect data in the following manners:

• Direct User Submissions: When you complete our contact form or communicate with us, we collect your name, email address, topic selection, and the contents of your message.
• Automated Telemetry & Device Data: When navigating our site, our hosting systems collect standard server log metrics including IP address (anonymized at ingestion), browser user-agent string, operating system, referring URL, timestamp, and requested asset paths.
• Local Preference Storage: We use browser localStorage to maintain your selected cookie choices so the consent banner is not presented repeatedly on successive page views.

3. Legal Bases for Processing Under GDPR

In accordance with Article 6 of the GDPR, we base our processing operations on the following distinct legal grounds:

• Legitimate Interests (Art. 6(1)(f) GDPR): Operating, securing, and maintaining the stability of our website servers, defending against distributed denial of service (DDoS) incidents, and diagnosing technical software errors.
• Consent (Art. 6(1)(a) GDPR): Processing any optional analytical telemetry or communication preferences where you have provided explicit affirmative consent via our cookie banner.
• Contractual Performance (Art. 6(1)(b) GDPR): Answering your inbound inquiries submitted through our contact desk regarding Nordic garment specifications or licensing.
• Legal Obligations (Art. 6(1)(c) GDPR): Complying with statutory book-keeping and data preservation mandates enforced by Finnish commercial laws.

4. Third-Party Service Processors

We engage vetted infrastructure providers to ensure site delivery. All processors operate under formal Data Processing Agreements (DPAs) that guarantee GDPR-compliant security safeguards:

• Cloud Infrastructure & Content Distribution: High-security European edge nodes providing SSL encryption, static asset caching, and network protection.
• Transactional Mail Routing: Secure SMTP relay infrastructure utilized solely to deliver user inquiries to our Helsinki office.

We do not sell, rent, or trade your personal data to commercial data brokers, advertising networks, or unauthorized third parties.

5. Your Rights Under European and International Privacy Laws

As a data subject within the European Economic Area (EEA), or under corresponding statutes such as the California Consumer Privacy Act (CCPA), you retain comprehensive rights concerning your personal information:

• Right of Access (Art. 15 GDPR): The right to request confirmation as to whether your personal data is processed and to receive an intelligible copy thereof.
• Right to Rectification (Art. 16 GDPR): The right to have inaccurate or incomplete data updated promptly.
• Right to Erasure / Right to be Forgotten (Art. 17 GDPR): The right to obtain deletion of your personal records where grounds for continued processing no longer apply.
• Right to Restriction of Processing (Art. 18 GDPR): The right to pause active processing pending dispute resolutions.
• Right to Data Portability (Art. 20 GDPR): The right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21 GDPR): The right to object at any time to processing based on legitimate interests.

To exercise any of these rights, submit your signed request directly to our Data Protection Officer at [email protected]. We respond to all verified requests within thirty (30) calendar days without charge.

6. Data Retention Protocols

Server access log entries are held for a rolling duration of thirty (30) days for diagnostic security auditing and then irreversibly purged. Direct email communications submitted through our contact desk are retained for up to twelve (12) months after case resolution, unless continuous retention is legally mandated by Finnish fiscal regulations.

7. Supervisory Authority Oversight

If you believe that our handling of your personal information infringes on current European privacy legislation, you have the right to lodge a formal complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto):

Office of the Data Protection Ombudsman
Lintulahdenkuja 4, 00530 Helsinki, Finland
Website: tietosuoja.fi/en