Privacy policy

• When you order: your name, email address, phone number, billing and delivery address, the pieces you buy, the price, VAT and delivery, and the payment status (paid, refunded). Card details are entered on the payment provider's own page and never reach us.
• If you withdraw from a purchase: your name, email address, the order and your message, with the date and time we received the notice, as proof of the withdrawal and to handle the return and refund.
• Invoices and receipts: the same order and customer details, as required for accounting.
• When you send a message, ask for a custom piece, a delivery quote or a reservation: your name, email address, phone number if you give it, your message and the piece concerned.
• Technical data: when the website is used, Google Cloud records standard server logs (time, address requested, response, browser type and IP address) to keep the service running and secure.

• To sell and deliver a piece, and to answer questions about it: performance of a contract or steps before one (GDPR Art. 6(1)(b)).
• Accounting and tax: orders, invoices and receipts are kept because the law requires it (Art. 6(1)(c); Finnish Accounting Act).
• Security and the reliability of the website: our legitimate interest in protecting the service and our customers (Art. 6(1)(f)).
• We do not use your data for advertising, we do not sell it, and we do not use analytics or tracking cookies.

The website, the database and the stored files run on Google Cloud in Finland (region europe-north1, Hamina). That is where customer data is stored.

Google may process limited operational and support data outside Finland under its data processing terms. The services below are used for specific tasks and act as our processors.

• Google Cloud (Google Cloud EMEA Ltd, Ireland): hosting, database, file storage and server logs, in Finland, and the domain's name service (Cloud DNS). Firebase Authentication handles the sign-in of Puupapat's own administrators only, not customers. Google Cloud Translation is used only to translate product descriptions, which contain no customer data.
• Paytrail Oyj (Finland): online payments. We give Paytrail the amount, the pieces ordered, the order number and your email address. You enter your bank or card details on Paytrail's or your bank's own pages; they never reach us. Paytrail is an independent controller for the payment data it processes as a payment service provider.
• Resend, Inc. (USA): sends our emails (order confirmations, invoices and receipts, confirmations of your messages and requests) from its EU region in Ireland. It receives your name and email address and the content of the email.
• Planeetta Internet Oy (Finland): registration of the domain name. No customer data is passed to it.

The email service may transfer data to the United States. Such transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses, as described in its data processing terms.

• Orders, invoices and receipts: at least six years from the end of the financial year in which they were made, as the Finnish Accounting Act requires. They cannot be deleted earlier, even on request. Withdrawal notices are kept with the order they belong to.
• Messages, custom piece requests, delivery quotes and reservations that did not lead to a purchase: deleted or anonymised 24 months after our last contact.
• Server logs: 30 days.
• The shopping cart and your language choice are kept only in your own browser.

The website uses only what it needs to work. There are no analytics, advertising or tracking cookies, so we do not ask for cookie consent.

• pp_locale (cookie, 1 year): remembers the language you chose.
• Shopping cart (browser storage on your device): the pieces you added. It is never sent to us until you order.
• __session (cookie, 8 hours): only for Puupapat's administrators when they sign in to manage the shop.

• You may ask for a copy of your data, have it corrected, or have it deleted when we no longer need to keep it.
• You may object to processing based on our legitimate interest, ask us to restrict processing, and receive the data you gave us in a machine-readable form.
• Write to the email address above. We answer within one month. We may ask you to confirm your identity first.
• You have the right to lodge a complaint with the Data Protection Ombudsman (tietosuoja.fi, Lintulahdenkuja 4, 00530 Helsinki).