top of page
1цу1_edited.png

SHELTER-SHOP.COM

Privacy Policy

Last updated: July 2026

1. Data Controller
Shelter Shop Oy (Business ID: 3625365-9) (“we”, “us”, “Shelter Shop”) is the controller of personal data processed in connection with the website shelter-shop.com and our services.

Privacy-related requests should be sent to the email address above.
 
2. Data We Collect

  • Customer and order data: name, email address, phone number, billing and delivery address, company details (for business customers), order history and correspondence.

  • Payment data: payments are handled by our payment service providers. We do not receive or store full payment card numbers.

  • Technical data: IP address, browser and device information, and server logs.

  • Marketing preferences: newsletter subscription and consent status.

Providing customer and order data is necessary to conclude and fulfil a purchase; other data is provided voluntarily.
 
3. Purposes and Legal Bases of Processing
We process personal data under the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (1050/2018) for the following purposes:

  • Processing, delivering and invoicing orders, and customer service — performance of a contract (Art. 6(1)(b) GDPR).

  • Bookkeeping, accounting and tax obligations — legal obligation (Art. 6(1)(c) GDPR).

  • Website security, fraud prevention, and improving our services — our legitimate interest (Art. 6(1)(f) GDPR) in maintaining a secure and functional service.

  • Direct marketing and newsletters — your consent (Art. 6(1)(a) GDPR). We may also send existing customers marketing about similar products based on our legitimate interest, as permitted by Finnish law; you may opt out at any time.

 
4. Cookies
We use strictly necessary cookies to operate the website. Analytics and marketing cookies are used only with your consent, which you can give, refuse or withdraw at any time through the cookie banner or your browser settings.
 
5. Recipients of Data
We share personal data only to the extent necessary with service providers acting on our behalf: payment service providers, delivery and logistics companies, IT hosting and maintenance providers, and analytics providers. These providers are bound by data processing agreements. We do not sell personal data. Data may also be disclosed where required by law or to competent authorities.
 
6. International Transfers
Personal data is processed primarily within the EU/EEA. Where a service provider processes data outside the EU/EEA, we rely on an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework) or the European Commission's Standard Contractual Clauses, together with additional safeguards where needed.
 
7. Data Retention

  • Order, invoicing and accounting data: retained for the periods required by the Finnish Accounting Act (generally 6–10 years).

  • Customer account data: while the account is active and for a reasonable period thereafter.

  • Marketing data: until you withdraw consent or opt out.

  • Technical logs: up to 12 months for security purposes.

 
8. Your Rights
Under the GDPR you have the right to:

  • access your personal data and receive a copy of it;

  • request rectification or erasure of your data;

  • request restriction of processing;

  • receive your data in a portable format (data portability);

  • object to processing based on legitimate interest, and object to direct marketing at any time;

  • withdraw consent at any time, without affecting processing carried out before withdrawal.

To exercise your rights, contact us at info@shelter-shop.com. We may need to verify your identity before responding. If you consider that our processing infringes data protection law, you may lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, www.tietosuoja.fi).
 
9. Automated Decision-Making
We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you.
 
10. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
 
11. Children
Our website and services are intended for adults and business customers. We do not knowingly collect personal data from children.
 
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in law or in our operations. The current version, with its date, is always available on this page. Material changes will be communicated where required by law.

bottom of page