Privacy policy

1. Controller

VilkenJävlaCirkus Oy / Haimoo Roastery
Business ID: 3096454-8
Haimoontie 248, 03400 Vihti
Phone: 044 980 5623
Email: hello@haimooroastery.fi

2. Person responsible for the register

Same as in section 1.

3. Contact person for data protection matters

Omid Rokhsatzadeh, contact details as in section 1.

4. Name of the register

Customer register of the Haimoo Roastery online shop.

5. Purpose of the register

We use your data for the following:

• processing, payment and delivery of orders
• managing and billing subscriptions (for example a coffee subscription)
• customer service and order messages
• newsletter and other email marketing, including abandoned cart reminders and messages based on purchase history
• improving the shop and visitor statistics
• accounting and other legal obligations

6. Legal basis for processing

Processing, payment and delivery of your order are based on our contract with you. Accounting is based on law.

The newsletter is based on your consent, which you give by ticking the newsletter box at checkout. When you create a customer account, your email address is added to the newsletter list automatically. You can unsubscribe at any time using the link at the end of every message.

Abandoned cart reminders, messages based on purchase history, visitor statistics and fraud prevention are based on our legitimate interest in keeping in touch with our customers and keeping the shop running. You can object to this processing, see section 14.

7. Data content of the register

• basic details: name, email, phone number, delivery and billing address
• order and payment details: products ordered, amounts, payment method, delivery method and pickup point, subscription product and billing period. We do not see or store your card number, it goes directly to Stripe
• customer account details: username and encrypted password, order history
• newsletter details: email, name, subscription status and purchase history
• cart contents and IP address, if you started a purchase but did not pay
• visitor statistics: page address, referring page, campaign parameters, country and city, browser and device type. The IP address is not stored
• feedback and customer service messages

We do not collect sensitive data.

8. Data retention period

We keep order and payment details for six years from the end of the financial year, as required by the Accounting Act. This cannot be shortened on request.

We keep customer account details until you ask for the account to be deleted. Order history is kept for the period required by the Accounting Act even after the account is deleted.

We keep newsletter details until you unsubscribe. An unsubscribed address stays on a block list so that messages are not sent to it again by mistake.

We keep abandoned cart details until the purchase is completed or you ask for them to be deleted.

Visitor statistics are pseudonymous, and their identifier changes daily. We keep the statistics for three years, after which they are deleted automatically.

Once the retention period ends, the data is deleted.

9. Regular sources of data

We get the data from you: when you order, create a customer account, subscribe to the newsletter and contact customer service.

In addition, data is collected from use of the shop in two ways:

• Haimoo Analytics is our own visitor statistics tool. It does not use cookies or store your IP address. The country and city and a daily changing identifier are derived from the IP address, after which the address is discarded.
• Sender.net's tracking script collects data on page loads and links them to the newsletter subscriber with a cookie. See section 11.

We do not obtain data from other sources.

10. Disclosure of data and transfers outside the EU or EEA

We do not sell or disclose your data to third parties for their own use. The services listed below process data on our behalf and according to our instructions. We disclose data to authorities only when required by law.

Payments: Stripe. When you pay by card, Apple Pay or Google Pay, the payment is processed by Stripe. Stripe receives your name, email, billing address and purchase amount. You give your card details directly to Stripe. For subscriptions, Stripe handles the recurring charge and the subscription management page, and calculates VAT. If you wish, you can save your card with Stripe for your next purchase. Our contracting partner is Stripe Payments Europe, Limited (Ireland). Data is also processed by Stripe, LLC in the United States on the basis of the EU–US Data Privacy Framework and, secondarily, the EU standard contractual clauses.

Checkout human check: Cloudflare Turnstile. When you place an order, the checkout uses Cloudflare Turnstile to check that the buyer is a person and not an automated program. This is how we stop payment attempts made with stolen cards. Cloudflare receives your IP address and technical details of your browser, but not your name, address or the contents of your order. Our contracting party is Cloudflare, Inc. (United States); the transfer to the United States is based on the EU–US Data Privacy Framework.

Newsletter and emails: Sender.net. Our newsletter list is on Sender.net. Your name and email go there when you subscribe to the newsletter or create a customer account. Sender.net also receives the basic details of your orders (name, email, phone, city, postcode, country, payment method and amounts) and abandoned cart details (email, products and IP address). We use these to send abandoned cart reminders and messages based on purchase history. Subscription welcome and cancellation messages are sent through Sender.net; they include your first name, email, product, price and management link. Sender.net (UAB Sender.lt) is a Lithuanian company, and subscriber data is stored in the EU.

Delivery: Shipit and carriers. Shipit and the carrier you choose (PostNord, Matkahuolto or Posti) receive your name, address, phone number, email and pickup point. Your phone number is used for the arrival notification. Location: Finland and the Nordic countries.

Printed products: Printful. Some products, such as clothing, are printed to order and shipped directly from the manufacturer. Printful receives your name, delivery address, phone number and email. Our contracting partner is Printful, Inc. (United States); for EU matters the contact is AS Printful Latvia (Riga). Transfers to the United States are based on the European Commission's standard contractual clauses.

Product listings on Google: Google Merchant Center. Our products appear in Google search results. Only product data is sent to Google, no customer data. Our website has no Google tracking or advertising tags.

Page translation: Google Translate. If you change the page language, the page content is sent from your browser to Google for translation. Google Ireland Ltd; transfers to the United States are based on the EU–US Data Privacy Framework.

Visitor statistics: Haimoo Analytics. Our own statistics tool, see section 9. Location: Finland.

Server: Hetzner. The online shop and customer register are hosted in Hetzner's data centre in Helsinki.

Email: Domainhotelli. Order confirmations and customer service emails pass through Domainhotelli's email server in Finland.

Our suppliers do not receive customer data.

Most data is processed in the EU. Stripe, Google, Printful and Cloudflare may also process data in the United States. Stripe's, Google's and Cloudflare's transfers are based on the EU–US Data Privacy Framework, and Printful's transfers on the European Commission's standard contractual clauses.

11. Use of cookies

The website has no cookie banner. Instead, we tell you here exactly which cookies are set.

Essential (WooCommerce and Stripe). Cart, login and checkout. Stripe sets its own cookies for payments, express checkout and fraud prevention. The shop does not work without them.

Sender.net. Sender.net's tracking script loads on every page and sets a cookie that links page visits to the newsletter subscriber.

Google Translate. Sets a cookie only if you choose another language for the page. The cookie remembers your choice.

Haimoo Analytics does not set cookies. It uses the browser's session storage (sessionStorage) for the duration of one visit and respects the browser's Do Not Track setting.

You can block or delete cookies in your browser settings (usually under Privacy or Cookies). You can block the Sender.net cookie by blocking the address sender.net in your browser or with an ad blocker. If you block all cookies, the cart and checkout will not work.

12. Security of the register

The online shop and customer register are hosted in Hetzner's data centre in Helsinki. The connection to the website is encrypted (HTTPS). Only people whose work requires it can access the register, with a personal username and password. Login attempts are limited. We do not store payment card details at all.

13. Automated decision-making

We do not make automated decisions that would have significant effects on you (Article 22 of the GDPR). Emails based on purchase history only choose which message is sent to you.

14. Your rights

You have the right to

• see what data has been stored about you
• ask for incorrect data to be corrected
• ask for your data to be deleted, except for accounting records required by law
• restrict or object to processing, including cart reminders and messages based on purchase history
• unsubscribe from the newsletter at any time using the link at the end of the message
• receive your data in a machine-readable format for transfer to another service
• lodge a complaint with the Data Protection Ombudsman (tietosuoja.fi) if you believe we are processing your data incorrectly

Requests should be sent by email to the address in section 1. We will reply within one month at the latest. If we cannot carry out a request, we will tell you why.