Privacy policy

Privacy policy

Summary

Finnsvala Oy processes your personal data when you shop in the svala.com online store or at our factory shop, subscribe to our newsletter, contact customer service or use our website. The key points are set out below. You can find more detailed information in the sections of this policy.

1. Controller and contact details

The controller is Finnsvala Oy (Business ID 0764063-3), Paanutie 4, 86710 Kärsämäki, Finland.

Questions and requests about data protection: email info@svala.com, phone +358 8 770 080, postal address Finnsvala Oy, Paanutie 4, 86710 Kärsämäki, Finland.

We have not appointed a data protection officer.

This policy covers the svala.com online store, the point-of-sale system at our factory shop in Kärsämäki, customer service, our social media channels and giveaways, business customers and retailers, and influencer and affiliate partnerships. 

2. Whose data we process and where we get it

We process the data of the following people:

• customers of the online store and the factory shop
• subscribers to the newsletter and other marketing messages
• users of the website and the mobile app
• people who contact customer service
• people who respond to customer surveys and write reviews
• participants in giveaways and campaigns
• contact persons of business customers and retailers
• influencer and affiliate partners

We mainly get the data directly from you when you place an order, subscribe to the newsletter, contact us or respond to a survey.

Some data is generated automatically when you use the website or the app. This includes, for example, cookie identifiers, IP address, device information and which pages you view. The use of cookies is based on your choices in the cookie banner.

We also receive data from our service providers:

• from the payment provider, confirmation that the payment was successful
• from carriers, the delivery status
• from Adtraction, information that a purchase was made through a partner’s link
• from social media services, the username and comment of a giveaway participant

We do not buy personal data, and we do not update address details from the Finnish Population Information System.

3. What we use the data for and on what legal basis

Each processing activity has a purpose and a legal basis under the EU General Data Protection Regulation (GDPR). The legal bases are contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), consent (Art. 6(1)(a)) and legitimate interest (Art. 6(1)(f)).

Where processing is based on legitimate interest, we have assessed that it does not override your rights.

Mandatory information

To process an order, we need your name, delivery address, email address and phone number. Your phone number is used for delivery notifications. Without this information, we cannot deliver your order.

Other information is voluntary, for example for the newsletter, size finder, surveys and reviews. Not providing it does not affect your ability to buy.

Data we do not process

We do not see or store payment card details. They are processed by the payment provider.

We do not process your personal identity code. Payment providers such as Klarna may ask for it for invoice or instalment payments as controllers in their own right.

4. Right to object to processing

You can object at any time to the processing of your data for direct marketing, including related profiling. When you object, we stop processing for this purpose. You do not need to give a reason for your request.

You can also object to other processing based on legitimate interest on grounds relating to your particular situation. In that case, we will stop the processing unless we have compelling legitimate grounds to continue it or the data is needed for a legal claim.

5. Marketing, advertising and profiling

Marketing messages

We send newsletters and offers by email and text message once you have given your consent. Your consent is recorded with the date and source.

If you have bought from us, we may send you information about our own similar products by email without separate consent. We tell you about this when you place your order, and you can opt out at checkout or later in any message.

Automated messages are based on your activity. For example, you may receive a reminder about a product left in your cart or a product you have viewed.

Advertising on other services

We use the advertising services of Meta (Facebook, Instagram), Google, TikTok and Pinterest. If you accept marketing cookies, our website shares information about your visits and purchases with these services. This is used to target advertising and measure results. Data is shared both from your browser and from our server.

We also upload our customers’ email addresses and phone numbers to advertising platforms in hashed form. The platform matches them against its own users and either shows our ads or does not show them. The platform does not receive information about customers it does not recognise. You can object to this, see section 4.

We are joint controllers with Meta for the collection and transfer of the data. The advertising platforms also process the data for their own purposes in accordance with their own privacy policies.

Shopify as a controller

Our online store runs on the Shopify platform. We use Shopify features in which Shopify also uses data from your dealings with other merchants: the Shop Pay payment method, the Shop app and Shopify Audiences. In these situations, Shopify itself is responsible for processing your data. For more information, see Shopify’s privacy policy.

Profiling

We calculate predictions for customers based on purchase and message history: expected customer value, timing of the next purchase, churn risk and likely gender. We use them to choose which products and offers we show you. You can object to profiling, see section 4.

Automated decision-making

We do not make decisions based solely on automated processing that would have legal or similarly significant effects on you. The credit decision for invoice and instalment payments is made by the provider of the payment method as a controller in its own right.

6. Who we share data with

We do not sell your personal data. Your data is processed by our staff as part of their work and by the service providers named below.

Processors act on our behalf under a written agreement. They may only use the data for the service they provide to us.

The following parties process data as controllers in their own right:

7. Transfers outside the EU/EEA

Some of our service providers process data outside the EU/EEA. We only transfer data when there is a basis for the transfer under the GDPR.

When we deliver an order outside the EU/EEA, we pass the delivery details to the carrier and the customs authorities of the destination country. The transfer is necessary to deliver the order (Article 49(1)(b) GDPR).

8. How long we keep data

We keep data only for as long as it is needed for the purpose described below. After that, we delete or anonymise it.

The retention periods of advertising platforms’ cookies and identifiers can be found in the cookie declaration in section 9.

9. Cookies and similar technologies

Cookies are small files that are stored on your device when you visit the website. We also use similar technologies, such as pixels and device identifiers.

We only use non-essential cookies if you give your consent in the cookie banner. You can change your choices or withdraw your consent at any time using the cookie settings link at the bottom of the website. Withdrawing consent is as easy as giving it.

When marketing cookies are switched off, we do not share website events with advertising platforms from your browser or from our server.

Cookie declaration

An up-to-date list of cookies, their providers and retention periods:

Generated on / Pandectes: 30 September 2026 at 14:23:32 UTC+3

We use cookies to optimise how the website works, analyse performance and give you a personalised experience. Some cookies are essential for the website to operate and function correctly. These cookies cannot be disabled. In this window, you can manage your cookie settings.

You can also block cookies in your browser settings. Blocking strictly necessary cookies may prevent you from making purchases.

10. Your rights

You have the right to:

• know what data we process about you and get a copy of it
• ask us to correct inaccurate data
• ask us to delete your data when there is no longer a basis for keeping it
• ask us to restrict processing, for example when the accuracy of the data is disputed
• receive the data you have provided in a machine-readable format and transfer it to another service provider
• object to processing, see section 4
• withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

How to exercise your rights

Send your request to info@svala.com. We verify your identity by comparing the request with information we already hold, such as your email address and order number. We reply to the email address stored in your customer details.

We will reply within one month. If the request is extensive or complex, we may extend this period by up to two months. We will tell you about any extension within the first month. There is no charge for the request.

We cannot delete statutory accounting records before the retention period ends.

Complaints to the supervisory authority

If you believe that we are processing your data unlawfully, you can lodge a complaint with the Finnish Data Protection Ombudsman: Office of the Data Protection Ombudsman, PO Box 800, 00531 Helsinki, Finland, tietosuoja@om.fi, tietosuoja.fi. You can also lodge a complaint with the supervisory authority in the country where you live or work.

11. Information security and risks related to processing

We protect data with technical and organisational measures:

• Data traffic on the website and at checkout is encrypted (TLS).
• Payment card details are processed in the payment provider’s PCI DSS-certified environment.
• Access to data is limited to people who need it for their work. Systems are accessed with personal credentials and two-factor authentication.
• We have data processing agreements in place with our service providers.

Processing involves risks that we aim to keep as small as possible:

• A data breach could expose contact or order details. We report breaches to the Data Protection Ombudsman within 72 hours, and to you if the breach is likely to result in a high risk to you.
• Outside the EU, authorities may have broader access to data than in the EU. This is why we use the safeguards described in section 7.
• Profiling and targeted advertising affect which products and ads are shown to you. You can object to them, see section 4.

12. Changes to this policy

We update this policy when our processing or the law changes. We notify our customers and newsletter subscribers of significant changes by email before they take effect.

Last updated: 28 October 2026