Privacy Policy

Updated: 28.8.2026

1. Data controller and contact information

Urjalan Makeistukku Oy
Business ID: 0904552-0
Turunväylä 52
31760 Urjala
Finland

Inquiries and requests regarding data protection and the processing of personal data:
tietoturva@urjalanmakeistukku.fi

Urjalan Makeistukku Oy is the controller responsible for the processing of personal data described in this privacy policy.

2. Scope of the policy

This privacy policy describes how Urjalan Makeistukku Oy collects, uses, stores, discloses, and otherwise processes personal data, and what rights data subjects have regarding the processing of their personal data.

The privacy policy applies to Urjalan Makeistukku Oy's online store:

  • godis247.se

The policy applies to customers and purchasers in the online store, registered users, contact persons at corporate customers and other organizations, recipients of marketing communications and product notifications, persons contacting customer service, and other users of the online store.

Personal data is processed only for determined and lawful purposes and only to the extent necessary for each respective purpose.

3. Personal data processed

We may process the following personal data depending on how you use our online store and services:

Customer and contact information

  • name
  • email address
  • telephone number
  • billing and delivery address
  • company name and other contact details related to the corporate customer relationship

Information regarding customer accounts

  • identification and contact details for the customer account
  • information regarding login and use of the account
  • information and choices the customer saves or makes in the service

Order and customer relationship information

  • orders and order history
  • information about ordered products, quantities, prices, discounts, deliveries, and returns
  • necessary identification and status information regarding payment methods and payment transactions
  • information regarding customer service, feedback, and complaints

Marketing and communication information

  • consents to and opt-outs of marketing
  • information about the delivery and use of email marketing and other marketing communications
  • information regarding subscription to notifications about product availability
  • information regarding customer communication

Technical information about the use of the online store

  • IP address
  • cookie identifiers and other online identifiers
  • browser, device, and connection information
  • information about the use of the online store, sessions, and events
  • cookie and other data protection choices

As a rule, we do not collect or process personal data belonging to the special categories of personal data referred to in the GDPR.

4. Sources of personal data

We primarily obtain personal data directly from the data subject in connection with the use of the online store and our other services. Information is collected, for example, when the customer:

  • places an order or creates a customer account
  • contacts customer service or makes a complaint
  • subscribes to marketing communications or product availability notifications
  • participates in a campaign or provides feedback to us
  • uses the online store and makes choices regarding cookies and other tracking technologies

Information is also generated automatically in connection with the use of the online store, for example through cookies, log data, and other similar technologies, in accordance with the user's consents and data protection choices.

We may also receive personal data from our service providers when it is necessary to, for example, carry out a payment, delivery, or other service related to the online store.

Information about contact persons at corporate customers and other organizations can also be obtained from the organization they represent, as well as from public sources.

5. Purposes and legal basis for the processing of personal data

We process personal data only when there is a legal basis according to applicable data protection legislation. The legal basis depends on the purpose for which the data is processed.

5.1 Performance of a contract and pre-contractual measures

We process personal data to fulfill a contract with the customer or to take steps at the customer's request prior to entering into a contract. This includes, for example:

  • receiving and processing orders
  • enabling payment
  • delivery of orders and communication regarding the delivery
  • handling of returns, refunds, and complaints
  • provision of customer accounts and related services
  • necessary communication regarding the order or customer relationship

Legal basis: performance of a contract (Article 6(1)(b) of the GDPR).

5.2 Legal obligations

We also process personal data to fulfill our legal obligations. These may, for example, relate to accounting, taxation, consumer protection, and regulatory requirements.

Legal basis: legal obligation (Article 6(1)(c) of the GDPR).

5.3 Legitimate interest

We may process personal data based on the legitimate interest of Urjalan Makeistukku Oy or a third party, for example for:

  • management and development of customer relationships
  • carrying out customer service
  • ensuring and developing the functionality, security, and quality of our services
  • prevention and investigation of misuse and fraud
  • establishment, exercise, or defense of legal claims
  • permissible direct marketing

For processing based on legitimate interest, we assess the necessity of the processing and the rights and interests of the data subject.

Legal basis: legitimate interest (Article 6(1)(f) of the GDPR).

5.4 Consent

We process personal data based on consent when the processing requires the data subject's consent. Such purposes can be, for example:

  • electronic direct marketing when consent is required
  • notifications about product availability
  • registration for a voluntary service or function when the processing is based on consent
  • non-essential cookies and other tracking technologies for analysis, personalization, and marketing

Giving consent is voluntary. Provided consent can be withdrawn at any time. Withdrawal does not affect the lawfulness of processing that occurred before the consent was withdrawn.

Legal basis: consent (Article 6(1)(a) of the GDPR).

6. Customer accounts and registered users

It may be possible to create a customer account in the online store or use other features intended for registered users.

In connection with the customer account, we process personal data to provide the account and related services. Such information can include, for example, contact details, delivery addresses, order history, and information about the use of the account.

Using a customer account is voluntary and is as a rule not a requirement for shopping in the online store.

The customer can manage information in their customer account through the functions available and request rectification or erasure of their personal data in accordance with the section Data subject's rights in this privacy policy.

If a customer account is removed from the online store, it does not necessarily mean that personal data is removed from all other systems used by Urjalan Makeistukku Oy. Data may be stored to the extent that storage is still necessary to fulfill a legal obligation or based on another legal basis for processing.

7. Orders, payments, and deliveries

We process the customer's personal data to receive, process, pay for, and deliver orders, and for communication related to these.

Information processed to fulfill an order can include, for example, the customer's name, contact details, billing and delivery address, the content of the order, and necessary information regarding payment and delivery.

Payment

For carrying out payment transactions, we use external payment service providers. The information needed to carry out the payment is provided to the payment service provider. Payment service providers may process personal data according to their own privacy policies and legal obligations.

As a rule, Urjalan Makeistukku Oy does not process or store customers' complete payment card details.

Deliveries

To deliver an order, we disclose necessary personal data to the chosen delivery or transport service. Information disclosed can include, for example, the recipient's name, delivery address, email address, telephone number, and such information about the order as is needed for the delivery.

The transport service provider may use the information to carry out the delivery and for related communication according to their legal obligations and privacy policies.

Order and payment information may also be processed for accounting, taxation, returns, refunds, complaints, prevention of misuse, and other purposes related to handling the order or fulfilling legal obligations.

8. Customer service and customer communication

We process personal data to handle customer inquiries, questions, feedback, complaints, and other customer service situations.

In connection with customer service, we may process, for example, the customer's name, email address, telephone number, order and customer information, as well as messages and other information provided to us that is needed to investigate the matter.

We may contact the customer via email, telephone, SMS, or other appropriate means when it is necessary to handle, for example, an order, delivery, payment, return, complaint, or other matter related to the customer relationship.

Information related to customer service and communication can also be used to develop the quality of our services, our operations, and the customer experience, as well as to investigate potential misuse or disputes.

The processing of personal data in connection with customer service is based, depending on the situation, on the performance of a contract, a legal obligation, or Urjalan Makeistukku Oy's legitimate interest in managing the customer relationship and its operations in a proper manner.

9. Electronic direct marketing

We may process personal data for electronic direct marketing, such as marketing via email and SMS, in accordance with applicable legislation.

Electronic direct marketing may be sent based on the data subject's consent. Direct marketing may also be sent to existing customers without separate prior consent when the legal requirements for such marketing are met.

For marketing, we may process, for example:

  • name and contact details
  • consents to and opt-outs of marketing
  • customer and order information
  • customer segments and areas of interest
  • information about sent marketing messages and the use thereof

The information can be used to target and personalize marketing, as well as to measure the functionality and effectiveness of marketing in accordance with applicable legislation and the user's data protection choices.

Electronic direct marketing can at any time be prohibited free of charge by using the unsubscribe option in the marketing message or by contacting Urjalan Makeistukku Oy.

When marketing is based on consent, consent can be withdrawn at any time. A withdrawn consent or a prohibition of direct marketing does not affect the customer's ability to use the online store or receive necessary messages regarding the order or customer relationship.

10. Notifications about product availability

The customer can choose to order a notification about a product's availability by providing their email address for this purpose.

Personal data provided for an availability notification is used to send the notification requested by the customer when the current product is back in stock. The processing is based on the customer's consent.

Ordering an availability notification does not imply consent to other electronic direct marketing, unless the customer gives separate consent for this.

Information regarding availability notifications is stored only for as long as is necessary to carry out the requested notification or until the customer withdraws their consent.

11. Cookies and other tracking technologies

We use cookies and other similar technologies in our online store to enable the online store's functionality, maintain security, develop the user experience, and, with the user's consent, for analysis, personalization, and marketing.

Cookies and other tracking technologies can be divided into the following categories according to the purpose of use:

Necessary cookies

Necessary cookies and similar technologies are used for the online store's technical functionality, security, shopping cart, login, payment, and for carrying out the user's data protection choices. Their use does not, as a rule, require consent when they are necessary to provide a service that the user has requested.

Analysis and functional cookies

These can be used to measure and analyze the use of the online store, develop the service's functionality and user experience, and carry out functions that the user has chosen.

Marketing and personalization cookies

These can be used, for example, to target and measure marketing, personalize content displayed to the user, and assess the effectiveness of advertising.

Cookies other than necessary ones and similar tracking technologies are used when the user has provided the required consent. The user can make and change their cookie choices via the data protection settings available in the online store.

Cookies, their purposes of use, service providers, and storage periods may change as the online store and the services used within it are developed. Up-to-date information about cookies and available choices can be found in the online store's cookie settings.

12. Shopify platform and Shopify Network Intelligence

Our online store uses the Shopify platform. Shopify processes customer personal data to provide the online store platform and related services. In these situations, Shopify generally acts as a data processor for Urjalan Makeistukku Oy.

We use the Shopify Network Intelligence feature. In connection with this, Shopify may process personal data about customers and users in our online store together with data that Shopify collects from other merchants and Shopify services to provide and develop Shopify's enhanced services.

This information can be used, for example, for service development, personalization, analysis, prevention of misuse, and for targeting and measuring advertising and marketing. For these processing activities, Shopify acts as an independent data controller in accordance with applicable data protection legislation.

The primary storage location for store, order, and customer information stored in Shopify for our online store is the European Union. Shopify and its service providers may, however, also process personal data outside the EU/EEA to provide the services. For international transfers, transfer mechanisms and safeguards that meet applicable data protection legislation are used.

More information on how Shopify processes personal data as an independent data controller and about the data protection rights that can be exercised via Shopify:
Shopify's Privacy Policy
Shopify's Privacy Portal

13. Recipients of personal data and service providers

We use external service providers for processing personal data when it is necessary to provide our online store and our other services.

Personal data can be processed by or disclosed to, for example, the following categories of recipients:

  • providers of online store, hosting, and IT services
  • providers of payment and financing services
  • providers of transport, logistics, and delivery services
  • providers of customer service and communication services
  • providers of marketing and analysis services
  • providers of accounting, financial management, and other support services for our business
  • authorities and other parties when there is a legal obligation or other lawful basis for the disclosure

Service providers may process personal data on behalf of Urjalan Makeistukku Oy as data processors or act as independent data controllers for their own services and legal obligations.

We ensure that the necessary data processing agreements and other appropriate safeguards in accordance with applicable data protection legislation are in place with service providers acting as data processors.

We only disclose such personal data to service providers that is necessary for providing the relevant service or for another specified purpose.

We do not sell personal data to third parties.

14. Transfer of personal data outside the EU/EEA

We strive to use services and solutions where personal data is primarily processed within the European Union or the European Economic Area. However, some of our service providers or their subcontractors may process personal data outside the EU/EEA.

When personal data is transferred outside the EU/EEA, we ensure that the transfer has a legal basis according to applicable data protection legislation and that appropriate safeguards are used to protect the personal data.

Transfers may, for example, be based on the European Commission's adequacy decision or the European Commission's Standard Contractual Clauses (SCC). Depending on the service provider and the transfer, other transfer mechanisms and supplementary safeguards according to applicable data protection legislation may also be used.

The primary storage location for store, order, and customer data stored in Shopify for our online store is the European Union. Nevertheless, Shopify and its service providers may also process personal data outside the EU/EEA to provide the services.

15. Retention periods for personal data

We store personal data only for as long as is necessary for the purposes for which it is processed or as long as applicable legislation requires.

When determining the retention period, we take into account, among other things, the purpose of the processing, the length of the customer relationship, the necessity of the data, legal retention obligations, and needs related to the investigation of potential legal claims.

As a rule, data is stored according to the following principles:

  • Order, payment, and accounting data are stored as long as necessary to manage the order and customer relationship and to fulfill accounting, tax, and other legal obligations.
  • Customer account data are stored during the existence of the customer account and the customer relationship and thereafter only as long as there is a justified need or legal obligation to store the data.
  • Data concerning customer service, returns, and complaints are stored during processing and thereafter as long as necessary, for example, to manage the customer relationship or investigate potential legal claims.
  • Data concerning marketing are stored as long as needed for the marketing purpose or until the data subject withdraws their consent or objects to direct marketing. Information about marketing prohibitions may be stored to ensure that the prohibition is respected.
  • Data concerning notifications of product availability are stored as long as needed to carry out the requested service or until consent is withdrawn.
  • Data collected via cookies, analytics tools, and other tracking technologies are stored in accordance with their purpose of use, the user's data protection choices, and the retention practices of the services used.

When there is no longer a basis for storing personal data, it is deleted or anonymized in an appropriate manner.

16. Protection of personal data

We protect personal data through appropriate technical and organizational measures against unauthorized or unlawful processing as well as against accidental loss, destruction, alteration, or unauthorized disclosure.

Only persons whose work tasks or responsibilities require the processing of personal data have access to the data. Access rights are managed and restricted based on the need for processing.

We require that service providers who process personal data maintain an appropriate level of data protection and information security in accordance with their role and applicable legislation.

Information security measures are assessed and developed taking into account the nature of the personal data, the risks associated with the processing, and available technical and organizational measures.

17. Data subject's rights

Under applicable data protection legislation, the data subject has the right to influence the processing of their personal data. Which rights apply depends, among other things, on the purpose and legal basis of the processing.

Right of access

The data subject has the right to obtain confirmation as to whether we are processing personal data concerning them and to gain access to the personal data being processed and information about the processing.

Right to rectification

The data subject has the right to request that incorrect or incomplete personal data be corrected or completed.

Right to erasure

In certain situations, the data subject has the right to request the erasure of their personal data. If a customer account is removed from the online store, it does not necessarily mean that personal data is removed from all other systems used by Urjalan Makeistukku Oy.

The data subject may request the erasure of their personal data by contacting tietoturva@urjalanmakeistukku.fi. In connection with the request, personal data will be deleted or anonymized in the systems and data where there is no longer a legal basis to retain them.

Information regarding an order, accounting, or other business transaction may be retained without personal data that allows for identifying the customer when it is necessary to retain the business transaction itself. Furthermore, personal data may be retained to the extent that there is a legal obligation or other basis under the GDPR to do so.

Right to restriction of processing

In the situations specified in the GDPR, the data subject has the right to request that the processing of personal data be restricted.

Right to object to processing

In certain situations, the data subject has the right to object to the processing of personal data based on legitimate interest.

The data subject always has the right to object to the processing of personal data for direct marketing. After the data subject has objected to direct marketing, the personal data will no longer be processed for this purpose.

Right to data portability

In certain situations, the data subject has the right to receive the personal data they have provided themselves in a structured, commonly used, and machine-readable format and to transfer the data to another data controller when the processing is based on consent or a contract and is carried out by automated means.

Right to withdraw consent

When the processing of personal data is based on consent, the data subject may withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the consent was withdrawn.

Requests concerning the data subject's rights:
tietoturva@urjalanmakeistukku.fi

We may, if necessary, request additional information to verify the identity of the person making the request. Requests are processed within the time limits prescribed by applicable data protection legislation.

18. Right to lodge a complaint with a supervisory authority

If the data subject believes that their personal data has been processed in violation of data protection legislation, they have the right to lodge a complaint with the competent data protection authority.

In particular, the data subject may lodge a complaint in the EU or EEA country where they have their habitual residence or place of work or where the alleged infringement took place.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.
Current contact information and instructions for lodging a complaint can be found on the supervisory authority's website.

19. Changes to the privacy policy

We may update this privacy policy, for example, when our methods for processing personal data, the services we use, or applicable legislation change.

The current version of the privacy policy is always available in our online store. We recommend that you review the privacy policy periodically. The date at the beginning of the policy indicates when it was last updated.