Privacy Policy

Updated: August 28, 2026

1. Data Controller and Contact Information

Urjalan Makeistukku Oy
Business ID: 0904552-0
Turunväylä 52
31760 Urjala
Finland

Requests and questions regarding data protection and personal data processing:
tietoturva@urjalanmakeistukku.fi

Urjalan Makeistukku Oy acts as the data controller for the personal data described in this privacy policy.

2. Scope of the Policy

This privacy policy explains how Urjalan Makeistukku Oy collects, uses, stores, discloses, and otherwise processes personal data, as well as the rights data subjects have regarding the processing of their personal data.

The privacy policy applies to the online stores maintained by Urjalan Makeistukku Oy:

  • urjalanmakeistukku.fi
  • godis247.se
  • candy2000.com

The policy applies to customers and subscribers of the online stores, registered users, contact persons for corporate customers and other entities, subscribers of marketing communications and product availability notifications, individuals contacting customer service, and other users of the online stores.

Personal data is processed only for defined and lawful purposes and to the extent necessary for each purpose.

3. Personal Data Processed

We may process the following personal data, depending on how you use our online stores and services:

Customer and Contact Information

  • name
  • email address
  • phone number
  • billing and shipping address
  • company name and other contact details related to corporate accounts

Customer Account Information

  • customer account identifiers and contact details
  • information related to login and account usage
  • preferences saved or choices made by the customer in the service

Order and Transaction Data

  • orders and order history
  • information concerning ordered products, quantities, prices, discounts, delivery, and returns
  • necessary identifier and status information regarding payment methods and transactions
  • information related to customer service, feedback, and complaints

Marketing and Communication Information

  • marketing consents and opt-outs
  • information related to the delivery and usage of email and other marketing communications
  • information related to subscribing to product availability notifications
  • information related to customer communications

Technical Information Concerning Online Store Usage

  • IP address
  • cookies and other online identifiers
  • browser, device, and connection information
  • information regarding online store usage, sessions, and events
  • cookie and other privacy preferences

In principle, we do not collect or process personal data belonging to the special categories of personal data as referred to in the GDPR.

4. Sources of Personal Data

We primarily receive personal data from the data subject themselves in connection with the use of our online store and other services. Information is obtained, for example, when a customer:

  • places an order or creates a customer account
  • contacts customer service or makes a complaint
  • subscribes to marketing communications or product availability notifications
  • participates in a campaign or provides us with feedback
  • uses the online store and makes choices regarding cookies and other tracking technologies

Information is also automatically generated in connection with the use of the online store, for example through cookies, log files, and other similar technologies, in accordance with the consents and privacy preferences provided by the user.

We may also receive personal data from service providers we use when it is necessary, for example, for the implementation of payment, delivery, or other services related to the online store.

Information about contact persons for corporate customers and other entities may also be obtained from the organization they represent, as well as from public sources.

5. Purposes and Legal Bases for Personal Data Processing

We process personal data only when there is a basis for processing under applicable data protection legislation. The legal basis for processing depends on the purpose for which the data is used.

5.1 Performance of a Contract and Pre-contractual Measures

We process personal data to perform a contract with the customer or at the customer's request prior to entering into a contract. This includes, for example:

  • receiving and processing orders
  • enabling payment
  • delivering orders and communicating about delivery
  • processing returns, refunds, and complaints
  • providing a customer account and related services
  • necessary communication related to an order or customer relationship

Legal basis: performance of a contract (GDPR Article 6(1)(b)).

5.2 Compliance with Legal Obligations

We also process personal data to fulfill legal obligations that apply to us. These may include requirements related to accounting, taxation, consumer protection, and statutory authority obligations.

Legal basis: compliance with a legal obligation (GDPR Article 6(1)(c)).

5.3 Legitimate Interest

We may process personal data based on the legitimate interest of Urjalan Makeistukku Oy or a third party, for example, for:

  • managing and developing customer relationships
  • implementing customer service
  • ensuring and developing the functionality, security, and quality of our services
  • preventing and investigating misuse and fraud
  • establishing, exercising, or defending legal claims
  • permitted direct marketing

When processing based on legitimate interest, we assess the necessity of the processing and the rights and interests of the data subject.

Legal basis: legitimate interest (GDPR Article 6(1)(f)).

5.4 Consent

We process personal data based on consent when processing requires the consent of the data subject. Such purposes may include, for example:

  • electronic direct marketing when it requires consent
  • sending product availability notifications
  • registration for a voluntary service or function when processing is based on consent
  • non-essential cookies and other tracking technologies used for analytics, personalization, and marketing purposes

Providing consent is voluntary. Given consent can be withdrawn at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Legal basis: consent (GDPR Article 6(1)(a)).

6. Customer Accounts and Registered Users

It may be possible to create a customer account or use other features intended for registered users in the online store.

In connection with a customer account, we process personal data to provide the account and related services. Such information may include, for example, contact details, shipping addresses, order history, and information related to account usage.

Using a customer account is voluntary, and creating one is generally not a prerequisite for shopping in the online store.

Customers can manage the information in their customer account through available functions and request the correction or deletion of their personal data as described in the Rights of the Data Subject section of this privacy policy.

Deleting a customer account from the online store does not necessarily delete personal data from other systems used by Urjalan Makeistukku Oy. Data may be retained to the extent that its retention is still necessary, for example, to fulfill a legal obligation or on the basis of another lawful processing ground.

7. Orders, Payments, and Deliveries

We process customer personal data for receiving, processing, paying for, and delivering orders, as well as for related communication.

Information processed for the fulfillment of an order may include, for example, the customer's name, contact details, billing and shipping address, order contents, and necessary information related to payment and delivery.

Payment

We use third-party payment service providers to carry out payment transactions. Information necessary to complete the payment is transmitted to the payment service providers. Payment service providers may process personal data in accordance with their own privacy policies and legal obligations.

Urjalan Makeistukku Oy does not, as a rule, process or store customers' full payment card details.

Deliveries

To deliver an order, we disclose necessary personal data to the chosen delivery or transport service provider. Disclosed information may include, for example, the recipient's name, shipping address, email address, phone number, and order-related information necessary for the delivery.

The transport service provider may use the information to carry out the delivery and for related communication in accordance with their own legal obligations and privacy policies.

Order and payment data may also be processed for accounting, taxation, returns, refunds, complaints, prevention of misuse, and other purposes related to the management of the order or legal obligations.

8. Customer Service and Customer Communication

We process personal data to handle customer inquiries, questions, feedback, complaints, and other customer service situations.

In connection with customer service, we may process, for example, the customer's name, email address, phone number, order and customer information, as well as messages provided to us by the customer and other information necessary to resolve the matter.

We may contact the customer via email, phone, text message, or other appropriate means when it is necessary, for example, to handle an order, delivery, payment, return, complaint, or other matter related to the customer relationship.

Information related to customer service and communication may also be used to develop the quality of our service, operations, and customer experience, as well as to investigate potential misuse or disputes.

Personal data processing related to customer service is based, depending on the situation, on the performance of a contract, a legal obligation, or Urjalan Makeistukku Oy's legitimate interest in properly managing the customer relationship and its business.

9. Electronic Direct Marketing

We may process personal data for electronic direct marketing, such as email and text message marketing, in accordance with applicable legislation.

Electronic direct marketing may be sent to an individual based on their consent. Additionally, electronic direct marketing may be sent to existing customers without separate prior consent when the requirements of legislation for such marketing are met.

For marketing purposes, we may process, for example:

  • name and contact details
  • marketing consents and opt-outs
  • customer and order information
  • customer segments and areas of interest
  • information related to sent marketing messages and their usage

Information may be used to target and personalize marketing, and to measure the functionality and effectiveness of marketing, in accordance with applicable legislation and the privacy choices made by the user.

Electronic direct marketing can be opted out of at any time, free of charge, by using the unsubscribe option in the marketing message or by contacting Urjalan Makeistukku Oy.

Regarding marketing based on consent, consent can be withdrawn at any time. Withdrawing consent or opting out of direct marketing does not affect the customer's ability to use the online store or receive necessary messages related to their order and customer relationship.

10. Product Availability Notifications

Customers can, if they wish, subscribe to a notification about product availability by providing their email address for this purpose.

Personal data provided for the availability notification is used to send the notification requested by the customer when the product in question is available again. Processing is based on the consent given by the customer.

Subscribing to an availability notification does not imply consent to other electronic direct marketing unless the customer provides separate consent for that.

Information related to availability notifications is stored only as long as it is necessary to fulfill the requested notification or until the customer withdraws their consent.

11. Cookies and Other Tracking Technologies

We use cookies and other similar technologies in our online stores to enable the operation of the stores, maintain security, develop the user experience, and, based on user consent, for analytics, personalization, and marketing.

Cookies and other tracking technologies used can be divided into the following categories based on their purpose:

Necessary Cookies

Necessary cookies and similar technologies are used for the technical operation of the online store, security, shopping cart, login, payment, and for the implementation of privacy choices made by the user. Their use generally does not require user consent when they are necessary to provide the service requested by the user.

Analytics and Functional Cookies

These can be used to measure and analyze the use of the online store, to develop the service's functionality and user experience, and to implement features chosen by the user.

Marketing and Personalization Cookies

These can be used, for example, to target and measure marketing, to personalize the content shown to the user, and to evaluate the effectiveness of advertising.

Non-essential cookies and similar tracking technologies are used when the user has provided the necessary consent for their use. Users can make and change their choices regarding cookies through the privacy settings available in the online store.

The cookies in use, their purposes, service providers, and retention periods may change as the online store and the services used therein evolve. Up-to-date information on cookies in use and choices related to them is available in the online store's cookie settings.

12. Shopify E-commerce Platform and Shopify Network Intelligence

Our online stores operate on the Shopify platform. Shopify processes customer personal data to provide the e-commerce platform and related services. In these situations, Shopify generally acts as a data processor on behalf of Urjalan Makeistukku Oy.

We use the Shopify Network Intelligence feature. In this context, Shopify may process personal data of our online store customers and users together with information gathered for Shopify from other merchant and Shopify services to provide and develop Shopify's enhanced services.

This information may be used, for example, for service development, personalization, analytics, prevention of misuse, and targeting and measuring advertising and marketing. In these processing activities, Shopify acts as an independent data controller in accordance with applicable data protection legislation.

The primary storage location for shop, order, and customer data held in Shopify for our online stores is in the European Union. However, Shopify and its service providers may also process personal data outside the EU/EEA area to provide the services. Transfer mechanisms and safeguards in accordance with applicable data protection legislation are used for international data transfers.

More information on how Shopify processes personal data as an independent data controller and on data protection rights available through Shopify:
Shopify Privacy Policy
Shopify Privacy Portal

13. Recipients of Personal Data and Service Providers

We use external service providers in the processing of personal data when it is necessary for the implementation of our online stores and other services.

Personal data may be processed or disclosed, for example, to the following recipient categories:

  • online store, hosting, and IT service providers
  • payment and financial service providers
  • transport, logistics, and delivery service providers
  • customer service and communication service providers
  • marketing and analytics service providers
  • accounting, financial management, and other service providers supporting our business
  • authorities and other parties when there is a legal obligation or other lawful basis for disclosing the information

Service providers may process personal data on behalf of Urjalan Makeistukku Oy as data processors or act as independent data controllers regarding their own services and legal obligations.

With data processors, we ensure that the processing agreements required by applicable data protection legislation and other appropriate safeguards are in place.

We only disclose to service providers such personal data as is necessary for the implementation of the service in question or other specified purpose of use.

We do not sell personal data to third parties.

14. Transfers of personal data outside the EU/EEA area

In the processing of personal data, we strive to use services and solutions where personal data is primarily processed within the European Union or the European Economic Area. However, some of the service providers or their subcontractors we use may also process personal data outside the EU/EEA area.

When personal data is transferred outside the EU/EEA area, we ensure that there is a basis for the transfer in accordance with applicable data protection legislation and that appropriate safeguards are used to protect the personal data.

Transfers may be based, for example, on a European Commission decision on an adequate level of data protection or on Standard Contractual Clauses (SCC) approved by the European Commission. Depending on the service provider and the transfer, other transfer mechanisms and supplementary safeguards provided for by applicable data protection legislation may also be used.

The primary storage location for the trade, order, and customer data of our online stores kept in Shopify is in the European Union. Despite this, Shopify and its service providers may also process personal data outside the EU/EEA area to provide the services.

15. Retention periods for personal data

We retain personal data only for as long as is necessary to fulfill its purpose of use or as required by applicable legislation.

When determining the retention period, we take into account, among other things, the purpose of the processing, the duration of the customer relationship, the necessity of the data, statutory retention obligations, and needs related to resolving potential legal claims.

As a rule, data is stored in accordance with the following principles:

  • Order, payment, and accounting data are retained for as long as is necessary to manage the order and customer relationship and to fulfill accounting, tax, and other statutory obligations.
  • Customer account data are retained for the duration of the customer account and customer relationship and thereafter only for as long as there is a justified need or statutory obligation to retain the data.
  • Data related to customer service, returns, and complaints are retained for the duration of the processing of the matter and thereafter for as long as is necessary, for example, to manage the customer relationship or to resolve potential legal claims.
  • Marketing-related data are retained for as long as they are needed for marketing purposes or until the data subject withdraws their consent or exercises their right to object to direct marketing. Information regarding a marketing ban may be retained to ensure compliance with the ban.
  • Data related to product availability notifications are retained for the time necessary for the implementation of the requested service or until consent is withdrawn.
  • Data collected using cookies, analytics, and other tracking technologies are retained in accordance with their purpose, the privacy choices made by the user, and the retention policies of the services in use.

When there is no longer a basis for the retention of personal data, the data will be appropriately deleted or anonymized.

16. Protection of personal data

We protect personal data with appropriate technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction, alteration, or unauthorized disclosure.

Access to personal data processing is restricted to individuals whose job duties or responsibilities require the processing of the data. Access rights are managed and restricted according to the needs of the processing.

Service providers used for the processing of personal data are required to provide an appropriate level of data protection and information security in accordance with their role and applicable legislation.

Information security measures are assessed and developed, taking into account the nature of the personal data being processed, the risks associated with the processing, and available technical and organizational means.

17. Rights of the data subject

In accordance with applicable data protection legislation, the data subject has the right to influence the processing of their personal data. The applicability of these rights depends on, among other things, the purpose and legal basis of the personal data processing.

Right of access to personal data

The data subject has the right to obtain confirmation as to whether we are processing personal data concerning them, and to gain access to the processed personal data and information related to it.

Right to rectification of data

The data subject has the right to request the correction or completion of inaccurate or incomplete personal data.

Right to erasure of data

In certain situations, the data subject has the right to request the deletion of their personal data. Deleting a customer account from the online store does not necessarily delete personal data from other systems used by Urjalan Makeistukku Oy.

The data subject may request the deletion of their personal data by contacting tietoturva@urjalanmakeistukku.fi. Upon a deletion request, personal data will be deleted or anonymized from those systems and records for which there is no longer a legal basis for retention.

Data concerning an order, accounting, or other business transaction may be retained without personal data that would allow for customer identification when the retention of the business transaction itself is necessary. Personal data may additionally be retained to the extent that there is a statutory obligation or other basis under the GDPR for its retention.

Right to restriction of processing

In situations defined in the GDPR, the data subject has the right to request the restriction of the processing of their personal data.

Right to object to processing

In certain situations, the data subject has the right to object to the processing of their personal data based on legitimate interest.

The data subject always has the right to object to the processing of their personal data for direct marketing purposes. After a direct marketing ban, personal data will no longer be processed for that purpose.

Right to data portability

In certain situations, the data subject has the right to receive the personal data they have provided in a structured, commonly used, and machine-readable format and to transfer this data to another controller, when the processing is based on consent or a contract and is carried out by automated means.

Right to withdraw consent

When the processing of personal data is based on consent, the data subject may withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal of consent.

Requests regarding the rights of the data subject:
tietoturva@urjalanmakeistukku.fi

If necessary, we may request additional information to verify the identity of the person making the request. Requests will be processed within the time frame required by applicable data protection legislation.

18. Right to lodge a complaint with a supervisory authority

If a data subject considers that their personal data has been processed in violation of data protection legislation, they have the right to lodge a complaint with a competent data protection authority.

The data subject may lodge a complaint in particular in the EU or EEA country where their habitual residence or place of work is located, or where the alleged infringement of data protection legislation has occurred.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.
Up-to-date contact information and instructions for lodging a complaint are available on the website of the Office of the Data Protection Ombudsman.

19. Changes to the privacy policy

We may update this privacy policy, for example, due to changes in personal data processing methods, the services we use, or applicable legislation.

The current version of the privacy policy is always available in our online stores. We recommend that you review the privacy policy from time to time. The update date indicated at the beginning of the policy shows when it was last updated.