Effective from: August 29, 2025

Data Controller

Milan ja Leena Oy (Business ID 3466844-7)
Nahkurintie 10, 21490 Marttila, Finland
Email: [asiakaspalvelu@lemi-shop.fi]
Phone: [add number]
www.lemi-shop.fi

Data Protection Officer / Contact Person

[First Name Last Name], [email], [phone] (if appointed)

Processing Purposes and Legal Bases

– Order processing and delivery (contract)
– Customer service (legitimate interest / contract)
– Invoicing and accounting (legal obligation)
– Marketing and communication (consent or legitimate interest)
– Website analytics and development (consent through cookies)

Processed Personal Data

Name, contact information (address, email, phone), order details, payment information (tokenized data in payment service), return and complaint information, communication history, cookie and analytics data.

Data Sources

Information is obtained from the customer during order/registration, and through cookies and analytics tools (see Cookie Policy).

Retention Periods

– Order and accounting data: 6–10 years according to accounting law
– Customer service related data: 3 years
– Marketing register: until consent is withdrawn or you object to processing
– Cookie and analytics data: see Cookie Policy

Recipients and Transfers

– Payment service: [payment service name] – payment processing
– Shipping companies: [Posti / Matkahuolto] – delivery
– E-commerce platform / maintenance: [WordPress + Elementor, hosting service provider]
– Analytics: Tilee Analytics (see Cookie Policy for details)

Data may be transferred outside the EU/EEA if the service provider is located or stores data outside the EU. In such cases, we ensure data security and appropriate safeguards (e.g., EU standard contractual clauses).

Rights of the Data Subject

– Right to access your data
– Right to rectification and erasure of data
– Right to restrict and object to processing
– Right to data portability
– Right to withdraw consent (e.g., marketing, analytics)
Requests: [asiakaspalvelu@lemi-shop.fi]. You have the right to lodge a complaint with the supervisory authority (Office of the Data Protection Ombudsman).

Data Security

We use appropriate technical and organizational security measures (encrypted connections, access control, backups).

Automated Decision-Making / Profiling

We do not engage in practices that produce legal effects without human intervention, unless specifically notified and consent obtained.