PRIVACY POLICY – LOIDUA

Last updated: [date]

This Privacy Policy explains how Loidua (“Loidua”, “we”, “us” or “our”) collects, uses, stores and protects personal data when you visit or use our website at www.loidua.com, place an order, contact our customer support team or otherwise interact with us.

We are committed to handling personal data responsibly, confidentially and in accordance with applicable data protection laws, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and, where applicable, the Privacy and Electronic Communications Regulations (“PECR”).

By using our website, placing an order or contacting us, you may provide us with personal data that we process as described in this Privacy Policy.

1. Personal data we collect

We only collect and process personal data that is necessary for operating our online store, processing orders, providing customer service, improving our services, maintaining security, carrying out marketing activities where permitted and complying with legal obligations.

1.1 Order and customer information

When you place an order through our website, we may collect and process the following information:

• your name;

• email address;

• telephone number;

• billing address;

• delivery address;

• order details;

• payment-related information;

• delivery and shipping information;

• communications relating to your order; and

• information relating to refunds, returns, cancellations or complaints.

Payments are processed through our payment service providers. We do not normally store complete payment card details.

1.2 Customer service information

When you contact our customer support team, we may process:

• your contact details;

• the content of your messages;

• information relating to your order;

• information relating to returns, complaints, refunds or chargebacks; and

• any photographs, documents or other attachments you provide to help us investigate or resolve an issue.

1.3 Website usage and device information

When you visit our website, we may automatically collect technical and usage information, including:

• IP address;

• browser type and version;

• device information;

• operating system;

• time zone;

• cookie and similar technology information;

• website usage and browsing information;

• referring URLs; and

• actions taken on our website.

We use this information to operate and secure our website, prevent fraud, understand how visitors use our store, improve the customer experience, measure marketing performance and improve our services.

1.4 Marketing information

Where you subscribe to our newsletter, provide marketing consent or otherwise receive marketing communications in accordance with applicable law, we may process:

• your name;

• email address;

• marketing preferences and consent records;

• information about unsubscribes or withdrawals of consent;

• email open and click activity; and

• information based on your interests, website activity or purchase history.

You can unsubscribe from marketing emails at any time by using the unsubscribe link in the email or by contacting us at support@loidua.com.

2. How we use personal data

We may use personal data for the following purposes:

• receiving, processing and managing orders;

• processing payments;

• delivering products;

• sending order confirmations, delivery updates and other service communications;

• processing cancellations, returns, refunds and replacements;

• providing customer support;

• managing our customer relationship with you;

• operating, maintaining and securing our website;

• preventing fraud, misuse and unauthorised activity;

• improving our website, products, services and customer experience;

• analytics, reporting and business administration;

• marketing, advertising and measuring advertising performance, where permitted;

• complying with legal, accounting, tax and consumer protection obligations; and

• establishing, exercising or defending legal claims.

3. Our lawful bases for processing

We process personal data only where we have a lawful basis to do so under applicable data protection law.

3.1 Performance of a contract

We process personal data where it is necessary to perform a contract with you or to take steps at your request before entering into a contract. This includes processing necessary to:

• process and fulfil your order;

• receive and process payment;

• deliver products;

• send order confirmations and service communications;

• process returns, cancellations and refunds; and

• provide customer support relating to your order.

3.2 Legal obligation

We may process personal data where necessary to comply with legal obligations, including obligations relating to:

• accounting and taxation;

• consumer protection;

• responding to lawful requests from public authorities; and

• complying with other legal or regulatory requirements.

3.3 Consent

We may process personal data based on your consent, for example where you:

• accept non-essential analytics or marketing cookies;

• subscribe to our newsletter; or

• provide separate consent for marketing communications.

You may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

3.4 Legitimate interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided that your rights and interests do not override those interests.

Our legitimate interests may include:

• improving and developing our website and services;

• maintaining website and account security;

• detecting and preventing fraud, misuse and unauthorised activity;

• managing customer relationships;

• improving customer communications and service quality;

• conducting business analytics and reporting; and

• establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we consider the potential impact on your privacy and take steps to ensure that our interests do not override your rights and freedoms.

4. Cookies and similar technologies

We use cookies and similar technologies on our website to support website functionality, improve the user experience, analyse website traffic and, where permitted, measure and personalise advertising.

Cookies and similar technologies may be used to:

• ensure that the website operates properly;

• enable shopping basket and checkout functionality;

• remember preferences;

• improve website performance and user experience;

• understand website traffic and visitor behaviour;

• measure the effectiveness of advertising; and

• show more relevant advertising.

Strictly necessary cookies may be used without consent where they are essential for the operation of the website or for providing a service you have requested.

Where required by law, we will ask for your consent before placing or accessing non-essential cookies, including analytics and marketing cookies. You can manage your cookie choices through the cookie settings available on our website. You may also manage cookies through your browser settings, although blocking some cookies may affect the functionality of our website.

For further information about cookies used by Shopify, please refer to Shopify’s own cookie information.

5. Analytics and marketing

We may use analytics and marketing services to improve our online store, understand customer behaviour, measure advertising performance and show relevant advertising, where permitted by law.

These services may include:

• Shopify;

• Google Analytics;

• Google Ads;

• Meta platforms, including Facebook and Instagram; and

• email marketing service providers.

Marketing and advertising may be based on information such as website activity, cookies, purchase history or interests, subject to applicable law and your preferences.

You may control certain advertising preferences through the settings offered by the relevant service providers. You can also manage your consent for non-essential cookies through our website’s cookie settings.

6. Sharing personal data

We share personal data only where necessary for the purposes described in this Privacy Policy, where required by law or where you have given us consent.

We may share personal data with the following categories of recipients:

• our e-commerce platform provider, such as Shopify;

• payment service providers;

• delivery, shipping and logistics providers;

• warehousing, fulfilment and product suppliers;

• customer support and communication service providers;

• analytics and marketing service providers;

• IT, hosting, security and maintenance service providers;

• accounting, tax and legal service providers;

• professional advisers;

• public authorities, regulators or law enforcement bodies where required by law; and

• any buyer, investor or successor to all or part of our business, where permitted by law.

We do not sell your personal data to third parties.

7. International transfers of personal data

Some of our service providers, suppliers or partners may process personal data outside the United Kingdom.

Where personal data is transferred outside the United Kingdom, we will take appropriate steps to ensure that the transfer is lawful and that your information receives an adequate level of protection. Depending on the circumstances, this may include relying on:

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK Addendum to the European Commission’s standard contractual clauses;

• other appropriate safeguards recognised under UK data protection law; or

• another lawful transfer mechanism permitted by applicable law.

Our service providers may process personal data outside the United Kingdom for purposes such as providing their services, hosting and maintaining systems, customer support, fraud prevention, payment processing, analytics and security.

8. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods may vary depending on the type of information and the purpose for which it is processed.

In general:

• order and payment-related information is retained for as long as required for accounting, tax and legal purposes;

• customer service communications are retained for as long as necessary to deal with the enquiry and any related follow-up;

• information relating to returns, complaints, refunds and disputes is retained for as long as necessary to manage the customer relationship, meet legal obligations or deal with potential legal claims;

• marketing consent records are retained until consent is withdrawn or the information is no longer needed; and

• cookie retention periods depend on the type of cookie and the relevant service provider.

When personal data is no longer required, we will delete it or anonymise it within a reasonable period, unless we are required by law to retain it for longer.

9. Security

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include:

• access controls;

• password protection and restricted user permissions;

• secure systems and encrypted connections where appropriate;

• limiting access to personal data to authorised personnel and service providers;

• carefully selecting service providers; and

• monitoring and security measures designed to protect our systems.

While we take reasonable steps to protect personal data, no method of internet transmission or electronic storage can be guaranteed to be completely secure.

10. Your data protection rights

Depending on the circumstances and applicable law, you may have the following rights in relation to your personal data:

• the right to request access to your personal data;

• the right to request correction of inaccurate or incomplete personal data;

• the right to request deletion of your personal data;

• the right to request restriction of processing;

• the right to object to processing based on legitimate interests;

• the right to object to direct marketing at any time;

• the right to request data portability in certain circumstances;

• the right to withdraw consent where processing is based on consent; and

• the right not to be subject to a decision based solely on automated processing where that decision has legal or similarly significant effects on you, subject to applicable exceptions.

To exercise your rights, please contact us using the details in Section 15 below.

We may ask for additional information to verify your identity before responding to a request. We aim to respond without undue delay and, where applicable, within the time limits required by law.

11. Children

Our website and products are not intended for individuals under the age of 18 without the involvement or consent of a parent or legal guardian.

We do not knowingly collect personal data from children without appropriate authorisation. If we become aware that we have collected personal data from a child without a valid legal basis, we will take reasonable steps to delete that information.

12. Automated decision-making

Loidua does not use fully automated decision-making that produces legal effects or similarly significant effects on customers.

However, our e-commerce platform, payment providers or other service providers may use automated tools for purposes such as fraud prevention, payment security, risk assessment or detecting unusual or potentially unauthorised activity.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, systems, business practices or legal obligations.

The latest version will always be available on our website. The date of the most recent update will appear at the top of this Privacy Policy.

14. Contact and complaints

If you have any questions about this Privacy Policy, how we process your personal data or how to exercise your data protection rights, please contact us first using the details below.

We aim to handle privacy-related questions, concerns and complaints fairly, appropriately and without undue delay. We encourage you to contact our customer support team first so that we can investigate the matter and try to resolve it directly with you.

You can contact us at:

Email: support@loidua.com

Contacting us first is voluntary and does not affect your legal rights.

If you are not satisfied with our response, or if you prefer not to contact us first, you have the right to lodge a complaint with the relevant data protection supervisory authority.

If you are in the United Kingdom, you may contact the Information Commissioner’s Office (“ICO”). If you are located in the European Economic Area, you may also contact the data protection supervisory authority in your country of residence, place of work or the place where you believe an infringement has occurred.

15. Data controller and company information

The controller responsible for your personal data is:

[Your full legal name] trading as Loidua
Finnish Business ID (Y-tunnus): 3346034-5
Business address: 
Country: Finland
Email: support@loidua.com

For privacy, order or customer service enquiries, please contact us at the email address above.