Privacy policy

Controller Information
Name: nurja Oy (Business ID: 3007690-3)
Address: Ilmarinkatu 35, 33500 Tampere, Finland
Email: info@nurja.fi

Purpose of the Register
The primary purpose of processing personal data is to deliver orders, resolve any related issues, and manage customer relationships. Personal data may also be used for marketing purposes if the customer has subscribed to the mailing list or created an account in the online store.

Stored Data and Its Processing
The customer register includes contact information provided by the customer for order delivery (name, address, phone number, and email address), as well as information about purchased products and services. By placing an order in our online store, you consent to the registration of this information.

Registered Users’ Rights Regarding Personal Data Processing

• Right of Access:
  Registered users have the right to inspect what personal data has been stored about them and to receive a copy of that data. Requests for access should be sent to info@nurja.fi. We will correct, delete, or complete incorrect or unnecessary personal data either on our own initiative or at the request of the data subject.
• Right to Review:
  Users can review the personal data we have stored.
• Right to Rectification:
  Users can request the correction of inaccurate or incomplete personal data.
• Right to Object:
  Users may object to the processing of their personal data if they believe it has been processed unlawfully.
• Right to Opt Out of Direct Marketing:
  Users have the right to prohibit the use of their data for direct marketing.
• Right to Erasure:
  Users may request the deletion of their data if it is no longer necessary for the original purpose. We will process the request and either delete the data or provide a justified reason why it cannot be deleted. Please note that the data controller may have a legal obligation or other right not to delete certain information. For example, under the Finnish Accounting Act (Chapter 2, Section 10), accounting records must be retained for 10 years, and therefore related data cannot be deleted before this period ends. Customers may unsubscribe from marketing messages using the unsubscribe link provided in each email.

Regular Disclosures of Data
In order to process payments, fulfill orders, and provide other essential functions of our online store, personal data may be shared with the following third-party services, all of which comply with data protection laws:

• MyCashFlow (e-commerce platform)
• Paytrail (payment processor)
• Postnord (logistics services)
• Matkahuolto (logistics services)
• Posti (logistics services)
• Flodesk (newsletter service)

Data will never be shared with external parties unless it is necessary for providing our service. We do not use data for automated decision-making or profiling.

Right to Lodge a Complaint
Users have the right to file a complaint with the data protection authority.

Contact details for the Data Protection Ombudsman:
https://tietosuoja.fi/en/contact-information

Privacy Policy updated: June 10, 2025