Privacy policy

1. Controller

Vaivatta Digipalvelut, business ID 3281265-2, address PL 10, 15101 Lahti. For data protection matters, contact info@vaivatta.fi .

2. What we process

• Customer and order data: name, company, business ID, email, phone number, billing and delivery address, order history, order contents and amounts.
• Account data: email, password hash, account settings.
• Payment data: transaction identifier and status. Card details are never stored in Vaivatta's systems.
• Communications: messages sent to customer service and their handling records.
• Technical data: IP address, browser information, cookie identifiers and log data.

3. Purposes

• Processing orders, delivery, invoicing and handling returns.
• Maintaining the customer account and providing customer service.
• Delivering and invoicing continuous services (VPS, software modules).
• Security of the webshop, prevention of misuse and investigation of faults.
• Statutory obligations such as accounting.
• Customer communications and marketing where there is a basis for it.

4. Legal bases (GDPR Article 6)

• Contract (6(1)(b)): delivering orders and services and maintaining the account.
• Legal obligation (6(1)(c)): accounting and tax legislation.
• Legitimate interest (6(1)(f)): security, prevention of misuse, debt collection and communication with existing customers.
• Consent (6(1)(a)): the newsletter and any non-essential cookies.

5. Sources of data

Data is primarily obtained from the data subject when placing an order, creating an account or contacting us. Technical data accumulates from the use of the service.

6. Processors and disclosures

We use carefully selected service providers that process personal data on our behalf under a data processing agreement:

• Stripe – payment processing.
• SendGrid – sending email.
• Cloudflare – content delivery, security and file storage.
• Hosting provider – operating the webshop and the services.
• Carriers – handling deliveries.
• Accounting – statutory bookkeeping and invoicing.
• Google Analytics – visitor statistics; analytics cookies are set only with consent.

Data may be disclosed to authorities where the law requires it. Data is never sold or rented. Any transfer outside the EU/EEA relies on the Commission's standard contractual clauses or another safeguard permitted by the GDPR.

7. Retention

• Order and invoicing data: six (6) years from the end of the financial year, per accounting legislation.
• Customer account: for the life of the account and at most two (2) years from the last sign-in.
• Customer service messages: at most two (2) years after the matter is closed.
• Technical logs: at most twelve (12) months.

8. Your rights

• Right of access, including a copy of your data.
• Right to have inaccurate data corrected.
• Right to erasure once there is no longer a basis for processing.
• Right to restriction of processing and right to object.
• Right to data portability.
• Right to withdraw consent at any time.
• Right to lodge a complaint with the Finnish Data Protection Ombudsman.

Requests should be sent to info@vaivatta.fi . We verify the identity of the requester before acting.

9. Cookies

The webshop uses strictly necessary cookies for the session, the cart and security; these cannot be switched off without breaking the service. Any statistics or marketing cookies are used only with consent. Cookies can be blocked in the browser settings, but some functions will then stop working.

10. Security

Connections are encrypted. Access to personal data is limited to those who need it for their work. Passwords are stored as hashes.

11. Changes to this policy

This policy is updated as the service and the legislation change. The current version is always available on this page.

Use of AI

Vaivatta is a fully agentic webshop under human supervision. Product texts and prices are drafted by AI (Anthropic Claude) and reviewed, checked and corrected by people.

• We use Anthropic's Claude AI model through our own interface for catalogue work only: product texts, categories and prices.
• No personal data is processed with AI and none is shared with Anthropic. The AI has no access to customer, order or payment data and makes no decisions about customers.
• More in our AI policy.

Cookies and consent

When you first visit the shop we tell you that it sells only to businesses and organisations and that it is run by AI agents under human supervision, and you choose between all cookies and necessary cookies only. Closing the window counts as necessary cookies only.

• Necessary cookies (always on): session, security token, shopping cart and the cookies that store your choice. The shop does not work without them.
• Analytics and advertising cookies (only if you accept all): Google Analytics 4 and Google Ads, to measure visits and advertising and to target our ads. Your visit may then be included in Google advertising audiences (for example, visitors who entered the shop and accepted all cookies), which we use to show our Google Ads to similar business buyers. With necessary cookies only, Google receives cookieless signals without identifiers.
• Record of your choice: to be able to demonstrate consent (GDPR Art. 7(1)) we store the time, your IP address, network forwarding information, your browser's user agent, the page address, your choices and the version of the text you saw. We keep these records for 3 years and then delete them automatically. If you place an order, the record is linked to the order.
• We ask again after about 12 months or when the text changes. You can change your choice at any time on the cookie settings page.