Privacy Policy
How we collect, use, and protect your personal data.
Effective date: 18 June 2026
This Privacy Policy describes how Elämyskauppa Oy (Business ID: 3612111-1, Helsinki, Finland, "we", "us", "our") processes personal data in the online service at elamyskauppa.fi (the "Service"). By using the Service you accept this Privacy Policy. This Policy complies with the EU General Data Protection Regulation (GDPR).
1. Data Controller
Elämyskauppa Oy is the data controller for all personal data processed in connection with the Service. Contact details are listed at the bottom of this page.
2. Data We Collect
Customers: name, email address, payment transaction details (no card numbers), and gift card use and redemption data. Merchant Partners: company name, contact person name, email address, billing and payment information, and Merchant Profile data. Technical data: IP address, cookies and similar tracking technologies, browser type, device information, and usage data (such as pages visited and time spent on the Service).
3. How We Use Your Data
We use your personal data to: sell and deliver gift cards; process payments and settle payouts to Merchant Partners; provide customer service and handle complaints; operate, maintain, and improve the Service; prevent fraud and misuse; fulfil statutory obligations (e.g. accounting and tax requirements); and, where you have given consent, send marketing communications.
4. Legal Basis (GDPR)
We process your personal data on the following legal bases: contract performance — to fulfil a purchase or service agreement; legal obligation — to comply with Finnish and EU law (e.g. accounting, tax); legitimate interests — to develop the Service and prevent fraud; and consent — for cookies and marketing where required (you may withdraw consent at any time).
5. Data Sharing
We may share your data with: payment service providers (solely for processing transactions); Merchant Partners (to facilitate gift card redemption); IT and hosting service providers acting as our data processors; and public authorities where required by law. We do not sell your personal data to third parties.
6. Data Retention
We retain personal data only as long as necessary for the purposes for which it was collected: transaction and order data is kept for the duration of the contract and for up to 10 years thereafter to meet accounting and statutory requirements; marketing data is kept until you unsubscribe or withdraw consent; technical logs are kept for up to 12 months.
7. Your Rights
Under the GDPR you have the right to: access your personal data; request correction of inaccurate data; request erasure ('right to be forgotten'); restrict or object to processing; data portability; and withdraw consent at any time without affecting prior processing. To exercise any of these rights, please contact us at the address below. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu).
8. Cookies
The Service uses cookies and similar technologies to enable core functionality, analyse usage, and personalise your experience. You can manage cookie preferences through your browser settings or our cookie consent tool. Blocking essential cookies may affect the functionality of the Service. For full details, please see our Cookie Policy.
9. Data Security
We protect your personal data through appropriate technical and organisational measures, including: encrypted connections (HTTPS); access controls and role-based permissions; secure server infrastructure; and restricted staff access on a need-to-know basis. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals.
10. Third-Party Services
The Service may use third-party providers such as payment processors, hosting services, and analytics tools (including Google Analytics). These providers may have access to your data solely for the purpose of providing their service to us and are bound by appropriate data protection agreements.
11. International Data Transfers
Where personal data is transferred outside the European Economic Area (EEA), we ensure an adequate level of protection through appropriate safeguards, such as the European Commission's standard contractual clauses (SCCs) or equivalent mechanisms approved under the GDPR.
12. Changes to This Policy
We may update this Privacy Policy from time to time. The current version is always available on the Service. Where changes are material, we will notify you by email or through a prominent notice on the Service before the changes take effect.
13. Contact
For any questions about this Privacy Policy or to exercise your data rights, please contact us:
Elämyskauppa Oy
Helsinki, Finland
info@elamyskauppa.fiData Protection Contact: privacy@elamyskauppa.fielamyskauppa.fiLast updated: 2026-06-18