Privacy policy

 

1. Controller

Louru Oy (Business ID 3090970-9), Tievantie 4, 95980 Ylläsjärvi, Finland. Email: tuki@louru.fi. Phone: +358 40 040 5878 (weekdays 10:00–17:00 Finnish time).

For data protection matters, you can contact us at the same addresses. Please use "Privacy" as the subject. We have not appointed a data protection officer, as one is not required given the scope of our operations.

This policy covers the kauppa.louru.fi online store, our store in Kittilä, customer service and marketing.

2. What data we process

• Contact details: name, email address, phone number, delivery and billing address; for business customers also the company name and Business ID.
• Order details: products purchased, prices, delivery method, order and return history, and warranty and service matters.
• Payment details: payment method and payment status. We do not see or store card numbers; they are handled by the payment service provider.
• Customer account: login details, saved addresses and loyalty programme points.
• Communications: customer service emails, chat messages and notes made during phone calls.
• Marketing: subscriptions to or opt-outs from our newsletter and text messages, opens and clicks of our messages, and back-in-stock notification requests.
• Reviews: product reviews you submit, your display name and any photos.
• Technical data: IP address, browser, device, visits and activity on the website, collected using cookies and similar technologies (see section 7).

We do not process sensitive data, and we do not make automated decisions or carry out profiling that would have legal or similarly significant effects on our customers.

3. Purposes and legal bases

We process data only for the purposes below. Each legal basis is based on Article 6 of the EU General Data Protection Regulation (GDPR).

Purpose	Legal basis
Processing orders, payments, deliveries, returns and warranty	Contract (6(1)(b))
Customer account and loyalty programme	Contract (6(1)(b))
Customer service and responding to enquiries	Contract or legitimate interest (6(1)(b), (f))
Accounting, taxation and consumer protection obligations	Legal obligation (6(1)(c))
Newsletter and text messages if you have not purchased from us before	Consent (6(1)(a))
Email marketing of similar products to existing customers	Legitimate interest (6(1)(f)) and section 200 of the Finnish Act on Electronic Communications Services; you can opt out at any time
Marketing to business customers	Legitimate interest (6(1)(f))
Back-in-stock notifications and review requests	Consent or legitimate interest (6(1)(a), (f))
Publishing product reviews	Consent (6(1)(a))
Store operation and security, fraud prevention	Legitimate interest (6(1)(f))
Analytics, improving the user experience and targeted marketing	Consent (6(1)(a)) via the cookie banner

Legitimate interest means that we have weighed our interests against your rights. You can object to such processing (see section 10).

4. Where we get the data

We receive data primarily from you: through orders, your customer account, forms, chat, emails, phone calls and store visits. Technical data is collected when you use the website. Payment service providers tell us whether a payment succeeded, and carriers tell us the delivery status. We may check business customers' details from public sources such as the Finnish Business Information System (YTJ).

5. Recipients and processors

We do not sell personal data. We use the service providers listed below. Processors handle data only on our behalf under a data processing agreement. Independent controllers also process data in accordance with their own privacy policies.

Recipient category	What the data is used for	Role
E-commerce platform and connected apps	Orders, customer accounts, checkout, customer service and chat, product reviews, loyalty programme, back-in-stock notifications	Processor
Payment service providers	Online banking, card and mobile payments, invoice and instalment payments, express checkout	Independent controller
Carriers and logistics partners	Deliveries, order picking and tracking	Independent controller or processor
Print-on-demand manufacturers	Manufacturing printed products to order and shipping them directly to you	Processor
Email and text message service	Newsletters, marketing messages and order-related messages	Processor
Analytics services	Measuring and improving website use	Processor
Embedded content providers	Social media feeds and fonts on the website	Independent controller
Accounting services	Accounting and taxation	Processor
Authorities	Only when required by law	Independent controller

On request, we will tell you in more detail which service providers your data has been disclosed to. If our business is sold or reorganised, data may be transferred to the new owner on the same terms.

6. Transfers outside the EU and EEA

Some of our service providers, such as the e-commerce platform and our marketing, customer service and analytics services, may also process data outside the EU and EEA, in particular in the United States and Canada. These transfers are based on a European Commission adequacy decision (for example Canada, and companies certified under the EU–US Data Privacy Framework) or on the Commission's standard contractual clauses together with any necessary supplementary safeguards. You can contact us for more information about the safeguards for these transfers.

7. Cookies and tracking

Cookies are small files stored on your device. We use them and similar technologies for four purposes:

• Strictly necessary: shopping cart, checkout, login and security. These are always on.
• Preferences: for example language and recently viewed products.
• Analytics: measuring and improving website use, for example Microsoft Clarity [and Google Analytics].
• Marketing: targeting advertising and messages and measuring their effectiveness, for example Klaviyo.

Cookies other than strictly necessary ones are used only with your consent, which you give in the website's cookie banner (section 205 of the Finnish Act on Electronic Communications Services). You can change your choice at any time in the cookie settings at the bottom of the website [check link name], or delete cookies in your browser settings.

Microsoft Clarity may record how the site is used, for example mouse movements and clicks. Information typed into forms is not recorded.

8. Use of AI tools

We use AI tools to develop our online store: drafting product descriptions, frequently asked questions and website content, and making technical changes. A person reviews and approves the content before it is published. The chat on our online store is also AI-assisted, and using it is entirely voluntary.

We do not enter our customers' personal data, such as names, contact details, orders or messages, into these tools. The chatbot platform's AI tool processes the chat messages that are sent to the chat.

If this changes, we will update this policy and list the services used in section 5 before we start using them.

9. Retention periods

We keep data only for as long as it is needed for the purposes below or as required by law. After that, the data is deleted or anonymised.

Data	Retention period
Order and payment data that forms part of our accounting records	6 years from the end of the year in which the financial year ended (Finnish Accounting Act, chapter 2, section 10)
Other order, warranty and return data	For the warranty and liability period, up to 3 years from the order
Customer account	Until you delete your account or it has been inactive for 3 years
Marketing consents and opt-outs	Until you withdraw your consent; opt-outs are kept so that we can honour them
Newsletter subscribers who do not open our messages	Removed after 2 years of inactivity
Customer service messages and chats	2 years from the last message
Product reviews	For as long as the review is published or until you ask us to remove it
Analytics and session recordings	According to the service's settings; Clarity recordings 30 days

10. Your rights

You have the right to:

• know whether your data is being processed and receive a copy of it
• request correction of inaccurate data
• request deletion of your data, unless the law requires us to keep it
• request restriction of processing
• object to processing based on legitimate interest, and opt out of direct marketing at any time
• receive the data you have provided in a machine-readable format and transfer it to another controller
• withdraw your consent at any time; withdrawal does not affect the lawfulness of processing before it

You can unsubscribe from the newsletter using the link at the end of each message. You can send other requests to tuki@louru.fi. We may ask you to confirm your identity. We will respond within one month; if the request is extensive, this may be extended, and we will let you know.

If you believe that the processing of your data breaches data protection law, you can lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi/en).

11. Security and changes to this policy

Only people who need the data for their work have access to it. We use personal user accounts and two-factor authentication, and connections to the website are encrypted. Our service providers are contractually committed to data security. If a data breach puts your data at risk, we will notify you as required by law.

We may update this policy when our services or the law change. We will announce significant changes on the website or by email.

Last updated: 2 October 2026