Privacy policy
Privacy Policy
Last updated: 14.9.2026
Who we are
Lelu Archive is a sole trader business (toiminimi) registered in Finland, and the controller of the personal data collected through this store.
Emilia Hokkonen, trading as Lelu Archive · Business ID (Y-tunnus) 3513146-5
Kalevankatu 40 C 35, 00180, Helsinki Finland
What we collect and why
To make and deliver your order we collect your name, email, shipping and billing address, phone number if you give one, and the contents of your order. We process this to perform our contract with you (GDPR Art. 6(1)(b)). Without it we cannot complete an order.
To meet our legal duties we keep order, payment and invoice records, and handle cancellations, returns and complaints (Art. 6(1)(c)).
To keep the store working and safe we use limited technical data — IP address, device and browser type, pages viewed — to prevent fraud and misuse and to fix problems. This is our legitimate interest in running a functioning shop (Art. 6(1)(f)).
If you sign up for emails, we use your address to send them, on the basis of your consent (Art. 6(1)(a)). You can unsubscribe at any time from the link in any email.
Payment is handled by our payment provider. We see confirmation that a payment succeeded and the last digits of the card, never the full card number.
We do not sell your data, we do not use it for profiling or automated decisions, and we do not use it for anything unrelated to the purposes above.
Who we share it with
Only with service providers who process data on our instructions, under data processing agreements: Shopify (webshop platform, hosting, order handling and payment processing), [CARRIER, e.g. Posti] (your name, address, phone and email, so your parcel can be delivered and tracked), and our accountant and bookkeeping software (records we are required to keep). We disclose data to authorities only where the law obliges us to.
Shopify operates partly outside the EU/EEA. Where personal data is transferred outside the EU/EEA it is protected by the European Commission's Standard Contractual Clauses or another valid safeguard under Chapter V of the GDPR.
How long we keep it
Order, payment and invoice data: six years from the end of the accounting year, as the Finnish Accounting Act requires. Customer service messages: up to two years after the matter is closed. Your email address on our mailing list: until you unsubscribe. Cookie data: for the lifetime set for each cookie, at most [12] months. After that, data is deleted or anonymised.
Cookies
Essential cookies keep the cart, checkout, security and language settings working — the store cannot run without them. Any non-essential cookies, such as analytics or marketing, are set only if you consent in the cookie banner, and you can change or withdraw that consent at any time from [cookie settings link]. You can also block cookies in your browser, though parts of the store may then stop working.
Your rights
You have the right to get a copy of the data we hold about you, to have it corrected or erased, to restrict or object to how we process it (including processing based on our legitimate interest), to receive it in a machine-readable form or have it moved to another provider, and to withdraw any consent you have given — withdrawal does not affect processing carried out beforehand.
Email leluarchive@gmail.com to use any of these. We reply within one month, and may ask you to confirm your identity first. If you think we handle your data unlawfully, you can complain to the Finnish Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.
Security and changes
Traffic to the store is encrypted, access to order data is limited to those who need it, and our providers are bound by GDPR Art. 28 agreements. No online service can be guaranteed completely secure.
We may update this policy as the business or the law changes; the current version is always on this page with its date, and we will tell you if a change materially affects your rights.