Privacy Policy
This policy is being finalised ahead of launch and is pending review by Northern Gifts’ legal counsel. Items in [square brackets] will be completed before publication. Last updated: 29 June 2026.
This Privacy Policy explains how Northern Gifts processes personal data in connection with its website (northerngifts.fi and northerngifts.se) and the B2B account-request form on it. The processing complies with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Finnish Data Protection Act (Tietosuojalaki 1050/2018).
1. Data controller
| Controller | [Legal entity name, e.g. Northern Gifts Oy] |
|---|---|
| Business ID (Y-tunnus) | [0000000-0] |
| Registered address | [Street, postal code, city, Finland] |
| [privacy@northerngifts.fi] | |
| Telephone | [+358 …] |
Contact in data-protection matters. Questions about this policy or your personal data can be sent to [privacy@northerngifts.fi]. [A Data Protection Officer has / has not been appointed; if appointed, add contact here.]
2. What this register covers
This policy covers the B2B account-request and customer-relationship register: personal data submitted through the account-request form and processed to evaluate the request, create and manage a wholesale customer account, and maintain the resulting business relationship.
3. Personal data we process
We collect the following directly from you when you submit the account-request form:
- Contact details: contact person’s name, email address, telephone number.
- Company details: company name, Business ID / VAT number.
- Address: street address, postal code, city, country.
- Free-text message: anything you add in the “Notes” field.
- Consent record: the fact, content and time of the consent you give on the form.
- Submission metadata: the interface language, the market (FI/SE), a generated request identifier, and the submission timestamp.
Our hosting environment also logs technical data for security and operation, which may include your IP address, browser type and request timestamps. We do not use this to identify you or to profile you.
We do not intentionally collect special categories of personal data (such as health or ethnicity). Please do not include such data in the free-text field.
4. Purposes and legal bases for processing
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Receiving and evaluating your account request, contacting you about it, and creating and managing your wholesale customer account | Art. 6(1)(b): steps taken at your request prior to, and performance of, a contract. We also record your explicit consent (Art. 6(1)(a)) given on the form. |
| Managing the ongoing customer relationship, orders and deliveries through the app4sales webshop and our ERP | Art. 6(1)(b): performance of a contract. |
| Statutory bookkeeping and accounting records | Art. 6(1)(c): compliance with a legal obligation (Finnish Accounting Act, Kirjanpitolaki 1336/1997). |
| Business communications to existing customers about products and services relevant to their trade | Art. 6(1)(f): our legitimate interest in serving and informing B2B customers. You may object at any time. |
| Securing the website and preventing form abuse and spam | Art. 6(1)(f): legitimate interest in the security of our service. |
Where processing is based on consent, you may withdraw it at any time (see Section 9). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. Where the data comes from
All personal data in this register is collected directly from you when you complete and submit the account-request form. We do not buy it or enrich it from external sources.
6. Recipients and processors
Your data is handled by Northern Gifts personnel who need it to evaluate requests and serve customers. We also use the following service providers (“processors”), who process the data only on our instructions and under data-processing agreements:
- Website hosting: [Cloudways / hosting provider], which hosts the website and database on EU/EEA-based infrastructure in [country/region].
- Email delivery: the request is emailed to a Northern Gifts mailbox via [email/SMTP provider]. [Until the EU business mailbox is in place, requests are emailed to a Gmail address (Google), which is a transfer outside the EEA. See Section 7.]
- app4sales webshop: [operator of the app4sales platform], the external B2B webshop where your wholesale account is created and used.
- Netvisor (Visma Solutions Oy): our ERP and accounting system, into which approved account requests are entered to create and maintain the customer account and related accounting records.
We do not sell or rent your personal data, and we do not disclose it to third parties except as described here or where required by law.
7. Transfers outside the EU/EEA
Our website, database and primary processing take place within the EU/EEA. Where a service provider processes data outside the EEA, the transfer is protected by a European Commission adequacy decision and/or the Commission’s Standard Contractual Clauses (SCCs) with appropriate supplementary measures. [To confirm: the location and transfer mechanism for each processor, in particular the email provider until the EU mailbox is in place.]
8. How long we keep your data
We keep personal data only as long as necessary for the purposes above:
- Requests that do not lead to an account: deleted within [12 months] of the request.
- Active customer-relationship data: kept for the duration of the relationship and for [a defined period, e.g. 6 years] after it ends.
- Accounting records: retained for the statutory minimum under the Finnish Accounting Act, which is 6 years from the end of the financial year in which the record arose.
After the applicable period, data is deleted or irreversibly anonymised.
9. Your rights
Under the GDPR you have the right to: access the personal data we hold about you; have inaccurate or incomplete data corrected; request erasure, subject to our legal retention obligations; request restriction of processing; object to processing based on legitimate interest, including direct B2B marketing; receive your data in a portable format where applicable; and withdraw consent at any time where processing is based on consent.
To exercise any of these rights, contact [privacy@northerngifts.fi]. We respond within one month and may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.
Right to lodge a complaint. If you believe we have processed your data unlawfully, you may contact the Finnish supervisory authority:
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Postal address: PL 800, 00531 Helsinki, Finland
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Telephone: +358 29 566 6700
Email: tietosuoja(at)om.fi · Web: tietosuoja.fi
10. Automated decision-making and profiling
We do not carry out automated decision-making that produces legal or similarly significant effects, and we do not profile you, within the meaning of Article 22 GDPR.
11. How we protect your data
We apply appropriate technical and organisational measures, including: transmission over encrypted connections (HTTPS/TLS); a signed (HMAC-SHA256) integration when transmitting requests to our ERP; access limited to personnel who need it; spam and abuse protection on the form; and storage on access-controlled, EU/EEA-based infrastructure.
12. Cookies
The website uses only strictly necessary and functional cookies and sets no analytics, advertising or third-party tracking cookies by default. See our Cookie Policy for details.
13. Changes to this policy
We may update this policy as our processing or the law changes. The current version and its date are shown at the top. Material changes will be communicated by appropriate means.