Privacy Policy
Last updated: 25.06.2026
On this page
- 1. Who we are
- 2. What personal data we collect
- 3. Why we use it and our legal basis
- 4. Bespoke orders and the configurator
- 5. Who we share data with
- 6. Transfers outside the EU/EEA
- 7. How long we keep your data
- 8. Cookies and tracking
- 9. Your rights
- 10. Providing your data, children and automated decisions
- 11. How we protect your data
- 12. Changes and contact
1. Who we are
hakolawood is the controller responsible for your personal data when you use hakolawood.com or buy from us.
- Business ID (Y-tunnus): 3513099-9
- VAT number: FI35130999
- Address: Pulttitie 9-11 – 00880 Helsinki
- Email: mail@hakolawood.com
For any privacy question, contact us at the email above.
2. What personal data we collect
Depending on how you use the shop, we may process:
- Name & contact details — name, email, phone.
- Billing & delivery address — for invoicing and shipping.
- Order & purchase history — what you bought, order value, dates.
- Payment details — handled by the payment provider — we don’t store card numbers.
- Account login data — username, hashed password (if accounts exist).
- Custom-order specifications — measurements, materials, drawings, photos you send.
- Messages & correspondence — emails, contact-form and chat messages.
- Marketing preferences — newsletter sign-up, consent records.
- Technical & usage data — IP address, device, browser, pages viewed.
We do not deliberately collect special categories of data (such as health or political views), and we ask you not to send them to us.
3. Why we use it and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Process and deliver your order | Performance of a contract — Art. 6(1)(b) |
| Take and confirm payment | Performance of a contract — Art. 6(1)(b) |
| Bookkeeping, invoicing, tax (incl. kotitalousvähennys) | Legal obligation — Art. 6(1)(c) |
| Answer questions and provide customer service | Contract / legitimate interest in responding to you — Art. 6(1)(b)/(f) |
| Design and quote bespoke pieces | Performance of a contract / pre-contract steps — Art. 6(1)(b) |
| Send newsletters and offers | Consent — Art. 6(1)(a) |
| Measure and improve the website | Consent for non-essential cookies — Art. 6(1)(a) |
| Keep the site secure and prevent fraud | Legitimate interest in security — Art. 6(1)(f) |
| Establish, exercise or defend legal claims; handle warranty/returns | Legitimate interest / legal obligation — Art. 6(1)(f)/(c) |
Where we rely on legitimate interests, our specific interest is keeping the website and orders secure, preventing misuse, and being able to defend or pursue legal claims. You can object to this processing (see Section 9).
We send marketing only with your consent, which you can withdraw at any time using the unsubscribe link or by emailing us. Withdrawing consent does not affect earlier processing.
4. Bespoke orders and the configurator
Because our furniture is made to order, we process the measurements, materials, drawings and any photos you send so we can design and build your piece; we may store the configurations and quotes you create so we can prepare and fulfil your order. This data is used only for your project and the related warranty or complaint handling.
5. Who we share data with
We never sell your personal data. We share it only with the service providers and parties needed to run the shop, each bound to protect it:
| Recipient | Purpose | Location |
|---|---|---|
| Paytrail Oyj | Payment processing (also acts as an independent controller for payment & fraud checks) | Finland (EU) |
| DSV | Freight & delivery of larger furniture | EU/EEA |
| Posti / parcel carriers | Parcel and pallet delivery | EU/EEA |
| Web hosting provider | Hosting the WooCommerce site | EU/EEA |
| Email / inbox provider | Sending and storing correspondence | EU/EEA |
| Analytics provider | Website statistics (only with consent) | check region |
| Accountant / bookkeeping service | Statutory bookkeeping and tax filing | EU/EEA |
| Public authorities | Tax administration, courts — only when legally required | Finland (EU) |
6. Transfers outside the EU/EEA
Most of our providers are in the EU/EEA. Where a provider processes data outside the EU/EEA (for example certain US-based tools), we rely on the EU–US Data Privacy Framework (for certified US recipients) and the European Commission’s Standard Contractual Clauses where a recipient is not certified. You can ask us for a copy of the safeguards we use.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Orders, invoices & accounting records | 6 years from the end of the accounting year (Accounting Act 1336/1997) |
| Customer account | Until you close the account, then deleted within a reasonable period |
| Marketing contact list | Until you withdraw consent or unsubscribe |
| Bespoke-order designs & correspondence | Duration of the project plus the warranty/complaint period, then deleted |
| Website analytics & cookies | Per the retention period of each cookie (see the cookie section) |
8. Cookies and tracking
Our website uses the following cookie types:
- Strictly necessary: Cart, checkout, security, language — no consent needed.
- Functional / preferences: Remember choices like saved configurations.
- Analytics / statistics: Understand traffic — consent required.
We ask for your consent before setting any non-essential cookies, and refusing is as easy as accepting. You can change or withdraw your choice at any time.
We use Matomo for website statistics, set only after you consent.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased (“right to be forgotten”), where applicable;
- restrict or object to processing, including profiling and direct marketing;
- receive your data in a portable format and have it transferred;
- withdraw any consent at any time, without affecting earlier processing.
By emailing the privacy contact above; we respond within one month. Exercising these rights is free, and we will not discriminate against you for doing so.
Complaints
You can lodge a complaint with the Finnish supervisory authority:
- Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
- Visiting address: Lintulahdenkuja 4, 00530 Helsinki · Postal: P.O. Box 800, 00531 Helsinki
- Email: tietosuoja@om.fi · Phone: +358 29 566 6700 · tietosuoja.fi/en
10. Providing your data, children and automated decisions
Some data is required to enter into and perform our contract with you — for example your name, address and payment details. Without it we cannot accept or deliver an order. Other data (such as newsletter sign-up) is entirely optional.
Our shop is intended for adults and is not directed at children. In Finland the age of consent for online services is 13; we do not knowingly collect children’s data.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
11. How we protect your data
We use TLS/HTTPS encryption on the website, access controls and limited staff access, regularly updated software, and reputable EU/EEA service providers under written data-processing agreements.
12. Changes and contact
We may update this policy from time to time. The current version and its effective date are always shown at the top of this page; significant changes will be highlighted. This policy is governed by Finnish law and EU data-protection law. It is provided in English for our English-speaking EU customers.
Questions about this policy or your data? Email mail@hakolawood.com.
