PRIVACY POLICY

Lohenette Ky – B2B Data Protection & Privacy Notice
Effective Date: October 4, 2026

1. Data Controller

Company Name: Lohenette Ky
Website: www.lohenette.fi
Business ID (Y-tunnus): 0889716-6
Address: Mäkituvantie 1 A, 02780 Espoo, Finland
Email: lohenette@lohenette.fi
Website: www.lohenette.fi

For any privacy-related inquiries, data access requests, or questions regarding personal data processing, please contact us at lohenette@lohenette.fi.

2. Legal Basis and Purpose of Processing

We process personal data in compliance with the EU General Data Protection Regulation (GDPR – Regulation 2016/679) and applicable Finnish legislation.

As a strictly B2B (Business-to-Business) platform, we collect and process limited personal data of customer representatives and corporate contacts for the following purposes:

  • Order Fulfillment & Contract Performance: Processing and delivering orders, validating corporate identities, managing customer communication, and coordinating advance payments (ennakkomaksu).
  • Customer Account Management: Maintaining registered B2B customer accounts, handling inquiries, and delivering administrative notices.
  • Legal Compliance: Fulfilling statutory requirements, including accounting, taxation, and legal record-keeping under Finnish law (Kirjanpitolaki).
  • Direct Business Marketing: Managing existing business relationships and providing relevant B2B product updates or promotional communications (subject to opt-out/unsubscribe rights).

Legal Grounds for Processing:

  • Performance of a contract to which the data subject’s employer/represented corporate entity is a party (GDPR Art. 6(1)(b)).
  • Compliance with legal obligations (GDPR Art. 6(1)(c)).
  • Legitimate business interest in conducting B2B commerce and maintaining client relations (GDPR Art. 6(1)(f)).

3. Categories of Data Collected

We collect only minimal and relevant personal data necessary for commercial operations:

  • Contact Information: Name, job title, company name, corporate email address, phone number, and delivery/billing address.
  • Order & Transaction Details: Ordered items, order history, communication records, transaction values, and payment verification status.
  • Technical & Log Data: IP address, browser type, login timestamp, and cookie identifier related to session security.

4. Data Retention Period

Personal data is retained only for as long as necessary to fulfill the purposes outlined in this policy or as required by law:

  • Accounting & Invoicing Data: Retained for six (6) to seven (7) years in accordance with the Finnish Accounting Act (Kirjanpitolaki 1336/1997).
  • Customer Representative Data: Retained for the duration of the active corporate customer relationship, or until a request for deletion/update is submitted due to personnel changes.

5. Data Sources & Disclosure of Data

Data is collected directly from the customer representative during account creation, order placement, or communication.

Data Transfer to Third Parties:

We do not sell, rent, or lease personal data to third parties. Data is shared strictly on a need-to-know basis with trusted service providers who process data on our behalf (Data Processors):

  • Logistics and freight carriers for physical order delivery.
  • Financial institutions and banking providers for processing advance payments.
  • IT infrastructure, web hosting, and software service providers ensuring platform operation and data security.

All service providers are bound by strict contractual data protection agreements.

6. International Data Transfers

Personal data is primarily stored and processed within the European Union (EU) or the European Economic Area (EEA). If technical infrastructure requires transfers outside the EU/EEA, such transfers are conducted under valid legal transfer mechanisms, such as the EU Standard Contractual Clauses (SCCs) or relevant adequacy decisions.

7. Data Security

We implement appropriate technical and organizational measures to safeguard personal data against unauthorized access, loss, misuse, alteration, or disclosure:

  • Encrypted communication via SSL/TLS protocols across all web interactions.
  • Restricted access controls limiting data visibility solely to authorized personnel.
  • Regular system maintenance and secure server infrastructure monitoring.

8. Rights of the Data Subject

Under the GDPR, corporate customer representatives have the following rights regarding their personal data:

  • Right of Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate, incomplete, or outdated data.
  • Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data, provided there is no legal obligation (e.g., accounting laws) requiring retention.
  • Right to Restrict or Object to Processing: Object to or request restriction of data processing based on legitimate interests or direct marketing.
  • Right to File a Complaint: File a complaint with the national supervisory authority if you believe your data protection rights have been violated:
    • Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)Website: www.tietosuoja.fiEmail: tietosuoja@om.fi

9. Updates to This Privacy Policy

We reserve the right to update this Privacy Policy to reflect changes in legal requirements or operational practices. Updated versions will be published directly on this page with an updated “Effective Date”.