Privacy Policy

Paja&Bureau Oy customer data privacy policy



Paja&Bureau Oy

Korkeavuorenkatu 7, 00140 Helsinki




Controller’s contact information


Nino Hynninen



What information do we process


The following data is collected from registered customers or customers who have made an order:


  • first and last name;
  • contact information, such as e-mail address, postal address, phone number
  • order and delivery history;
  • chosen payment method and data concerning payment traffic;
  • possible customer communication and additional information provided by the customer
  • consents and bans on direct marketing;
  • VAT number and name of business clients


In addition we may process technical data from all webstore guests. These may be considered as personal data in some cases. These kinds of data are: 


  • IP address;
  • operating system and device type
  • products you’ve looked up in the webstore; and
  • browser history within the webstore.


To what purpose is the personal data processed


Customers’ personal data is processed toward the following functions:

  • Processing of orders, purchases and returns
  • Billing
  • Collection
  • Service production, development and survey as well as customer service realization
  • Customer relations’ management
  • Customer registry analysis and classification in order to direct communications
  • To produce questionnaires for example after a purchase or service transaction
  • To gather customer opinions and views toward development
  • Book keeping
  • To prevent and solve crimes
  • Establishment, exercise or defence of legal claims for example concerning criminal and accident claims as well as consumer law cases
  • Withdrawal of hazardous products


Personal data retention period


When the processing of your personal data is based on consent we will stop processing data after you cancel your consent. Aforementioned is applicable for example to newsletter subscription data, which we will cancel without delay in case you inform us of your cancellation of the subscription. You can cancel your consent by being in contact with the controller.


Data concerning purchase transactions, returns or billing is processed as part of Paja&Bureau Oy’s book keeping material for the retention period set by the law, which is six years from the end of the calendar year of which the accounting period ends. Data concerning feedback and reclamation processing as well as data concerning legal claims are retained for a time period required to process the action in question which generally doesn’t exceed five years. To protect vital interests such as information concerning product recall will be removed without delay after the recall according to instructions by officials. Information about sending customer questionnaires, answering them and the answers are retained for maximum of five years. Participant lists for competitions and draws are deleted after the winner has been chosen and/or the draw has been completed and the possible prize has been awarded. Information on the use of rights on behalf of registered persons and answers to them will be retained for one year after replying to the request; inspection requests are retained for 3 months after the answer has been sent. 

Your right to cancel consent


When your personal data processing is based on your consent you can at any time cancel your consent. Personal data processing is based on consent for example when you have given permission for direct marketing.


You have the possibility to restrict direct marketing and customer research.


If you don’t give consent to digital direct marketing we will only send you messages concerning the processes that are vital for dealing with your orders and customer relations.


Information about your other rights


A registered person has the right to access their personal data that is being processed by Paja&Bureau. You can contact us to inspect what information we are processing and what they are being used for.


You have the right to have faulty, inaccurate, inadequate, old or useless personal data that we are retaining, fixed, removed or completed on our behalf. By contacting us you can update for example your contact information and other personal data.


You can request a personal data removal. We will perform actions according to your request unless we have a legal reason not to remove the information. A reason like this can be duty to retain information set by book keeping law or need to retain order information to validate a warranty issue. 


In addition you have in some specific special situations the right to deny the processing of your personal data if a special personal situation warrants it.

How can you use your rights


If you want to use your aforementioned rights you can send a request concerning this to the controller whose contact information you can find at the beginning of this page. 


If the answer includes your personal data we will send you the information either in secure digital form or by post as a registered letter. The letter can not be signed delivered by anyone else than the person designated as the recipient. This way we can assured the confidentiality of the data. 


We can deny requests that are made unreasonably often, that are excessive or clearly unfounded.



Information on recipients of personal data


Personal data is processed by the employees of Paja&Bureau whose work tasks require the processing of this data. The processors of personal data are bound by professional secrecy. 


Customer registry information is no given outside Paja&Bureau Oy except in situations as mentioned below, when the law demands it, in the case of merger of acquisition or issues concerning collection. 


Customer information may be given to partners in the following situations:

  • Customer information may be in part be given to payment operators such as banks, loan companies and other payment service companies in order to fulfil services.


In addition to Paja&Bureau customers’ personal data is processed by Paja&Bureau’s service providers and partners in their name and according to their objectives. These subcontractors are for example IT service providers who handle technical upkeep of digital operating systems and partners who provide product and service delivery solutions for Paja&Bureau.

When personal data being processed as Paja&Bureau’s appointed task, the partner is bound by professional secrecy set by Paja&Bureau and the the partner is not allowed to hand over information to a third party or use the information for anything else than the task appointed by Paja&Bureau.


The most important recipients and processors of Paja&Bureau’s customer information are:


  • Payment service providers in the webstore: Checkout
  • IT service provides: Webaula Oy and Google LLC (Analytics)
  • Logistics companies, such as Posti 


Personal data is processed and stored only within the European financial zone.


Some officials have the right to access information based in the law. These officials include the police, customs, border control and tax officials.


The right to complain to the supervisory authority


If you feel that we are not processing your personal data according to the EU’s general data protection regulation, you can make a complaint to the supervisory authority in the EU member state where you reside or where your regular workplace is or where you see the breach has been made. In Finland the official in question is the data protection ombudsman


Office of the Data Protection Ombudsman

Ratapihantie 9, 6th floor

00520 Helsinki


PL 800

00521 Helsinki


+358 29 56 66700

+358 9 56 66735

Your data is not going to be used for anything else without your knowledge 


We will not use your data in other ways except the aforementioned. If later other uses come up that are compatible with their use toward which the data was originally collected, we will inform you about new uses and the legal processing means. If needed we will ask for your consent to process the data in new ways.