Privacy Policy

Updated: 28 August 2026

1. Data controller and contact details

Urjalan Makeistukku Oy
Business ID: 0904552-0
Turunväylä 52
31760 Urjala
Finland

Requests and enquiries concerning privacy and the processing of personal data:
tietoturva@urjalanmakeistukku.fi

Urjalan Makeistukku Oy acts as the data controller for the processing of personal data described in this Privacy Policy.

2. Scope of this Privacy Policy

This Privacy Policy explains how Urjalan Makeistukku Oy collects, uses, stores, discloses and otherwise processes personal data, and what rights data subjects have in relation to the processing of their personal data.

This Privacy Policy applies to the Urjalan Makeistukku Oy online store:

  • candy2000.com

This Policy applies to customers and purchasers using the online store, registered users, contact persons of business customers and other organisations, recipients of marketing communications and product availability notifications, persons contacting customer service, and other users of the online store.

Personal data is processed only for specified and lawful purposes and only to the extent necessary for those purposes.

3. Personal data we process

We may process the following personal data depending on how you use our online store and services:

Customer and contact details

  • name
  • email address
  • telephone number
  • billing and delivery address
  • company name and other contact details relating to a business customer relationship

Customer account information

  • customer account identifiers and contact details
  • information relating to sign-in and use of the account
  • information and preferences saved or selected by the customer in the service

Order and transaction information

  • orders and order history
  • information about ordered products, quantities, prices, discounts, deliveries and returns
  • necessary identifiers and status information relating to payment methods and payment transactions
  • information relating to customer service, feedback and complaints

Marketing and communication information

  • marketing consents and objections
  • information relating to the delivery and use of email and other marketing communications
  • information relating to subscriptions for product availability notifications
  • information relating to customer communications

Technical information relating to use of the online store

  • IP address
  • cookie identifiers and other online identifiers
  • browser, device and connection information
  • information relating to use of the online store, sessions and events
  • cookie and other privacy preferences

As a general rule, we do not intentionally collect or process personal data belonging to the special categories of personal data referred to in the GDPR.

4. Sources of personal data

We primarily obtain personal data directly from the data subject in connection with the use of the online store and our other services. Information is collected, for example, when a customer:

  • places an order or creates a customer account
  • contacts customer service or submits a complaint
  • subscribes to marketing communications or product availability notifications
  • participates in a campaign or provides feedback to us
  • uses the online store and makes choices concerning cookies and other tracking technologies

Information is also generated automatically when the online store is used, for example through cookies, log data and other similar technologies, in accordance with the user's consents and privacy choices.

We may also receive personal data from service providers where this is necessary, for example, to process a payment, deliver an order or provide another service connected with the online store.

Information concerning contact persons of business customers and other organisations may also be obtained from the organisation they represent and from public sources.

5. Purposes and legal bases for processing personal data

We process personal data only where there is a lawful basis under applicable data protection legislation. The applicable legal basis depends on the purpose for which the data is processed.

5.1 Performance of a contract and pre-contractual measures

We process personal data to perform a contract with the customer or to take steps at the customer's request before entering into a contract. This includes, for example:

  • receiving and processing orders
  • enabling payment
  • delivering orders and communicating about delivery
  • handling returns, refunds and complaints
  • providing customer accounts and related services
  • necessary communication relating to an order or customer relationship

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

5.2 Compliance with legal obligations

We also process personal data in order to comply with legal obligations that apply to us. These may include requirements relating to accounting, taxation, consumer protection and obligations imposed by public authorities.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

5.3 Legitimate interests

We may process personal data on the basis of the legitimate interests of Urjalan Makeistukku Oy or a third party, for example for:

  • managing and developing customer relationships
  • providing customer service
  • ensuring and improving the functionality, security and quality of our services
  • preventing and investigating fraud and misuse
  • establishing, exercising or defending legal claims
  • permitted direct marketing

Where processing is based on legitimate interests, we assess the necessity of the processing and balance those interests against the rights and interests of the data subject.

Legal basis: legitimate interests (Article 6(1)(f) GDPR).

5.4 Consent

We process personal data on the basis of consent where the processing requires the data subject's consent. Such purposes may include, for example:

  • electronic direct marketing where consent is required
  • sending product availability notifications
  • registration for a voluntary service or feature where processing is based on consent
  • non-essential cookies and other tracking technologies used for analytics, personalisation and marketing

Providing consent is voluntary. Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

Legal basis: consent (Article 6(1)(a) GDPR).

6. Customer accounts and registered users

It may be possible to create a customer account in the online store or to use other features intended for registered users.

In connection with a customer account, we process personal data in order to provide the account and related services. Such information may include contact details, delivery addresses, order history and information relating to use of the account.

Use of a customer account is voluntary and, as a general rule, creating an account is not required in order to purchase from the online store.

Customers can manage information stored in their customer account through the available features and may request rectification or erasure of their personal data as described in the section Data subject rights of this Privacy Policy.

Deleting a customer account from the online store does not necessarily delete personal data from all other systems used by Urjalan Makeistukku Oy. Information may be retained to the extent that retention remains necessary in order to comply with a legal obligation or where another lawful basis for processing applies.

7. Orders, payments and deliveries

We process customers' personal data in order to receive, process, take payment for and deliver orders and to communicate in connection with these activities.

Personal data processed to fulfil an order may include, for example, the customer's name, contact details, billing and delivery address, contents of the order and necessary information relating to payment and delivery.

Payments

We use external payment service providers to process payment transactions. Information necessary to process a payment is provided to the relevant payment service provider. Payment service providers may process personal data in accordance with their own privacy policies and legal obligations.

As a general rule, Urjalan Makeistukku Oy does not process or store customers' full payment card details.

Deliveries

In order to deliver an order, we disclose necessary personal data to the selected delivery or transport service provider. The information disclosed may include the recipient's name, delivery address, email address, telephone number and information concerning the order that is necessary to carry out the delivery.

The transport service provider may use the information to carry out the delivery and related communications in accordance with its own legal obligations and privacy policies.

Order and payment information may also be processed for accounting, taxation, returns, refunds, complaints, fraud prevention and other purposes relating to the handling of an order or compliance with legal obligations.

8. Customer service and customer communications

We process personal data in order to handle customer enquiries, questions, feedback, complaints and other customer service matters.

In connection with customer service, we may process, for example, the customer's name, email address, telephone number, order and customer information, and messages and other information provided to us that are necessary to resolve the matter.

We may contact the customer by email, telephone, text message or another appropriate method where this is necessary, for example, to deal with an order, delivery, payment, return, complaint or another matter relating to the customer relationship.

Information relating to customer service and customer communications may also be used to improve the quality of our services, our operations and the customer experience, and to investigate possible misuse or disputes.

Depending on the circumstances, the processing of personal data in connection with customer service is based on performance of a contract, compliance with a legal obligation or Urjalan Makeistukku Oy's legitimate interest in properly managing its customer relationships and business operations.

9. Electronic direct marketing

We may process personal data for electronic direct marketing, such as marketing by email and text message, in accordance with applicable legislation.

Electronic direct marketing may be sent on the basis of the recipient's consent. Electronic direct marketing may also be sent to existing customers without separate prior consent where the legal requirements for such marketing are met.

For marketing purposes, we may process, for example:

  • name and contact details
  • marketing consents and objections
  • customer and order information
  • customer segments and areas of interest
  • information relating to marketing messages sent and their use

Information may be used to target and personalise marketing and to measure the performance and effectiveness of marketing in accordance with applicable legislation and the user's privacy choices.

You may object to electronic direct marketing at any time free of charge by using the unsubscribe option provided in a marketing message or by contacting Urjalan Makeistukku Oy.

Where marketing is based on consent, consent may be withdrawn at any time. Withdrawal of consent or an objection to direct marketing does not affect the customer's ability to use the online store or receive necessary communications relating to an order or the customer relationship.

10. Product availability notifications

Customers may choose to subscribe to a notification about the availability of a product by providing their email address for this purpose.

Personal data provided for a product availability notification is used to send the requested notification when the relevant product becomes available again. The processing is based on the customer's consent.

Subscribing to a product availability notification does not constitute consent to other electronic direct marketing unless the customer separately provides such consent.

Information relating to product availability notifications is retained only for as long as necessary to provide the requested notification or until the customer withdraws consent.

11. Cookies and other tracking technologies

We use cookies and other similar technologies in our online store to enable the operation of the store, maintain security, improve the user experience and, with the user's consent, for analytics, personalisation and marketing.

Cookies and other tracking technologies may be divided into the following categories according to their purpose:

Necessary cookies

Necessary cookies and similar technologies are used for the technical operation and security of the online store, the shopping cart, sign-in, payment and implementation of the user's privacy choices. As a general rule, their use does not require consent where they are necessary to provide a service requested by the user.

Analytics and functional cookies

These may be used to measure and analyse use of the online store, improve the functionality of the service and the user experience, and provide features selected by the user.

Marketing and personalisation cookies

These may be used, for example, to target and measure marketing, personalise content shown to the user and evaluate advertising effectiveness.

Non-essential cookies and similar tracking technologies are used where the user has provided the consent required for their use. Users can make and change their cookie choices through the privacy settings available in the online store.

The cookies in use, their purposes, service providers and retention periods may change as the online store and the services used in it develop. Up-to-date information about cookies and the available choices can be found in the online store's cookie settings.

12. Shopify platform and Shopify Network Intelligence

Our online store operates on the Shopify platform. Shopify processes customers' personal data in order to provide the online store platform and related services. In these situations, Shopify generally acts as a processor on behalf of Urjalan Makeistukku Oy.

We use the Shopify Network Intelligence feature. In connection with this feature, Shopify may process personal data concerning customers and users of our online store together with information collected by Shopify from other merchants and Shopify services in order to provide and improve Shopify's enhanced services.

This information may be used, for example, for service development, personalisation, analytics, fraud prevention and the targeting and measurement of advertising and marketing. For these processing activities, Shopify acts as an independent controller in accordance with applicable data protection legislation.

The primary storage location for store, order and customer data stored in Shopify for our online store is the European Union. However, Shopify and its service providers may also process personal data outside the EU/EEA in order to provide their services. International transfers are protected using transfer mechanisms and safeguards that comply with applicable data protection legislation.

More information about how Shopify processes personal data as an independent controller and about privacy rights available through Shopify:
Shopify Privacy Policy
Shopify Privacy Portal

13. Recipients of personal data and service providers

We use external service providers to process personal data where this is necessary to operate our online store and provide our other services.

Personal data may be processed by or disclosed to, for example, the following categories of recipients:

  • online store, hosting and IT service providers
  • payment and financing service providers
  • transport, logistics and delivery service providers
  • customer service and communications service providers
  • marketing and analytics service providers
  • accounting, financial administration and other service providers supporting our business
  • public authorities and other parties where disclosure is required by law or there is another lawful basis for the disclosure

Service providers may process personal data on behalf of Urjalan Makeistukku Oy as processors or may act as independent controllers in relation to their own services and legal obligations.

Where service providers act as processors, we ensure that appropriate data processing agreements and other safeguards required by applicable data protection legislation are in place.

We disclose to service providers only the personal data that is necessary for the relevant service or another specified purpose.

We do not sell personal data to third parties.

14. Transfers of personal data outside the EU/EEA

We aim to use services and solutions in which personal data is primarily processed within the European Union or the European Economic Area. However, some of our service providers or their subcontractors may also process personal data outside the EU/EEA.

Where personal data is transferred outside the EU/EEA, we ensure that there is a lawful basis for the transfer under applicable data protection legislation and that appropriate safeguards are used to protect the personal data.

Transfers may, for example, be based on an adequacy decision adopted by the European Commission or on the European Commission's Standard Contractual Clauses (SCCs). Depending on the service provider and the transfer, other transfer mechanisms and supplementary safeguards permitted under applicable data protection legislation may also be used.

The primary storage location for store, order and customer data stored in Shopify for our online store is the European Union. However, Shopify and its service providers may still process personal data outside the EU/EEA in order to provide their services.

15. Retention of personal data

We retain personal data only for as long as necessary for the purposes for which it is processed or for as long as required by applicable legislation.

When determining retention periods, we take into account, among other things, the purpose of the processing, the duration of the customer relationship, the necessity of the data, statutory retention requirements and the need to investigate or defend possible legal claims.

As a general rule, data is retained according to the following principles:

  • Order, payment and accounting information is retained for as long as necessary to handle the order and customer relationship and to comply with accounting, tax and other legal obligations.
  • Customer account information is retained for the duration of the customer account and customer relationship and thereafter only for as long as there is a justified need or legal obligation to retain the information.
  • Information relating to customer service, returns and complaints is retained while the matter is being handled and thereafter for as long as necessary, for example, to manage the customer relationship or investigate possible legal claims.
  • Marketing information is retained for as long as it is needed for the marketing purpose or until the data subject withdraws consent or exercises the right to object to direct marketing. A record of a marketing objection may be retained in order to ensure that the objection is respected.
  • Information relating to product availability notifications is retained for as long as necessary to provide the requested service or until consent is withdrawn.
  • Information collected through cookies, analytics and other tracking technologies is retained in accordance with its purpose, the user's privacy choices and the retention practices of the services used.

When there is no longer a lawful basis for retaining personal data, the data is appropriately deleted or anonymised.

16. Protection of personal data

We protect personal data through appropriate technical and organisational measures against unauthorised or unlawful processing and against accidental loss, destruction, alteration or unauthorised disclosure.

Access to personal data is limited to persons whose duties or responsibilities require such access. Access rights are managed and restricted according to the need for processing.

Service providers that process personal data are required to maintain an appropriate level of data protection and information security in accordance with their role and applicable legislation.

Security measures are assessed and developed taking into account the nature of the personal data, the risks associated with the processing and the technical and organisational measures available.

17. Data subject rights

Under applicable data protection legislation, data subjects have rights in relation to the processing of their personal data. The availability of individual rights depends, among other things, on the purpose and legal basis of the processing.

Right of access

Data subjects have the right to obtain confirmation as to whether we process personal data concerning them and to obtain access to the personal data being processed and information concerning that processing.

Right to rectification

Data subjects have the right to request correction or completion of inaccurate or incomplete personal data.

Right to erasure

In certain circumstances, data subjects have the right to request erasure of their personal data. Deleting a customer account from the online store does not necessarily delete personal data from all other systems used by Urjalan Makeistukku Oy.

A data subject may request erasure of personal data by contacting tietoturva@urjalanmakeistukku.fi. Following an erasure request, personal data will be deleted or anonymised from systems and records where there is no longer a lawful basis for retaining it.

Information concerning an order, accounting entry or other business transaction may be retained without personal data that enables the customer to be identified where retention of the underlying transaction is necessary. Personal data may also be retained to the extent required by a legal obligation or another lawful basis under the GDPR.

Right to restriction of processing

In the circumstances specified in the GDPR, data subjects have the right to request restriction of the processing of their personal data.

Right to object to processing

In certain circumstances, data subjects have the right to object to processing of their personal data based on legitimate interests.

Data subjects always have the right to object to the processing of their personal data for direct marketing purposes. Once a person has objected to direct marketing, their personal data will no longer be processed for that purpose.

Right to data portability

In certain circumstances, data subjects have the right to receive personal data that they have provided in a structured, commonly used and machine-readable format and to transmit that data to another controller where the processing is based on consent or a contract and is carried out by automated means.

Right to withdraw consent

Where processing of personal data is based on consent, the data subject may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Requests concerning data subject rights:
tietoturva@urjalanmakeistukku.fi

We may request additional information where necessary to verify the identity of the person making the request. Requests will be handled within the time limits required by applicable data protection legislation.

18. Right to lodge a complaint with a supervisory authority

If a data subject considers that their personal data has been processed in breach of data protection legislation, they have the right to lodge a complaint with a competent data protection supervisory authority.

In particular, a complaint may be lodged in the EU or EEA country where the data subject has their habitual residence or place of work, or where the alleged infringement took place.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.
Up-to-date contact details and instructions for lodging a complaint are available on the supervisory authority's website.

19. Changes to this Privacy Policy

We may update this Privacy Policy, for example, if our personal data processing practices, the services we use or applicable legislation change.

The current version of this Privacy Policy is always available in our online store. We recommend reviewing the Privacy Policy from time to time. The date shown at the beginning of the Policy indicates when it was last updated.