Privacy policy

This notice explains how eBrands Global Oy processes personal data in the Luonkos online store. We comply with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (1050/2018).

1. Controller

eBrands Global Oy
Pieni Roobertinkatu 9
00130 Helsinki
Finland
Business ID: 3181726-7

For data protection matters, data subjects can contact the controller at: wecare@luonkos.com

2. What data we process

  • Name, billing and delivery address, email address and telephone number
  • Order and payment transaction data and payment confirmations (we do not store full card details)
  • Customer service correspondence
  • Product reviews, if you leave one
  • Store usage and browsing data, device data and IP address
  • Marketing permissions and objections

3. Purposes and legal bases

  • Processing orders, delivery, returns and customer service — performance of a contract (GDPR Art. 6(1)(b))
  • Accounting and other statutory obligations — legal obligation (Art. 6(1)(c))
  • Fraud prevention, information security and service development — legitimate interest (Art. 6(1)(f))
  • Electronic direct marketing and marketing targeting — consent (Art. 6(1)(a)). You may withdraw consent at any time.
  • Marketing by other eBrands Global Oy brands — consent (Art. 6(1)(a)). We disclose your contact details to other brands owned by eBrands Global Oy, for their own marketing, only if you have given separate consent to it. That consent is optional, it is asked for separately, and it is not tied to placing an order or to the Luonkos newsletter. You can withdraw it at any time at wecare@luonkos.com or from the unsubscribe link in any marketing message.
  • Non-essential cookies and analytics — consent given in the cookie banner

4. Sources of data

We receive data from you when you order, create an account, contact us or subscribe to the newsletter, and automatically from your use of the online store.

5. Recipients

We disclose data only to the extent needed to provide the service:

  • Shopify — ecommerce platform
  • Payment service providers — Paytrail Oyj and Shopify Payments, depending on country
  • Transport and logistics partners — including PostNord and DHL, depending on destination country
  • Marketing and analytics service providers
  • Other brands owned by eBrands Global Oy — only if you have given separate consent to marketing by them. Each brand then acts as its own controller.
  • Authorities, where required by law

We do not sell personal data.

6. Transfers outside the EU and EEA

Some of our service providers process data outside the EU and EEA. In those cases the transfer is based on the standard contractual clauses approved by the European Commission, or on a Commission adequacy decision.

7. Retention periods

  • Order and payment data: six years from the end of the financial year, as required by accounting law
  • Customer service correspondence: no more than two years from contact
  • Marketing permissions: until you withdraw consent
  • Browsing and analytics data: no more than 26 months

8. Your rights

You have the right to:

  • access your data and obtain a copy of it
  • have inaccurate data rectified
  • request erasure of your data
  • restrict processing
  • object to processing based on legitimate interest
  • data portability
  • withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal

To exercise your rights, contact wecare@luonkos.com. We respond within one month.

9. Right to lodge a complaint with a supervisory authority

If you consider that we process your data unlawfully, you may lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi) or with the data protection authority of your country of residence.

10. Information security

Data is protected by access control, encryption and firewalls. Only those whose duties require it process the data, and they are bound by a duty of confidentiality.

11. Changes

We update this notice as needed. Last updated: 24.09.2026.