Privacy Policy

1. Controller and contact details

Sisuvalo Oy is the controller for the processing described in this Policy. Please use the contact details above for privacy questions or requests.

2. Personal data we collect

Data you provide to us

• name, email address, telephone number and the contents of messages;
• customer-account details, username and password hash;
• billing address and other information required for payment and taxation;
• order details, products, amounts, payment status and transaction references;
• product ratings, reviews and the display name chosen for publication;
• your cookie and privacy choices; and
• any other information you voluntarily provide.

Data collected automatically

• IP address and approximate location derived from it;
• browser, device type, operating system and language;
• date and time of access, requested pages, referring URL and technical logs;
• cookie identifiers and consent status; and
• website interactions and conversion events where you have consented to analytics or marketing technologies.

We normally receive personal data directly from you, from your browser or device, or from service providers involved in an order or payment.

3. Why we use personal data and our legal bases

Where processing is based on consent, you may withdraw that consent at any time with effect for the future. Withdrawing consent does not affect processing that was lawful before withdrawal.

4. Website hosting and server logs

Our website and email services are hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The host may process IP addresses, access times, requested files, referrer information, browser data and error or security logs to deliver the website, maintain technical security and diagnose faults.

The legal basis is our legitimate interest in providing a reliable and secure website (Art. 6(1)(f) GDPR). The provider processes data on our behalf under a data-processing agreement. Further information is available in the ALL-INKL.COM privacy information.

5. WooCommerce, customer accounts and orders

Our online farm shop uses WordPress and WooCommerce. When you browse the shop, place products in the cart, create an account or place an order, we may process:

• products viewed, cart contents and selected preferences;
• name, email, telephone number and billing address;
• account login details and password hash;
• order contents, prices, tax information, payment status and transaction identifiers; and
• IP address, browser information and timestamps for security, checkout and fraud prevention.

We currently offer collection from our farm shop and do not ship orders. We may nevertheless request billing or location information where it is required for payment processing, invoicing or correct tax treatment.

Customer accounts are optional unless a particular service clearly states otherwise. Account information is used to manage login access, saved billing details and order history. You may request deletion of your account; information that must be retained for accounting, taxation, fraud prevention or legal claims will not be deleted until the applicable retention period has expired.

6. Payment processing

Stripe, card payments, Apple Pay and Google Pay

Online payments are processed by Stripe. Depending on the device and payment method, Stripe may also enable card payments, Apple Pay or Google Pay. Stripe receives information required to process and secure the payment, such as name, billing details, payment instrument information, transaction amount, device data, IP address and fraud-prevention signals. Stripe Tax may process billing or location information and transaction details to calculate applicable taxes.

Sisuvalo Oy does not receive or store your complete card number. We receive information such as the payment status, payment method type and transaction reference. Payment processing is necessary to perform the purchase contract (Art. 6(1)(b) GDPR), and related accounting and tax data is processed to comply with legal obligations (Art. 6(1)(c)).

Stripe may process data as our service provider and, for certain purposes such as fraud prevention and regulatory compliance, as an independent controller. Details are provided in Stripe’s Privacy Policy. Apple Pay and Google Pay may also process data under their own terms and privacy policies when you choose those wallet services.

MobilePay and cash at the farm

MobilePay and cash payments are offered on site and are not processed by this website. For MobilePay transactions, we may receive transaction details such as the payer name, amount, date and payment reference. We retain the transaction information required for bookkeeping and taxation. Cash payments do not involve online payment data, but the sale is recorded as required by accounting and tax law.

7. Contact forms and correspondence

When you contact us through a website form, by email or by telephone, we process the information you provide in order to answer your enquiry, arrange a visit, provide customer service or take steps requested before a contract is made.

Our forms may be provided through WPForms. Depending on the form settings, submissions may be transmitted to us by email and may also be stored in the WordPress database. Form data is not used for unrelated marketing unless you have separately consented to that use.

Please do not use ordinary website forms to send sensitive personal data unless we specifically request it through an appropriate channel.

8. Product reviews

If product reviews are enabled and you submit a review, we may process and publish your chosen display name, rating, review text and submission date. Your email address is used for administration and is not published. Technical information such as an IP address may be processed to detect spam, fraud or abusive content.

Reviews may be moderated before or after publication. We may remove unlawful, misleading, abusive or irrelevant content. You may ask us to remove or anonymise a review by contacting info@sisuvalo.eu.

9. Cookies and consent management

We use cookies and similar technologies to operate essential website and shop functions, remember cart and account choices, protect forms, measure website use and, where permitted, measure marketing performance.

Strictly necessary technologies are used because they are required to provide the website or a service you requested. Analytics, marketing and other non-essential technologies are activated only after you give the relevant consent through our cookie banner. You can withdraw or change your consent at any time using the cookie settings available on the website.

We use Complianz to record and manage cookie choices. Information about individual cookies, providers, purposes and storage periods is provided in our Cookie Policy and in the cookie settings.

10. Google services

Google Analytics

With your consent, we use Google Analytics to understand how visitors use the website and to improve its content, performance and usability. Google Analytics may process information such as pages viewed, interactions, approximate location, device and browser information, referral source, cookie identifiers and timestamps.

Google states that Google Analytics does not log or store IP addresses for users in the EU. Analytics is activated only after the relevant consent. We configure event-level user data retention for no longer than 14 months, while aggregated reports may be retained without directly identifying you. The legal basis is consent (Art. 6(1)(a) GDPR).

Google Maps

We embed Google Maps to show our farm location. The map is loaded only after you consent to the relevant external-content or marketing category. When loaded, Google may receive your IP address, device and browser data, location-related information and information about your interaction with the map. If you are signed in to Google, Google may associate the visit with your account.

Google reCAPTCHA

Where enabled, Google reCAPTCHA helps protect forms and account functions from spam, abuse and automated submissions. It may analyse device and browser information, IP address, cookies, mouse movements, time spent on the page and other interaction signals. Google states that reCAPTCHA sets the necessary _GRECAPTCHA cookie when it performs its risk analysis. Depending on the implementation, reCAPTCHA is loaded only after the applicable consent or is used on the basis of our legitimate interest in website security and spam prevention (Art. 6(1)(f) GDPR).

Google services are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information is available in Google’s Privacy Policy. You can withdraw consent through our cookie settings.

11. Meta Pixel

With your consent, we may use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The Pixel helps us measure whether visitors arrive through advertising and how they interact with our website and shop.

Depending on our configuration, Meta may receive browser and device data, IP address, cookie or advertising identifiers, pages viewed, product and cart interactions, purchases and timestamps. Meta may combine this information with data from Facebook, Instagram or other Meta services, particularly if you are logged in to those services.

The Meta Pixel and related marketing cookies are activated only after your consent (Art. 6(1)(a) GDPR). You may withdraw consent through our cookie settings. Further details are available in Meta’s Privacy Policy.

12. Recipients and international transfers

We disclose personal data only where necessary, including to:

• hosting, website-maintenance, form and IT service providers;
• Stripe and the financial institutions involved in a payment;
• Google and Meta where you have activated the relevant services;
• accounting, legal or professional advisers subject to confidentiality; and
• public authorities where disclosure is required by law.

Our hosting takes place in the European Union. Some providers, including Stripe, Google and Meta, may process information outside the European Economic Area. Where personal data is transferred to a country without an EU adequacy decision, the transfer is based on appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Providers may also rely on an applicable adequacy framework, such as the EU–US Data Privacy Framework, where valid and applicable.

13. How long we retain data

We keep personal data only for as long as necessary for the purpose for which it was collected and for any applicable legal, accounting, tax or limitation period. In particular:

• order, invoice, payment and accounting materials are generally retained for at least six years after the end of the relevant year, or longer where Finnish law requires;
• customer-account data is retained while the account remains active and is deleted or anonymised after a valid deletion request, except for data that must remain with order or accounting records;
• contact enquiries are normally retained for up to 12 months after the matter is concluded, unless they relate to a contract, legal obligation or dispute;
• product reviews are retained while the review remains relevant and published, unless deletion is requested or continued retention is required for legal reasons;
• Google Analytics event-level user data is retained for no longer than 14 months under our Analytics settings;
• server and security logs are retained for the period reasonably necessary to detect misuse, investigate incidents and maintain service security; and
• consent records are retained for as long as necessary to demonstrate compliance and are updated when you change or withdraw your choice.

Data may be retained longer where necessary to establish, exercise or defend legal claims or where a legal hold applies.

14. Your data-protection rights

Subject to the conditions in applicable law, you may have the right to:

• receive information about how your personal data is processed;
• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request erasure of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain data in a structured, commonly used and machine-readable format;
• withdraw consent at any time for future processing; and
• lodge a complaint with a supervisory authority.

To exercise your rights, email info@sisuvalo.eu. We may ask for information necessary to verify your identity. Rights are not absolute; for example, we may need to retain records required by accounting or tax law.

Supervisory authority in Finland

Office of the Data Protection Ombudsman
P.O. Box 800
00531 Helsinki
Finland
Email: tietosuoja@om.fi
Website: tietosuoja.fi/en

15. Security and automated processing

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include encrypted website connections, access controls, software updates, backups and limiting access to those who need the data.

Sisuvalo Oy does not make decisions producing legal or similarly significant effects solely through automated processing. Payment and security providers may use automated fraud and risk analysis under their own legal obligations and privacy policies.

16. Children’s data

The website shop and customer-account functions are intended for adults. Farm visits and experiences may involve children, but bookings and related communications should be made by a parent, guardian or other responsible adult. If information about a child is necessary for an activity, we collect only what is reasonably required for safety, administration and delivery of the activity, and we obtain it from the responsible adult.

17. Changes to this Privacy Policy

We may update this Privacy Policy when our website, services or legal obligations change. The current version is published on this page and the “Last updated” date above shows when it was most recently revised. Material changes will be communicated through the website or another appropriate channel where required.