Privacy policy
Last updated: September 25, 2026
Eira Haul Oy (“Eira Haul”, “we”, “us” or “our”) operates this website and online store, including our products, services, content and related features (the “Services”).
This Privacy Notice explains how we collect, use, store and disclose personal data when you visit our website, use our Services, purchase our products, create an account, contact us, or otherwise interact with us.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), applicable Finnish data protection legislation, and other applicable laws.
1. Data controller
Eira Haul Oy is the data controller responsible for the processing of your personal data described in this Privacy Notice.
Eira Haul Oy
Business ID: 3646556-3
Email: hello@eirahaul.fi
If you have any questions about how we process your personal data or wish to exercise your data protection rights, you can contact us using the details above.
2. Personal data we collect
Depending on how you interact with our Services, we may collect and process the following types of personal data:
Information you provide to us
This may include:
- Name
- Billing and delivery address
- Email address
- Telephone number
- Account information, such as login details and preferences
- Information included in customer service communications
- Information you provide when submitting reviews or other content
- Information you provide when participating in promotions, competitions or other activities
- Order and transaction information
When you purchase from us, we may process information such as:
- Products purchased
- Order number
- Order date
- Order value
- Delivery information
- Return, refund, exchange or cancellation information
- Payment method and payment status
Payment card details are generally processed by our payment service providers rather than stored directly by Eira Haul. The payment information processed by a payment provider is subject to that provider’s own privacy notice.
Technical and usage information
When you visit or use our website, we may automatically collect certain technical information, including:
- IP address
- Browser type and version
- Device type
- Operating system
- Approximate location derived from your IP address
- Pages visited
- Products viewed
- Referring website
- Date and time of visits
- Information about how you interact with our website
- Cookies and similar technologies
We use this information to operate, secure and improve our website and, where applicable, for analytics and marketing purposes.
3. How we collect personal data
We may collect personal data:
- Directly from you when you place an order, create an account, contact us, subscribe to marketing communications, or otherwise provide information to us;
- Automatically when you browse or use our website through cookies and similar technologies;
- From service providers that process information on our behalf, such as payment, shipping, hosting, analytics and technology providers; and
- From other third parties where permitted by applicable law.
4. Why we process your personal data
We process personal data only where we have a lawful basis to do so.
Processing and fulfilling orders
We process information necessary to:
- Process and fulfil your orders;
- Process payments;
- Arrange delivery;
- Provide order confirmations and delivery updates;
- Handle returns, refunds and exchanges;
- Provide customer support; and
- Manage customer accounts.
The legal basis for this processing is generally the performance of a contract with you.
Legal and accounting obligations
We may process personal data when necessary to:
- Comply with accounting, tax and other legal requirements;
- Maintain required business records;
- Respond to lawful requests from authorities; and
- Fulfil other legal obligations applicable to us.
The legal basis for this processing is compliance with a legal obligation.
Website operation and security
We may process technical and usage information to:
- Operate and maintain our website;
- Protect our website and systems;
- Detect and prevent fraud, abuse and other unlawful activity;
- Troubleshoot technical problems; and
- Protect our customers, business and services.
The legal basis for this processing may be our legitimate interests, where those interests are not overridden by your rights and freedoms, or another legal basis where required by law.
Analytics and improving our Services
Where permitted and where required, we may use cookies and similar technologies to understand how visitors use our website and to improve our products, website and customer experience.
Where consent is required, we will ask for your consent before placing or using the relevant non-essential cookies.
Marketing
With your consent where required by law, we may send you marketing communications about our products, offers, launches and other updates.
You can unsubscribe from marketing emails at any time by using the unsubscribe link included in the message or by contacting us.
We may also use information about your interaction with our website for advertising and marketing purposes where permitted by applicable law and, where required, based on your consent.
You may continue to receive non-marketing communications, such as order confirmations, delivery updates and other messages necessary to provide our Services.
5. Cookies and similar technologies
Our website uses cookies and similar technologies to provide essential website functionality, remember preferences, understand how visitors use our website, and, where applicable, support marketing and advertising.
Some cookies are necessary for the operation and security of the website and cannot be disabled through our cookie consent tools.
Where required by law, we will ask for your consent before using non-essential cookies, including certain analytics and advertising cookies.
You can manage your cookie preferences through the cookie settings available on our website. You can also adjust your browser settings to block or delete cookies.
Please note that disabling certain cookies may affect the functionality of our website.
6. Who we share personal data with
We may share personal data with trusted third parties where necessary to operate our business and provide our Services.
These may include:
Shopify
Our online store is hosted and powered by Shopify. Shopify provides the technology that enables us to operate our online store and process transactions.
Shopify may process personal data in connection with providing its services to us and may also process certain information for its own purposes as described in Shopify's privacy documentation.
For more information, please see Shopify's Consumer Privacy Policy.
Payment providers
We use payment service providers to process payments securely. Depending on the payment method you choose, your personal data may be processed by the relevant payment provider.
Delivery and shipping providers
We may share the information necessary to deliver your order with shipping and delivery providers, including Posti.
This may include your name, delivery address, telephone number, email address and other information necessary for delivery.
Service providers
We may use third-party service providers for services such as:
- Website hosting and technology
- IT and technical support
- Accounting and bookkeeping
- Customer support
- Email communications
- Analytics
- Fraud prevention and security
- Marketing and advertising
- Cloud storage and other business services
These providers may process personal data on our behalf and are required to process it in accordance with applicable data protection requirements.
Legal and business purposes
We may disclose personal data where necessary to:
- Comply with applicable laws or legal obligations;
- Respond to lawful requests from authorities;
- Establish, exercise or defend legal claims;
- Protect our rights, property or safety;
- Investigate fraud or other unlawful activity; or
- Facilitate a business transaction such as a merger, acquisition or sale of assets.
We do not sell your personal data.
7. International transfers
Some of our service providers may process or store personal data outside Finland or the European Economic Area (“EEA”).
Where personal data is transferred outside the EEA, we will ensure that the transfer is carried out in accordance with applicable data protection law. This may include relying on an adequacy decision by the European Commission, Standard Contractual Clauses, or another legally recognised transfer mechanism.
8. How long we keep personal data
We retain personal data only for as long as necessary for the purposes described in this Privacy Notice or as required by applicable law.
Retention periods depend on the type of information and why we need it.
For example:
- Order and transaction information is retained for as long as necessary to fulfil the order, handle potential complaints, returns or disputes, and comply with accounting and tax requirements.
- Customer account information is generally retained while your account remains active or for as long as necessary to provide the Services.
- Customer service communications are retained for as long as necessary to handle your enquiry and, where appropriate, to protect our legitimate interests.
- Marketing information is retained until you withdraw your consent or unsubscribe, unless we have another lawful reason to retain it.
- Accounting and legally required records are retained for the periods required by applicable Finnish legislation.
When personal data is no longer needed, we will delete it or anonymise it where reasonably possible.
9. Your rights
Under the GDPR and applicable data protection law, you may have the following rights in relation to your personal data:
Right of access
You may request confirmation as to whether we process your personal data and, where applicable, request a copy of the personal data we hold about you.
Right to rectification
You may request that inaccurate or incomplete personal data be corrected.
Right to erasure
In certain circumstances, you may request that we delete your personal data.
This right is not absolute, and we may be required to retain certain information to comply with legal obligations or to establish, exercise or defend legal claims.
Right to restriction of processing
In certain circumstances, you may request that we restrict the processing of your personal data.
Right to object
You may have the right to object to certain processing based on our legitimate interests.
You may also object to the processing of your personal data for direct marketing purposes at any time.
Right to data portability
Where applicable, you may have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format and to request that it be transmitted to another controller.
Right to withdraw consent
Where we process your personal data based on your consent, you may withdraw your consent at any time.
Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew your consent.
10. How to exercise your rights
To exercise any of your rights, please contact us at:
We may need to verify your identity before fulfilling a request in order to protect your personal data.
We will respond to requests within the time period required by applicable law.
In some circumstances, we may be unable to fulfil a request, for example where we are legally required to retain certain information. If this occurs, we will explain the reason where permitted by law.
11. Complaints
If you have concerns about how we process your personal data, we encourage you to contact us first at:
You also have the right to lodge a complaint with the relevant data protection supervisory authority.
In Finland, the relevant supervisory authority is:
Office of the Data Protection Ombudsman
Tietosuojavaltuutetun toimisto
Finland
More information about the Finnish data protection authority and how to lodge a complaint is available through its official website.
12. Children's data
Our Services are intended for a general audience and are not specifically directed at children.
We do not knowingly collect personal data from children in circumstances where applicable law prohibits such collection.
If you believe that a child has provided us with personal data and you would like us to review or delete that information, please contact us at hello@eirahaul.fi.
13. Third-party websites and services
Our website may contain links to third-party websites, applications or services.
We are not responsible for the privacy practices, security or content of third-party websites or services. If you follow a link to a third-party website, we recommend that you review its privacy notice before providing personal data.
14. Shopify
Our online store is powered by Shopify.
Shopify processes personal data in connection with providing its platform and related services. Shopify may also process certain personal data independently for its own purposes.
For more information about how Shopify processes personal data, please review Shopify's Consumer Privacy Policy and related privacy information.
15. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes to our business, Services, technology, legal requirements or data-processing practices.
When we make changes, we will update the “Last updated” date at the top of this Privacy Notice and provide any additional notice required by applicable law.
16. Contact us
If you have questions about this Privacy Notice, our privacy practices, or your personal data, please contact us:
Eira Haul Oy
Business ID: 3646556-3
Email: hello@eirahaul.fi
We are the data controller for the personal data described in this Privacy Notice.