Privacy Policy

Customer Service
Phone +358 (0) 207 611 311 (switchboard)
Email: gdpr@kalevala.fi

We process the following categories of personal data:

• Basic customer information, such as first and last name, contact details, date of birth and gender; for business customers, the contact details of the contact person; and for sole traders, also the business ID and basic company information
• Order, delivery and payment information, such as ordered products, order date, pricing information and purchase history, delivery address and method, payment and billing information, and information related to product returns, repairs and maintenance
• Membership programme information, such as membership status and membership start/end date
• Customer service and transaction information, such as contacts and their content, responses to contacts, information related to complaints and refunds, and the reason code for feedback
• Information related to marketing communications and activities, such as marketing consents and opt-outs, newsletter subscriptions, information on direct marketing activities (e.g. marketing messages and invitations sent) and factory visit registrations
• Login information, such as user credentials and log data
• Information provided by the customer, such as jewellery preferences and wishlist products
• Feedback information, such as product reviews and customer feedback, and responses to market research and customer surveys
• Information related to social media community pages, such as messages, comments and analytics data
• Information on the use of online services, such as data collected through cookies and other similar technologies (e.g. tracking pixels), and cookie preferences

The personal data we process depends on the type of interaction, customer relationship or other relationship the person has with us (for example, using the website, placing an order, contacting customer service or subscribing to the newsletter). Certain information, such as the information needed to process and deliver orders and handle complaints, is necessary. If this information is not provided, we may be unable to deliver an order, handle your enquiry or fulfil our legal or contractual obligations. We do not process more data than is necessary in each situation and for the relevant purpose of processing described below.

Data is primarily collected from the customer or other person themselves, or it is generated when they use our online services. Names, contact details and updates to them may also be obtained from authorities and companies that provide contact information and updating services.

a) We process personal data on the basis of the contract between the customer and Kalevala Koru for the following purposes:

Providing services, selling products and managing orders

• Online store transactions and processing of orders and sales transactions
• Delivery of and payment for orders
• Management of pick-up point orders
• Registration and login to the online service
• Communications related to orders and the contractual relationship

Handling returns and product complaints, and maintenance and repair services

• Processing refund requests and compensation claims, and paying refunds
• Processing product returns
• Processing and carrying out maintenance and repair orders

Providing the membership programme (Kalevala Community)

• Operating the membership programme in accordance with its terms, such as offering benefits and communications related to the membership programme

b) We process personal data on the basis of Kalevala Koru's legitimate interest for the following purposes:

Customer service

• Processing and responding to enquiries

Improving the customer experience and developing products, services and business

• Conducting customer surveys and market research
• Collecting, processing and analysing product reviews and feedback
• Developing products, the product range, service quality and the customer experience
• Monitoring, analysing, forecasting, planning and developing the business, its performance and processes, as well as analytics, statistics and reporting, including the pseudonymisation and anonymisation of personal data

Marketing and sales promotion

• Marketing planning, target group analyses and selections, and classification or segmentation of the customer base
• Sales, marketing and direct marketing
• Targeting marketing to products and services likely to interest the customer or potential customer
• Monitoring, measuring, analysing and developing the effectiveness of marketing activities and sales
• Organising and running competitions, prize draws and events

You may object to the processing of your personal data for direct marketing by contacting our customer service.

Processing of business customers' contact person data for administrative purposes

• Managing the customer and contractual relationship and related communications and transactions
• Processing, delivering and invoicing orders

Information security and misuse management

• Developing and maintaining information security
• Preventing, detecting, investigating and managing misuse, fraud and other crimes, and referring them for investigation

Legal claims

• Preparing, defending and responding to legal claims, for example in criminal and damages matters and consumer law matters

Kalevala Koru's legitimate interest is to conduct and develop its business, to market and promote the sale of its products and services, to maintain and improve the functionality and security of its services, and to protect its rights and interests as part of its normal business operations.

c) We process personal data to comply with statutory obligations for the following purposes:

• Financial administration and accounting
• Fulfilling the seller's statutory liability for defects and product liability
• Recalls of dangerous products
• Disclosing personal data to authorities in accordance with legal obligations
• Notifying personal data breaches (to the authority / data subjects)
• Fulfilling the rights of data subjects

Electronic direct marketing

We send electronic direct marketing, for example by email, to those who have given their consent or subscribed to our newsletter. Consent can be withdrawn by contacting our customer service or via the link included in the message.

We may also send electronic direct marketing without consent to representatives or contact persons of companies or other organisations regarding products or services related to the data subject's duties or position. You may opt out of electronic direct marketing at any time by contacting our customer service or via the link included in the message.

Use of artificial intelligence

We may use artificial intelligence and AI-based tools to support the processing purposes described in this policy. AI may be used, for example, in business support functions and analytics, and in the planning, evaluation and development of our products, services, marketing and business. However, we do not use personal data for automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you. Personal data is also not used to train AI models.

Community pages and joint controllership

Kalevala Koru maintains pages (so-called community or fan pages) on social media services such as Facebook and TikTok. Kalevala Koru processes data collected through its social media pages for marketing, running competitions and prize draws, receiving feedback, and for development and customer service purposes on the legal bases described above. With regard to these pages, Kalevala Koru and the social media service provider, such as Meta, act as joint controllers where applicable, for example regarding page visitor data. More information:

• Meta Platforms Ireland: Page Controller Addendum and Meta's Privacy Policy
• TikTok Technology Limited: information about TikTok Analytics, the joint controller agreement and TikTok's Privacy Policy

We use subcontractors and partners, such as IT and cloud service providers and business support service providers, in processing personal data and in producing and providing our services.

We may disclose personal data:

• To transport or logistics service providers for the delivery of orders
• To the payment service provider according to the payment method you have chosen
• To authorities within the limits permitted and required by law
• To establish, exercise or defend legal claims, to collect receivables, and to investigate possible breaches or misuse
• In connection with business arrangements (e.g. a business transfer or merger), to the parties involved in the arrangement and their advisers

Personal data may be transferred outside the EU/EEA if service providers located outside the EU/EEA, or processing personal data outside it, are involved in the processing. Transfers of personal data outside the EU/EEA comply with the EU General Data Protection Regulation. A transfer may be based, for example, on an adequacy decision of the European Commission, the EU–U.S. Data Privacy Framework where the recipient is certified under it, or the Standard Contractual Clauses approved by the European Commission, supplemented by additional safeguards where necessary.

Kalevala Koru's website uses cookies and other similar technologies, such as tracking pixels ("cookies"). Cookies are small text files stored on the user's device when they use websites. Cookies store information during use of the website and between visits. Through cookies, analytics records, among other things, the user's IP address, the time of the visit, the pages visited, the browser type used, the web address from which the user arrived at the website, and the server from which the user came to the site.

Our Cookie Policy provides more information about cookies, their purposes, retention periods and service providers. Cookies other than strictly necessary cookies are optional, and we ask for your consent to their use. You can change your choices at any time in the cookie settings at the bottom of the page under the Customer Service heading.

Under the General Data Protection Regulation, data subjects have the following rights:

• Right of access: the right to obtain confirmation as to whether Kalevala Koru processes personal data concerning them, to request access to their personal data and to receive a copy of it;
• Right to rectification: the right to request the correction of inaccurate data and the completion of incomplete data;
• Right to erasure: the right to request the erasure of personal data in certain situations under the GDPR;
• Right to restriction of processing: the right to request the restriction of processing under the conditions set out in the GDPR;
• Right to object: the right to object at any time to the processing of personal data for direct marketing. The data subject may object to other processing on grounds relating to their particular situation where the processing is based on legitimate interest. However, Kalevala Koru may refuse the request if there are compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject, or if the processing is necessary for the establishment, exercise or defence of legal claims;
• Right to data portability: the right to receive the personal data they have provided to Kalevala Koru in a structured, commonly used and machine-readable format, and the right to transmit it to another controller, where the processing is based on consent or the performance of a contract and is carried out by automated means;
• Right to withdraw consent: the right to withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal; and
• Right to lodge a complaint: the right to lodge a complaint with the supervisory authority (Office of the Data Protection Ombudsman, www.tietosuoja.fi/en)

You can request more information about your rights and send related requests to: gdpr@kalevala.fi

Where necessary, we may ask for additional information to verify your identity before fulfilling the request.

We may update this privacy policy when necessary, for example due to changes in legislation, guidance from authorities, our processing activities or our practices. Changes take effect when the updated privacy policy is published on our website. We recommend that you review this policy regularly. If the changes are material, we will notify registered customers separately in an appropriate manner (e.g. by email).