Privacy Policy

Last updated: 11.08.2026

This Privacy Policy explains how HEYA Collective Oy collects, uses, stores and protects your personal data when you visit our website, place an order, contact us, subscribe to our marketing communications or otherwise interact with HEYA Collective Oy.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR), applicable Finnish data protection legislation and other applicable laws.

1. DATA CONTROLLER

The controller responsible for your personal data is:

HEYA Collective Oy
Business ID: 3625181-3
Addresss: Säästäjäntie 1, 25260 Vaskio, Finland
Email: info@heya.fi
Website: www.heya.fi

If you have any questions about how we process your personal data or wish to exercise your data protection rights, you can contact us using the details above.

2. WHAT PERSONAL DATA WE COLLECT

Depending on how you interact with HEYA Collective Oy, we may collect the following categories of personal data.

Contact information

This may include:

  • Name
  • Email address
  • Telephone number
  • Billing address
  • Delivery address

Order and transaction information

This may include:

  • Products ordered
  • Order number
  • Order date
  • Order value
  • Delivery method
  • Payment status
  • Returns, refunds and complaints
  • Discount codes or gift cards used

We do not normally receive or store your complete payment card details. Payments are processed through the payment providers available at checkout.

Account information

If you create a customer account, we may process information associated with that account, such as:

  • Name
  • Email address
  • Saved addresses
  • Order history
  • Account preferences

Customer service communications

If you contact us, we may process:

  • Your contact details
  • The contents of your message
  • Information relating to your order or enquiry
  • Photographs or other information you provide in connection with a complaint, return or product issue

Marketing information

If you subscribe to our newsletter or other marketing communications, we may process:

  • Your email address
  • Marketing preferences
  • Information about whether you open or interact with our communications
  • Information relating to your previous purchases, where permitted by law

Website and technical information

When you visit our website, certain information may be collected automatically, including:

  • IP address
  • Browser type
  • Device type
  • Operating system
  • Pages visited
  • Referral source
  • Date and time of visits
  • Website interactions
  • Cookie and similar technology identifiers

The extent to which this information is collected depends on your cookie choices and the technologies used on our website.

3. WHY WE PROCESS YOUR PERSONAL DATA

We process personal data only where we have a lawful basis for doing so.

Processing and fulfilling your order

We use your information to:

  • Process your purchase
  • Receive and confirm your order
  • Arrange payment
  • Arrange delivery
  • Provide order and delivery updates
  • Process returns and refunds
  • Handle complaints and warranty or defect matters

Legal basis: Performance of a contract and taking steps at your request before entering into a contract.

Customer service

We process information to answer questions, assist with orders and resolve problems.

Legal basis: Performance of a contract where your enquiry relates to an order, or our legitimate interest in providing customer service and managing our business.

Accounting and legal obligations

Certain customer and transaction information must be retained to comply with accounting, taxation, consumer protection and other legal requirements.

Legal basis: Compliance with a legal obligation.

Preventing fraud and protecting our business

We may process information where reasonably necessary to:

  • Detect fraudulent transactions
  • Prevent misuse of our website
  • Protect the security of our systems
  • Establish, exercise or defend legal claims

Legal basis: Our legitimate interests in protecting HEYA Collective Oy, our customers and our services, and where applicable compliance with legal obligations.

Email marketing

If you subscribe to our newsletter, we may use your email address to send you information about:

  • New products
  • Collections
  • Restocks
  • Offers
  • Events
  • HEYA news and content

Legal basis: Consent, where consent is required.

You can unsubscribe at any time by clicking the unsubscribe link included in our marketing emails.

Where applicable law permits marketing to existing customers without separate consent, we may rely on our legitimate interests, subject to your right to object at any time.

Analytics and website improvement

Where permitted by your cookie choices, we may use analytics information to understand:

  • How visitors use our website
  • Which pages and products are popular
  • How customers find HEYA
  • How our website and marketing perform
  • How we can improve the customer experience

Legal basis: Consent where required for non-essential cookies or tracking technologies.

Advertising and social media marketing

Where you have provided the required consent, we may use advertising technologies to measure campaigns, understand website activity and show more relevant advertising on third-party platforms.

Legal basis: Consent where required.

You can manage your preferences through our cookie settings.

4. HOW WE COLLECT PERSONAL DATA

We may collect personal data:

  • Directly from you when you place an order
  • When you create an account
  • When you contact customer service
  • When you subscribe to marketing
  • When you submit a return or complaint
  • Automatically when you use our website, subject to your cookie choices
  • From service providers involved in processing orders, payments or deliveries
  • From advertising or analytics platforms where legally permitted

5. WEBADOR

Our website and online store are hosted and operated using Webador, a service provided by JouwWeb B.V.

Webador provides the technical platform that enables us to operate our website and online store. In connection with these services, Webador may process personal data on behalf of HEYA Collective Oy, including information relating to:

  • Website visits and use
  • Customer orders
  • Contact and account information
  • Online store functionality
  • Payments and order processing
  • Website hosting and associated technical services

For personal data that Webador processes on our behalf in providing these services, HEYA Collective Oy acts as the data controller and Webador acts as a data processor.

Webador may use approved subprocessors in providing its services and may process personal data in accordance with its contractual and legal obligations.

Further information about Webador’s processing of personal data is available in Webador’s own privacy information.

6. PAYMENT PROVIDERS

Payments made through our online store are processed by the payment methods and service providers displayed at checkout.

Depending on the payment method you choose, your personal data may be shared with the relevant payment provider to:

  • Process your payment
  • Verify your identity or payment details
  • Prevent fraud
  • Process refunds
  • Provide invoice or instalment services where selected

Payment providers may process certain information as independent controllers under their own privacy policies.

HEYA Collective Oy does not normally store complete credit or debit card details.

Current payment providers may include: Stripe, Klarna and Paypal.

  1. DELIVERY PROVIDERS

When necessary to deliver your order, we may share relevant information with delivery and logistics providers.

This may include:

  • Your name
  • Delivery address
  • Telephone number
  • Email address
  • Parcel and delivery information

Our delivery providers may include:

Posti and Matkahuolto.

Delivery providers may process personal data under their own privacy policies where they act as independent controllers.

8. OTHER SERVICE PROVIDERS

We may use trusted third-party service providers to operate and improve our business.

These may include providers of:

  • E-commerce hosting
  • Payment processing
  • Shipping and logistics
  • Customer service
  • Email marketing
  • Website analytics
  • Advertising
  • Social media integrations
  • Fraud prevention
  • IT services
  • Cloud storage
  • Accounting and bookkeeping

These providers receive personal data only where reasonably necessary for the services they provide.

Where a provider processes personal data on our behalf, we require appropriate contractual and data protection safeguards.

Our current service providers may include:

  • Webador
  • Posti
  • Matkahuolto
  • Stripe
  • Klarna
  • Paypal
  • Klaviyo
  • Meta Platforms
  • TikTok

9. COOKIES AND SIMILAR TECHNOLOGIES

Our website uses cookies and similar technologies to operate the website and online store, remember your preferences and, where applicable, understand how visitors use our website and measure the effectiveness of our marketing.

Some cookies are strictly necessary for the website to function properly and do not require your consent. These may be used for purposes such as:

  • Maintaining your shopping basket
  • Enabling checkout and order functionality
  • Remembering essential website preferences
  • Maintaining website security
  • Providing other necessary technical functionality

Other cookies and similar technologies may be used for purposes such as website analytics, advertising and personalisation.

Where consent is required by law, these non-essential cookies and tracking technologies will only be used after you have given your consent.

When you visit our website, you can choose whether to accept or reject non-essential cookies through our cookie consent settings. Where available, you can also choose which categories of cookies you wish to allow.

You can change or withdraw your cookie consent at any time through the cookie settings available on our website. Withdrawing your consent does not affect the lawfulness of any processing carried out before your consent was withdrawn.

Information about the cookies and similar technologies currently used on our website, including their purposes, is available through our cookie consent and settings panel..

10. INTERNATIONAL TRANSFERS OF PERSONAL DATA

Some of the service providers we use may process or store personal data outside Finland or outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we take appropriate steps to ensure that the transfer is carried out in accordance with applicable data protection law and that your personal data remains adequately protected.

Depending on the destination and service provider, these safeguards may include:

  • A European Commission adequacy decision
  • Standard Contractual Clauses approved by the European Commission
  • Other safeguards permitted under applicable data protection legislation

Some of our service providers, particularly those providing website hosting, payment processing, analytics, advertising, social media or other technical services, may process data internationally as part of providing their services.

Where required, we ensure that appropriate contractual or other legal safeguards are in place for such transfers.

This is more suitable for HEYA Collective Oy because it does not unnecessarily promise that Webador itself transfers your customers’ data outside the EEA. It simply covers HEYA Collective Oy if one of your current or future providers does. Under GDPR, transfers outside the EEA need an appropriate legal mechanism, such as an adequacy decision or approved safeguards like Standard Contractual Clauses. 

11. HOW LONG WE KEEP YOUR PERSONAL DATA

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected or where retention is required by law.

Retention periods may differ depending on the type of information.

Order and accounting information

Order and transaction information may be retained for the periods required by Finnish accounting, taxation and other applicable laws.

Customer service information

Customer service communications are retained for as long as necessary to resolve the matter and for a reasonable period afterwards where needed to handle potential claims or follow-up enquiries.

Customer accounts

Account information is generally retained for as long as the customer account remains active, subject to legal retention requirements.

Marketing information

Marketing information is generally retained until you unsubscribe, withdraw your consent or otherwise object to the processing, unless we are required to retain limited information to record your opt-out.

Cookie and analytics information

Retention periods for cookies and related technologies vary depending on the particular cookie or service.

Further information is available through our cookie settings.

When information is no longer necessary, it will be deleted, anonymised or otherwise handled in accordance with applicable law.

12. HOW WE PROTECT YOUR PERSONAL DATA

We take appropriate technical and organisational measures to protect personal data against:

  • Unauthorised access
  • Accidental loss
  • Destruction
  • Alteration
  • Unauthorised disclosure
  • Other unlawful processing

Access to personal data is limited to persons and service providers who require it for legitimate business purposes.

However, no online service or electronic transmission method can be guaranteed to be completely secure.

13. YOUR DATA PROTECTION RIGHTS

Depending on the circumstances, you have the following rights under the GDPR.

Right of access

You may request confirmation of whether we process personal data concerning you and request a copy of that data.

Right to rectification

You may ask us to correct inaccurate or incomplete personal data.

Right to erasure

In certain circumstances, you may request that we delete your personal data.

This right is not absolute. For example, we may need to retain certain transaction information to comply with accounting or other legal obligations.

Right to restriction of processing

In certain circumstances, you may request that processing of your personal data be restricted.

Right to data portability

Where processing is based on consent or a contract and carried out by automated means, you may have the right to receive certain personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.

Right to object

Where we process personal data on the basis of legitimate interests, you may have the right to object to that processing based on your particular circumstances.

You have the right to object at any time to the processing of your personal data for direct marketing purposes.

Right to withdraw consent

Where processing is based on consent, you can withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights relating to automated decision-making

Where applicable, you have rights regarding decisions based solely on automated processing that produce legal or similarly significant effects.

HEYA Collective Oy does not currently intend to make such decisions about customers unless clearly communicated otherwise.

14. HOW TO EXERCISE YOUR RIGHTS

To exercise your data protection rights, contact us at:

info@heya.fi

Please provide enough information for us to identify your request.

We may ask for additional information where reasonably necessary to verify your identity before disclosing or changing personal data.

We will respond within the timeframe required by applicable data protection law.

Requests are generally free of charge. However, the GDPR allows a reasonable fee or refusal in certain cases involving manifestly unfounded or excessive requests.

15. RIGHT TO LODGE A COMPLAINT

If you believe that HEYA Collective Oy has processed your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority.

In Finland, the supervisory authority is:

Office of the Data Protection Ombudsman

You may also contact us first so that we have an opportunity to address your concern.

16. CHILDREN

Our online store is not specifically directed at children.

We do not knowingly collect personal data from children for marketing purposes without the consent or other lawful basis required under applicable law.

If you believe that a child has provided personal data to us inappropriately, please contact us.

17. SOCIAL MEDIA

HEYA Collective Oy may maintain profiles on social media platforms such as Instagram, Facebook, TikTok or other platforms.

When you interact with us through these services, the relevant social media provider may also process personal data independently in accordance with its own privacy policy.

If you contact HEYA Collective Oy through social media, we may process the information contained in your communication for customer service and communication purposes.

18. LINKS TO OTHER WEBSITES

Our website may contain links to websites or services operated by third parties.

HEYA Collective Oy is not responsible for the privacy practices of independent third-party websites.

We recommend reviewing the privacy information of any third-party service you use.

19. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

  • Changes to our services
  • New service providers
  • Changes to our data processing practices
  • Legal or regulatory developments

The latest version will always be available on our website.

Where a change materially affects how we process personal data, we will provide additional notice where required by law.

20. CONTACT

For questions about this Privacy Policy or the processing of your personal data, please contact:

HEYA Collective Oy

Business ID: 3625181-3

Address: Säästäjäntie 1, 25260 Vaskio, Finland
Email: info@heya.fi

Website: www.heya.fi