Privacy Policy

1. Introduction

We respect your privacy and are committed to protecting it. This Privacy Policy explains how we collect, use, and safeguard your personal data when you visit our website or place an order. By using our site or services, you agree to the terms below.

2. Who We Are (Data Controller)

• Riimuki (Finland) is the data controller for personal data processed via this website.
• Email: hello@riimuki.com
• Postal: PO 17, Oulu, Finland 90101

3. Personal Data We Collect

We collect only what is needed to provide and improve our services:

• Contact details: name, email address.
• Order & delivery details: delivery address, country, phone (where required for carriers).
• Payment details: processed securely by Stripe; we do not store full card numbers.
• Communications: messages you send us, including support and pre-order interest.
• Analytics & usage data: page views, events, and device information (see our Cookie Policy: /policies/cookies-policy).

4. Legal Bases for Processing (GDPR)

We process your data under these legal bases:

• Contract (Art. 6(1)(b)): to process orders, arrange delivery, and provide customer support.
• Consent (Art. 6(1)(a)): for non-essential cookies/analytics and marketing emails. You can withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)): to improve our services and maintain site security in a privacy-respecting way.
• Legal obligation (Art. 6(1)(c)): to meet accounting, tax, and consumer protection requirements.

5. How We Use Your Data

• To process and deliver orders.
• To communicate updates and respond to enquiries.
• To send product updates and news if you opt in.
• To improve site performance, design, and usability.
• To comply with legal obligations and prevent fraud.

6. Cookies and Tracking

We use cookies and similar technologies for essential site functions and, with your consent, to improve your experience. All non-essential cookies are opt-in.

• Session cookies – enable core functions and help us understand how different parts of the site are used during a single visit.
• Analytics cookies – help us understand how Riimuki is experienced overall. These are set only with your consent, use PostHog’s EU service (eu.posthog.com), and are never shared beyond them.
• Returning visitor cookies – recognise when you return from the same device to make the experience feel more familiar.
• Experience improvement cookies – allow us to run quiet A/B tests to choose what feels most natural.
• Marketing cookies – measure ad performance and help us show relevant content. Always optional and never intrusive.
• We do not share your cookie data with anyone except PostHog, and they are not permitted to use it for their own purposes.
• For full details, see our Cookie Policy: /policies/cookies-policy.

7. Service Providers (Processors)

We use selected providers who process data on our behalf:

• Stripe – secure payment processing. For EU customers, Stripe primarily processes data in the EU but may transfer some personal data to the United States for operational purposes. These transfers are protected by Standard Contractual Clauses and Stripe’s participation in the EU–US Data Privacy Framework.
• AWS (Amazon Web Services) – hosting and infrastructure, currently in the eu-central-1 (Frankfurt) region.
• AWS SES – transactional and opt-in marketing emails, hosted in the EU.
• Vercel – hosting and content delivery for our website. Operates a global edge network, including EU locations, with possible transfers of request data (such as IP addresses) to the United States. These transfers are protected by Standard Contractual Clauses.
• PostHog – analytics and performance measurement via their EU service (eu.posthog.com).
• Logistics/delivery partners – for shipping and tracking (final partner will be confirmed before launch).

8. International Transfers

Our backend and core services are hosted in the European Economic Area (EEA). Some of our providers, such as Stripe and Vercel, may transfer personal data outside the EEA to the United States. When this occurs, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework.

9. Data Retention

We retain personal data only as long as necessary:

• Order records: retained as required by law.
• Support communications: retained for a reasonable period to manage requests.
• Marketing data: retained until you unsubscribe or withdraw consent.
• Analytics data: retained according to PostHog’s configuration and minimisation settings.

10. Your Rights

Under GDPR, you can:

• Access, correct, or delete your data.
• Restrict or object to certain processing.
• Withdraw consent at any time for consent-based processing.
• Request a copy of your data (data portability).
• Lodge a complaint with your supervisory authority.

11. Children’s Data

Our site and products are not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have such data, contact us and we will delete it.

12. Security

We use technical and organisational measures to protect your data, including encryption in transit and secure infrastructure. No system is entirely risk-free, but we act promptly if an incident occurs.

13. Other Policies

For related information, please see:

• Delivery Policy: /policies/delivery-policy
• Returns & Refunds Policy: /policies/returns-and-refund-policy
• GDPR Policy: /policies/gdpr-policy
• Terms & Conditions: /policies/terms-policy

14. Updates to This Policy

We may update this Privacy Policy from time to time. Changes will be posted here with an updated effective date.

15. Contact

Questions or requests about your personal data:

• Email: hello@riimuki.com
• Postal: PO 17, Oulu, Finland 90101