Privacy policy

Last updated: 24 August 2026

This Privacy Policy explains how Atelier 229 Oy ("we", "us", "our") collects, uses, discloses and protects your personal data when you visit or make a purchase through atelier-229.com (the "Site"), in accordance with the EU General Data Protection Regulation (GDPR) and Finnish data protection law.

Who we are

The data controller responsible for your personal data is:

Atelier 229 Oy
Business ID (Y-tunnus): 3211200-7
Kaljaasi Fortunan katu 6 A 4, 00540 Helsinki, Finland
Email: iisak.jokisalo@atelier-229.com

What personal data we collect

  • Contact and order details: name, address, email, phone number, order history, payment confirmation.
  • Account information: username and login details, if you create an account.
  • Shopping behaviour: items viewed, added to cart or wishlist.
  • Customer support communications: anything you send us via email or contact forms.
  • Technical/usage data: IP address, browser and device information, and other data collected automatically via cookies and similar technologies when you use the Site.

Why we process your data and our legal basis

  • To fulfil your order (processing payment, shipping, customer service) — necessary for the performance of a contract with you (GDPR Art. 6(1)(b)).
  • To comply with legal obligations, such as accounting and tax law — legal obligation (Art. 6(1)(c)).
  • To send you marketing communications (email newsletters, offers) — based on your consent (Art. 6(1)(a)), which you may withdraw at any time via the unsubscribe link in any email or by contacting us.
  • To operate, secure and improve the Site, including fraud prevention and basic analytics — our legitimate interest (Art. 6(1)(f)), balanced against your rights.

Cookies

We use cookies and similar technologies to operate the Site, remember your preferences, and — where you have given consent — to measure traffic and personalise marketing (for example via Shopify, analytics, and advertising partners). You can manage or withdraw cookie consent at any time through your browser settings or the Site's cookie preferences, where available. Essential cookies required for the Site to function cannot be disabled. For more information about cookies used to power our store via Shopify, see https://www.shopify.com/legal/cookies.

Who we share your data with

We share personal data only where necessary, with:

  • Our e-commerce platform provider, Shopify Inc., which hosts the Site and processes orders on our behalf.
  • Payment processors, to securely process your payment.
  • Shipping and fulfilment partners, to deliver your order.
  • Email marketing providers (such as Klaviyo or Shopify Email), where you have consented to receive marketing.
  • Authorities, where required by law.

We do not sell your personal data to third parties.

International data transfers

Some of our service providers may process data outside the European Economic Area (EEA), including in the United States. Where this occurs, we rely on recognised safeguards such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision.

How long we keep your data

We retain personal data for as long as necessary to fulfil the purposes described above, including to meet legal, accounting, or reporting requirements (for example, Finnish accounting law generally requires records to be kept for 6 years).

Your rights under GDPR

Subject to conditions set out in the GDPR, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request erasure of your data
  • Restrict or object to certain processing
  • Request a copy of your data in a portable format
  • Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, contact us at iisak.jokisalo@atelier-229.com. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi, or the data protection authority of your own EU/EEA country of residence.

Children's data

Our Services are not directed at children, and we do not knowingly collect personal data from children.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. The "Last updated" date above indicates when it was last revised.

Contact

Questions about this Privacy Policy or how we handle your data? Contact us at iisak.jokisalo@atelier-229.com.