Privacy Notice
This Privacy Notice applies specifically to the customer register of Tmi karolilia’s Johku online store and explains how personal data is processed in connection with the store.
We may update our privacy practices and this Privacy Notice from time to time. We recommend reviewing this Privacy Notice regularly to stay informed about how your personal data is processed.
1. Data Controller
Tmi karolilia
Jokisalo 3
69100 Kannus
Business ID: 3643024-8
Phone: +358 40 195 4844
Email: karolina.emilia.salin@gmail.com
2. Contact Person for Data Protection Matters
Karolina Salin
Tmi karolilia
+358 40 195 4844
karolina.emilia.salin@gmail.com
3. Name of the Register
Tmi karolilia’s online store customer register
4. Legal Basis and Purpose of Processing Personal Data
The legal basis for processing personal data under the EU General Data Protection Regulation (GDPR) is the performance of a contract that arises when a customer purchases products and/or services through Tmi karolilia’s online store.
The purpose of the register is to enable transactions through Tmi karolilia’s online store, including the exchange of order information, billing information, payment confirmation information, and other information necessary for processing the order between Tmi karolilia and the customer.
The register is also used to enable customer service communications, maintain customer relationships, and carry out electronic marketing where the customer has given their consent.
Tmi karolilia does not store orders placed with other merchants or any information relating to such orders in its customer register.
Personal data is not used for automated decision-making. Personal data may be used for profiling.
5. Personal Data Stored in the Register
The register may contain the following information:
First and last name
Address
Postal code and city
Country
Telephone number
Email address
Personal identity code (for private customers receiving an invoice)
Source page of the order
For business customers, the following additional information may be stored:
Company name
Business ID
E-invoicing address
E-invoicing operator ID
Reference
Marking
Customers may also be given the opportunity to provide additional information freely in designated fields where relevant to the service or order.
Data Retention
Personal data is retained for as long as there is a valid contractual relationship and/or consent between the customer and Tmi karolilia.
Data may be retained for longer where necessary to comply with statutory obligations, such as accounting and consumer protection requirements, and to demonstrate proper compliance with such obligations.
6. Regular Sources of Information
Personal data is collected through electronic forms in the Johku online service. Customers enter their information themselves when purchasing products and/or services through Tmi karolilia’s Johku online store.
7. Regular Disclosures and Transfers of Personal Data Outside the EU or EEA
Personal data is not routinely disclosed to third parties and is retained under the control of the data controller.
Personal data may, however, be technically processed outside the European Union or the European Economic Area.
8. Principles of Data Protection
Personal data is processed with due care, and data processed through information systems is appropriately protected.
When register data is stored on internet servers, appropriate physical and digital security measures are used to protect the hardware and data.
The data controller ensures that stored information, access rights to the servers, and other information critical to the security of personal data are handled confidentially and only by persons whose duties require access to such information.
Electronically Stored Data
The register is maintained in the Johku service, and Aptual Commerce Oy acts as the data processor.
Full access to the register is limited to the data controller and the technical maintenance personnel of Aptual Commerce Oy.
More information about Johku’s privacy practices is available at:
Johku Privacy Policy
Manually Stored Data
As a general rule, we avoid printing register information into physical records. If register information is printed for any reason, the material is stored in a locked location and access is limited to the data controller.
9. Right of Access and How to Exercise It
Every person whose data is stored in the register has the right to access their personal data and request correction of any inaccurate or incomplete information.
This right can be exercised through the Oma Johku service as follows:
Johku communicates with users about the processing of their personal data through the Oma Johku service in connection with the merchant’s confirmation messages. These messages contain a link to the Oma Johku service.
In Oma Johku, users can review the personal data stored about them and make corrections where necessary. The service also provides a function for downloading personal data in a structured format for transfer to another system.
Oma Johku can be accessed at any time at:
Oma Johku also allows users to terminate their Oma Johku agreement and delete their data from the Oma Johku service.
If a user stops using Oma Johku and terminates their agreement with Johku, the automated functions for managing their personal data will no longer be available. After termination, requests concerning access, correction, erasure, restriction of processing, and data portability must be submitted directly to Tmi karolilia in writing.
Tmi karolilia may, where necessary, request the person making the request to verify their identity.
Tmi karolilia will respond to written requests within the period specified by the GDPR, generally within one month.
Use of the Oma Johku service is free of charge.
10. Other Rights Concerning the Processing of Personal Data
Individuals whose personal data is stored in the register have the right to request the deletion of their personal data from the register (“right to be forgotten”).
Data subjects also have other rights under the EU General Data Protection Regulation, including the right to request restriction of processing in certain circumstances.
Please note, however, that the information stored in Tmi karolilia’s customer register is generated when a customer purchases products and/or services. Tmi karolilia may therefore be legally required to retain certain information under accounting and tax legislation.
Requests concerning personal data must be submitted to the data controller in writing. Where necessary, the data controller may ask the person making the request to verify their identity.
The data controller will respond to the request within the period specified by the GDPR, generally within one month.
11. Cookies
This website uses cookies. Cookies are small files sent to your browser and stored on your device.
The website uses both temporary session cookies, which are deleted when you close your browser, and persistent cookies, which remain stored on your device.
Cookies are used to improve the user experience on the website. If you are a registered user, cookies may also be used to manage your login and access to pages intended for registered users.
Cookies may be used to monitor and analyse users’ interests and thereby improve the usability of the service.
Web browsers generally accept cookies automatically. If necessary, you can disable cookies through your browser settings. Please note that disabling cookies may affect some website functionality.
Advertising cookies may be used to help optimise the advertising experience for users of the service. Some third-party providers, including Google, may also use cookies or web beacons (1-pixel image files) to improve the advertising experience.
Information collected through cookies and web beacons does not contain information that directly identifies the user. Online activities cannot be linked to a specific individual on the basis of this information alone.
Prepared: 28 September 2026