Privacy policy

Updated 5 September 2026

1. Data controller

H&T Stores Oy (Lemmivo)
Business ID: 3588326-1
VAT ID: FI35883261
Pohjanniementie 7
40250 Jyväskylä
Finland
Email: info@htstores-eu.com

2. What personal data do we process?

We may process the following personal data:

  • name, email address, delivery address, billing address and the telephone number provided by the customer;
  • orders, products, payment status, deliveries, returns, refunds and complaints;
  • customer service messages and other content you send to us;
  • marketing and cookie consents and changes to those choices;
  • IP address, device, browser and network information, cookie identifiers, page views and website usage information;
  • information relating to fraud prevention and service security.

Full payment card details are processed by the payment service provider. We do not normally receive or store them ourselves.

3. Purposes and legal bases for processing

  • Performance of a contract: receiving, paying for, delivering, returning and refunding orders, and providing customer service.
  • Legal obligation: fulfilling accounting, tax, consumer protection and other statutory obligations.
  • Legitimate interests: preventing fraud, maintaining security, developing our operations, and establishing, exercising and defending legal claims.
  • Consent: electronic direct marketing where consent is required, and non-essential analytics and advertising technologies.

The contact, delivery and payment details requested to process an order are necessary for entering into the contract. The order cannot be processed without them.

4. Sources of data

We receive personal data primarily from you when you place an order, contact us, make a cookie choice or use the website. We may also receive data from Shopify, payment service providers, delivery and returns partners, and marketing and security service providers.

5. Recipients and service providers

We may disclose data, to the extent necessary to perform the relevant task, to the following parties:

  • Shopify and its subcontractors;
  • payment service providers and financial institutions;
  • warehousing, supplier, carrier and returns partners;
  • accounting, email, customer service, security and IT service providers;
  • Meta Platforms Ireland Limited if you consent to the use of Meta Pixel;
  • authorities or other parties where required by law.

Service providers may process data only to deliver the agreed service, fulfil their own statutory obligations or on another applicable legal basis.

6. Transfers outside the EEA

Shopify, Meta and some delivery, technology or supplier partners may process data outside the European Economic Area, including in Canada, the United States or China.

Fulfilling a delivery from outside the European Union may require the customer's name, delivery address, contact details and details of the products ordered to be shared with a supplier or carrier. We do not provide partners with data that is unnecessary for the delivery.

Where safeguards are required by law, a transfer is based, for example, on an adequacy decision by the European Commission, approved binding corporate rules or the European Commission's standard contractual clauses.

7. Meta Pixel and cookies

We currently use Meta Pixel to measure advertising, target advertising and evaluate campaign performance. Meta Pixel may process information such as IP address, device and browser information, page views, cart and purchase events, and cookie identifiers.

Meta Pixel and other non-essential analytics or advertising technologies are used only on the basis of your consent. You can accept, reject or later change your choices in the website's cookie settings. Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.

For more information about Meta's processing, see the Meta Privacy Policy.

8. Retention periods

We retain personal data only for as long as required by the purpose of processing, the contract, applicable complaint and liability periods, or statutory obligations. Accounting records are retained for the period required by accounting law. Customer service and order information may be retained for as long as necessary to handle complaints and legal claims.

Processing based on consent will stop when you withdraw your consent, unless there is another lawful basis for retaining the data. Data is deleted or anonymised when there is no longer a basis for retaining it.

9. Rights of the data subject

Under applicable data protection law, you may have the right to:

  • access your personal data;
  • request correction of inaccurate or incomplete data;
  • request erasure of data;
  • request restriction of processing;
  • object to processing based on legitimate interests and to direct marketing;
  • receive data you have provided in a portable format where the legal requirements are met;
  • withdraw your consent at any time.

You can exercise your rights by sending a request to info@htstores-eu.com. We may request reasonable additional information to verify your identity.

You have the right to lodge a complaint with the competent data protection authority. In Finland, the authority is the Office of the Data Protection Ombudsman. You may also contact the supervisory authority in the country where you habitually reside or work.

10. Automated decision-making

We do not make decisions about customers based solely on automated processing where those decisions would produce legal effects or similarly significant effects for them. Payment and security services may nevertheless use automated methods to detect fraud in accordance with their own terms.

11. Security and changes

We protect personal data using appropriate technical and organisational measures. Access is limited to people and service providers who need the data to perform their duties.

We may update this notice when our services, processing practices, partners or applicable law change. The current version and date of update are published on this page.