Legal

Privacy policy

This policy explains what personal data Minda Group Oy collects when you use cms.minda.dev, why, who else handles it, how long it is kept, and what rights you have.

Who is responsible

The controller of your personal data is:

Minda Group Oy
Business ID: 3375972-6
Address: Tolosentie 131 A
99800 Ivalo
Suomi
Email: myynti@minda.fi

Questions about this policy or your data can be sent to myynti@minda.fi.

What we collect

We collect only what we need for the purposes below:

Contact details you give us, such as your name, email address and phone number.
Messages you send us, and what we answer.
Your account: user name, password (stored only in a form nobody can read), and the details you save in it.
Orders: what you bought, delivery and billing addresses, and the order history.
Payment details: how and when you paid. Card numbers go straight to the payment provider; we never see or store them.
Comments you leave on the site, with the name and email address you give.
Technical data: IP address, browser and device type, and the pages you visit, as recorded in the server's logs.
With your consent: how you use the site (statistics) and which ads you have seen (marketing).

Most of it you give us yourself. Technical data is recorded automatically when you use the site.

Why we use it, and on what legal basis

To deliver what you ordered, take payment, and handle returns and complaints — to perform our contract with you (GDPR Art. 6(1)(b)).
To keep your account and let you sign in — to perform our contract with you (GDPR Art. 6(1)(b)).
To keep accounts and pay taxes as the law requires — a legal obligation (GDPR Art. 6(1)(c)).
To answer your messages and keep in touch with customers — our legitimate interest (GDPR Art. 6(1)(f)).
To keep the site secure and working, and to prevent misuse and fraud — our legitimate interest (GDPR Art. 6(1)(f)).
To understand how the site is used and to show and measure ads — only with your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time.

Where the law or our contract requires data — to deliver an order, for example — we cannot provide the service without it.

Who else handles your data

We do not sell personal data. We use these service providers, who handle data only on our behalf and under a data processing agreement:

Payments: Stripe
Email delivery: Postmark
Hosting: DigitalOcean, LLC (EU region)
Statistics and advertising: Google Analytics
Accounting and tax authorities, when the law requires it.

Transfers outside the EU and EEA

Some of the providers above, or their subcontractors, may handle data outside the European Union and the European Economic Area — in the United States, for example. When they do, the transfer is protected by a decision of the European Commission that the country's protection is adequate (such as the EU–US Data Privacy Framework) or by the Commission's standard contractual clauses.

How long we keep it

Orders and bookkeeping records: 6 years from the end of the financial year, as accounting law requires.
Your account: until you close it.
Messages: as long as needed to deal with them, and at most 2 years after the last contact.
Server logs: a few weeks, unless needed to investigate misuse.
Records of cookie choices: 3 years, to show that consent was asked.

After that, the data is deleted or made anonymous.

Your rights

You have the right to:

see the personal data we hold about you and get a copy of it;
have incorrect data corrected;
have your data deleted, unless the law requires us to keep it;
restrict how we use it, or object to its use based on our legitimate interest;
get the data you gave us in a machine-readable form and have it moved to another service;
withdraw your consent at any time, without affecting what was done before.

To use these rights, contact us at myynti@minda.fi. We answer within one month.

If you think your data is handled against the law, you can complain to the data protection authority: Tietosuojavaltuutetun toimisto.

Cookies

Cookies are small files the site stores in your browser. Necessary cookies make the site work and need no consent. Other cookies are used only if you allow them. You can change your choice at any time: Cookie settings.

Necessary

Cookie	Provider	Purpose	Duration
`__stripe_mid`	Stripe	Prevents payment fraud.	12 months
`__stripe_sid`	Stripe	Prevents payment fraud.	30 minutes
`ucm_consent`	This site	Remembers your cookie choices.	12 months
`woocommerce_cart_hash`	WooCommerce	Notices when the cart changes.	Session
`woocommerce_items_in_cart`	WooCommerce	Notices when the cart changes.	Session
`wp_woocommerce_session_*`	WooCommerce	Keeps your cart.	2 days

Preferences

Statistics

Cookie	Provider	Purpose	Duration
`_ga`	Google Analytics	Tells visitors apart, to count visits.	2 years
`_ga_*`	Google Analytics	Keeps the state of a visit.	2 years
`_gid`	Google Analytics	Tells visitors apart, to count visits.	24 hours
`sbjs_*`	WooCommerce	Records how you arrived, to attribute orders to campaigns.	Session or 6 months

How we protect your data

The site is served over an encrypted connection. Only people who need personal data for their work can see it, accounts are protected with strong passwords, and our providers are chosen for their security.

Automated decisions

We do not make decisions about you by automated means alone, and we do not use profiling with legal or similarly significant effects.

Changes to this policy

We may update this policy when our services or the law change. The latest version is always on this page.

Last updated: October 9, 2026