Privacy Policy

Scope and material applicability

This Privacy Policy applies to visitors and customers who interact with the public website at https://shythreltrphulei.world/, including informational pages about the Stabira food supplement, contact forms, and cookie-based tools described separately in our Cookie Policy. If you communicate with us by email, the same principles apply to messages stored in our mailboxes, subject to proportionate retention.

We describe our practices in plain language while referencing GDPR terminology where it helps you exercise rights. Where national Finnish law adds stricter rules, we comply with those requirements as well.

Data controller and representative details

Controller: Shythreltrphulei.world, operating the Stabira brand presentation online.

For privacy-specific requests, include “Privacy request” in the subject line so we can route your message to the responsible internal contact without unnecessary delay.

Categories of personal data we may process

Identity and contact data: name, email address, and any identifiers you include voluntarily in free-text messages when you request information about Stabira or related logistics.

Transaction and communication metadata: timestamps of form submissions, message threads, and reference numbers we generate to track your enquiry fairly.

Technical and usage data: IP address, browser type, operating system, referring URL, and on-page interactions when you consent to analytics cookies.

Cookie and preference data: records of your cookie choices, stored locally and sometimes duplicated server-side when necessary for audit trails tied to consent.

Purposes of processing in operational terms

We process personal data to respond to product and service questions, prepare or confirm orders where applicable, operate and secure the Site, measure aggregated traffic when permitted, maintain records required by accounting or consumer law, and demonstrate accountability to supervisory authorities when asked.

Marketing communications are only sent where a valid legal basis exists—typically consent for electronic direct marketing—and you may withdraw that consent without affecting the lawfulness of earlier processing that already occurred.

Lawful bases under GDPR Article 6

Contract and pre-contract steps: handling your enquiry when you intend to purchase or need information that reasonably precedes a contract.

Legitimate interests: network security, abuse prevention, improving site stability, and understanding aggregate usage patterns where we balance our interests against your rights and offer opt-outs where appropriate.

Legal obligation: retaining invoices or dispute records where Finnish or EU law mandates specific archives.

Consent: optional cookies and certain marketing activities that are not strictly necessary for delivering the Site’s core service.

Retention periods and deletion logic

General enquiry data is retained for up to twenty-four months after the last substantive message unless a longer period is justified by an open complaint, warranty matter, or statutory requirement. Server logs used for security are rotated or anonymised typically within ninety days.

When retention ends, we delete or irreversibly anonymise data so it can no longer be linked to an identifiable person, except where a small subset must remain in aggregated statistics that do not identify individuals.

Recipients and categories of processors

We share personal data only with service providers who help us host the Site, transmit email, analyse traffic when you consent, or process payments if you complete a purchase through an integrated provider. Each processor is bound by a contract that requires GDPR-aligned safeguards and limits use to documented instructions.

We do not sell personal data in the sense of exchanging lists for monetary consideration. Any disclosure to public authorities occurs only when legally compelled and after a proportionate review.

International transfers outside the EEA

Where a sub-processor stores or processes data in a country without an adequacy decision, we rely on Standard Contractual Clauses approved by the European Commission, supplemented by technical measures such as encryption in transit, or another mechanism recognised under Chapter V GDPR.

You may request a summary of transfer mechanisms relevant to your data categories by contacting us; we will respond within reasonable timeframes, subject to confidentiality obligations toward providers.

Your GDPR rights and how to exercise them

You may request access, rectification, erasure, restriction of processing, objection, and data portability where the conditions of Articles 15–20 GDPR are met. You may withdraw consent at any time for processing that relies on consent, without affecting the lawfulness of processing based on consent before its withdrawal.

You also have the right to lodge a complaint with the Finnish Office of the Data Protection Ombudsman. We encourage you to contact us first so we can understand and address your concern promptly.

Security measures and organisational controls

We implement HTTPS across the Site, access controls for administrative interfaces, principle of least privilege for staff accounts, and periodic review of vendor security practices. While no online system is perfectly secure, we align technical and organisational measures with the nature of the data and the risks presented by processing.

In the event of a personal data breach likely to affect your rights, we will notify the supervisory authority and, when required, affected individuals without undue delay, in line with Articles 33–34 GDPR.

Automated decision-making and profiling

We do not use fully automated decision-making that produces legal or similarly significant effects solely by algorithmic means with respect to the data described in this Policy. Analytics cookies may measure engagement in aggregate but do not determine eligibility for essential services without human review.

Children’s data

The Site is not directed at children under sixteen years of age. We do not knowingly collect personal data from children without appropriate parental authority. If you believe we have received such data inadvertently, please contact us so we can delete it promptly.

Changes to this Privacy Policy

We may update this Policy to reflect legal, technical, or business developments. Material changes will be highlighted on the Site when practical, and the document date at the top will always show when the text was last reviewed for accuracy.

Contact for privacy matters

Write to talk@shythreltrphulei.world or post to the Helsinki address above. We aim to acknowledge requests within a few business days and complete them within statutory timelines, possibly extending slightly where requests are complex or numerous.