phone

1. Data controller

Decal Group Oy
Nuolitie 2, Vantaa, 01740
Finland
Business ID: 1234567-8
Email: myynti@decalgroup.fi
Phone: +358 442443847

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website, online shop, service booking, contact forms, and customer account (together, the “Services”). We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the Finnish Data Protection Act (1050/2018), and other applicable legislation.

2. Personal data we collect

Depending on how you use our Services, we may collect the following categories of personal data:

Identity and contact details: name, email address, phone number, postal address, city, postal code, country.
Company details: company name and business ID, if you order as a business customer.
Order and booking information: products or services ordered, vehicle details, registration number, appointment date and time, order number, payment method, order and payment status.
Account information: login credentials and profile details if you create a customer account.
Communication data: messages you send via contact forms, email, or chat.
Technical data: IP address, browser type, device information, pages visited, and cookies (see Section 9).
Payment data: payment transactions are processed by our payment service provider Paytrail. We do not store full payment card details on our servers.

Providing personal data marked as required is necessary to place an order, make a booking, or use certain features. Without this data, we may not be able to provide the requested service.

3. Purposes and legal basis for processing

We process your personal data only when we have a valid legal basis under Article 6 of the GDPR:

Performance of a contract (Art. 6(1)(b)): processing orders, bookings, deliveries, payments, and customer support.
Legal obligation (Art. 6(1)(c)): accounting, tax records, and compliance with applicable laws.
Legitimate interests (Art. 6(1)(f)): website security, fraud prevention, service improvement, and limited direct communication related to your purchase or booking, where our interests are not overridden by your rights.
Consent (Art. 6(1)(a)): optional marketing communications and non-essential cookies, where required. You may withdraw consent at any time.

4. How we use your data

We use personal data to:

process and deliver product orders and service bookings;
communicate with you about orders, bookings, payments, and inquiries;
manage customer accounts and authentication;
send service-related notifications to our staff (email and messaging integrations);
maintain website functionality, security, and performance;
comply with legal and regulatory obligations;
send marketing messages only where permitted by law and, where required, with your consent.

5. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy:

Orders and bookings: for the duration of the customer relationship and thereafter as required by Finnish accounting and consumer protection laws (typically up to 6 years for accounting records).
Customer account data: until you delete your account or request erasure, unless longer retention is required by law.
Contact form messages: as long as needed to handle your inquiry and for a reasonable follow-up period.
Technical logs and cookies: according to the periods stated in our cookie information or until deleted by you.

When data is no longer needed, we delete or anonymise it securely.

6. Recipients and processors

We may share personal data with trusted third parties who process data on our behalf or as required to provide the Services, including:

payment service providers (e.g. Paytrail);
email and notification service providers;
hosting, IT, and website infrastructure providers;
accounting and legal advisers where necessary;
public authorities when required by law.

We ensure that processors are bound by data processing agreements and appropriate safeguards in line with GDPR requirements. We do not sell your personal data.

7. International transfers

Your data is primarily processed within the European Economic Area (EEA). If personal data is transferred outside the EEA, we use appropriate safeguards such as EU Standard Contractual Clauses or an adequacy decision by the European Commission.

8. Your rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access – obtain confirmation and a copy of your data.
Right to rectification – request correction of inaccurate data.
Right to erasure – request deletion where legally applicable.
Right to restriction – request limited processing in certain cases.
Right to data portability – receive your data in a structured, machine-readable format where applicable.
Right to object – object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent, without affecting prior lawful processing.

To exercise your rights, contact us at myynti@decalgroup.fi. We will respond within one month, as required by law. We may need to verify your identity before fulfilling a request.

You also have the right to lodge a complaint with the Finnish supervisory authority: Office of the Data Protection Ombudsman (Tietosuojavaltuutettu), tietosuoja.fi.

9. Cookies and similar technologies

Our website uses cookies and similar technologies that are necessary for site functionality, security, and analytics. Essential cookies do not require consent. Where non-essential cookies are used, we request your consent in accordance with the ePrivacy rules and Finnish national legislation.

You can control cookies through your browser settings. Disabling certain cookies may affect website functionality.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These measures include access controls, encrypted connections (HTTPS), and secure handling of credentials and service integrations.

11. Children

Our Services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us so we can delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always published on this page with the “Last updated” date. We encourage you to review this policy periodically.

13. Contact

For any questions about this Privacy Policy or our data processing practices, contact: Decal Group Oy, myynti@decalgroup.fi, +358 442443847.