Updated 19 September 2026.
Data controller
World Heroes / Tonin Verkkokauppa, Finnish Business ID 3408872-5.
Veljestie 7, 44500 Viitasaari, Finland.
Data protection enquiries: info@toninverkkokauppa.com, +358 40 539 8810.
What data do we process and why?
We process your name, contact details, customer account information and order, payment, delivery and customer service information. Use of the website may generate an IP address, device and browser information, cookie identifiers and information about products viewed and other usage events. We receive information from you and from payment and delivery services. We do not store your full payment card details in our own systems.
- Orders, payments, deliveries and related customer service are based on entering into or performing a contract.
- Accounting, statutory liability for defects and product safety obligations are based on legal requirements.
- Information security, prevention of misuse and handling legal claims are based on our legitimate interest in protecting customers and our business.
- The newsletter and non-essential analytics, personalisation and targeted advertising are based on your consent.
Placing an order requires the information needed to process it. Without this information, we cannot fulfil the order. Consent to marketing is voluntary.
Personal data processing for the monthly prize draw is explained separately in the prize draw privacy information (in Finnish).
Service providers and data transfers
The store operates on the Shopify platform. Shopify, payment services such as Shopify Payments, delivery companies and customer communication and accounting service providers process information to the extent required for their tasks. Shopify, Google and Meta services are used for analytics and advertising in accordance with your consent choices. For marketing purposes, information may be combined with information the service provider receives from other services.
Shopify collects and processes your browsing and purchase information also to provide services that draw on your interactions with other merchants and with Shopify (Shopify Network Intelligence). To provide these services, information is shared with Shopify and other service providers, which may be located in other countries.
Shopify explains its processing in its Consumer Privacy Policy. You can manage advertising consent in cookie settings and exercise your privacy rights concerning Shopify in its privacy portal.
Service providers may process information outside the EU and EEA. Transfers rely on an applicable EU adequacy decision or other safeguards under the General Data Protection Regulation, such as standard contractual clauses or binding corporate rules. Further information about these safeguards is available from us and in Shopify's Data Processing Addendum.
Data retention
The retention period is determined by the purpose of the information and statutory obligations. Supporting documents for orders and correspondence forming part of the accounting records are retained for at least six years from the end of the year in which the financial year ended. Accounting records and financial statement material are retained for at least ten years from the end of the financial year.
The need to retain other customer and communication information is determined by the customer relationship, the matter being handled and any warranty, statutory defect liability or legal claims. Use of data for marketing ends when consent is withdrawn. A record of the objection to marketing may be retained to ensure that it is respected.
Cookies and your choices
Essential cookies are used for the store's operation, shopping cart, sign-in and information security. Other cookies are used to measure usage, remember choices and target advertising with your consent. You can change your choices or withdraw consent by opening cookie settings.
Information about the cookies used by these services and their lifetimes: Shopify, Google and Meta. A cookie's lifetime is different from the retention period for information collected by the service provider.
Your rights
Subject to the conditions laid down by law, you may access, correct or delete your information, restrict processing, object to processing based on legitimate interests and transfer information from one system to another. You may object to direct marketing and withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it. Information that must be retained by law cannot be deleted before the retention period expires.
Send a data request or an objection to marketing to info@toninverkkokauppa.com. We will verify your identity where necessary. You may lodge a complaint with the Office of the Data Protection Ombudsman.
We do not make decisions concerning you based solely on automated processing that have legal effects or similarly significant effects.
