Privacy Policy
Privacy Policy
MoominTarot — operated by Playart Production Oy Ab
Last updated: 13 September 2026
This Privacy Policy explains how Playart Production Oy Ab ("Playart", "we", "us", or "our") collects and processes personal data when you visit moomintarot.com, create an account, contact us, subscribe to marketing, or place an order with us. We process personal data in accordance with the EU General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Finnish data protection legislation.
1. Data controller and contact details
The controller responsible for your personal data is:
Playart Production Oy Ab
Mailing address:
PL 64
00101 Helsinki
Finland
For any questions about this Privacy Policy or to exercise your data protection rights, contact us at: info@playartproductions.com
We have not appointed a Data Protection Officer. If our processing activities change so that the appointment of a Data Protection Officer becomes mandatory under Article 37 GDPR, we will appoint one and update this Privacy Policy accordingly.
2. Scope
This Privacy Policy applies to personal data we process through the moomintarot.com online store, including when you browse or use the website, create or use a customer account where available, place and receive orders, make payments, request returns, contact customer service, subscribe to marketing, or otherwise interact with our products and services.
3. What personal data we collect
Depending on how you use the store, we may collect:
- Order and contact data — name, email address, billing address, delivery address, phone number, and details of the products you order.
- Account data — if you create an account, information associated with your customer account, such as your email address, saved addresses, preferences, and order history.
- Payment and transaction data — payment status, payment method, transaction references, refunds, and other transaction-related information. Payment credentials such as full card numbers are processed by our payment service providers and are not stored by us.
- Customer service data — the content of messages you send us and our correspondence with you.
- Marketing data — your email address, consent status, marketing preferences, and interactions with marketing communications.
- Technical and usage data — IP address, device and browser information, cookie identifiers, and information about how you use the website, collected through cookies and similar technologies.
- Shipping and fulfilment data — delivery details, shipment status, tracking information, and other information necessary to fulfil and deliver your order.
4. How we collect it
We collect most personal data directly from you when you place an order, create or use an account, contact us, subscribe to marketing, complete a form, or otherwise interact with our store.
Technical and usage data may be collected automatically through cookies and similar technologies. Where required by law, non-essential cookies are used only after you have provided your consent.
We may also receive limited personal data from service providers involved in operating the store. For example, payment service providers may confirm whether your payment was successful, while fulfilment and shipping providers may update the delivery status of your order.
5. Purposes and legal bases for processing
We only process your personal data where we have a valid legal basis under Article 6 GDPR:
| Purpose | Data used | Legal basis |
|---|---|---|
| Processing and fulfilling your order, arranging delivery, and handling returns | Order and contact data, shipping data, account data | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and managing transactions | Order data, transaction data, payment confirmation data | Performance of a contract (Art. 6(1)(b)) |
| Preventing fraud, misuse, and security incidents | Transaction data, technical data, account data | Legitimate interest (Art. 6(1)(f)) |
| Keeping accounting and tax records | Order and transaction data | Legal obligation (Art. 6(1)(c)) |
| Providing customer service and responding to enquiries | Contact and customer service data | Performance of a contract and/or legitimate interest (Art. 6(1)(b)/(f)) |
| Managing your customer account | Account data | Performance of a contract (Art. 6(1)(b)) |
| Sending marketing emails where consent is required | Marketing data | Consent (Art. 6(1)(a)) |
| Managing marketing preferences and unsubscribe requests | Marketing data | Legal obligation and/or legitimate interest (Art. 6(1)(c)/(f)) |
| Website analytics and non-essential cookies | Technical and usage data | Consent (Art. 6(1)(a)) |
| Operating, securing, and improving the website | Technical and usage data | Legitimate interest (Art. 6(1)(f)), subject to applicable cookie requirements |
| Establishing, exercising, or defending legal claims | Relevant order, account, communication, and technical data | Legitimate interest (Art. 6(1)(f)) |
Providing the order and contact data required during checkout is necessary to enter into and perform the sales contract. If you do not provide the required information, we may not be able to process or fulfil your order.
Where we rely on legitimate interests, we consider our interests against your interests, rights, and freedoms before carrying out the processing.
6. Who we share your data with (recipients and processors)
We share personal data only where necessary to operate our store, fulfil orders, process payments, provide customer service, comply with legal obligations, or provide the services described in this Privacy Policy.
Recipients may include:
- Shopify — hosting, ecommerce infrastructure, checkout functionality, customer accounts, and operation of the online store.
- Payment service providers — payment processing, refunds, transaction verification, and fraud prevention.
- eShop Suomi — order fulfilment, warehousing, and dispatch, where applicable.
- ShipIt — shipping and carrier integration, where applicable.
- Delivery and postal carriers — transporting and delivering your order.
- Email and communications service providers — sending transactional communications and, where you have consented, marketing communications.
- Analytics and technology providers — website functionality, security, performance measurement, and analytics, subject to your cookie choices where required.
- Professional advisers — such as accountants, auditors, lawyers, and other professional service providers where necessary.
- Public authorities — where disclosure is required by law, court order, or another legally binding request.
Some service providers may act as processors on our behalf, while others may act as independent controllers for particular processing activities. Where a provider acts as an independent controller, its own privacy notice applies to that processing.
We do not sell your personal data.
7. International transfers
Some of our service providers may process personal data outside Finland or outside the European Economic Area ("EEA").
Where personal data is transferred outside the EEA, we use or rely on appropriate safeguards as required by applicable data protection law. Depending on the destination and service provider, these safeguards may include:
- an adequacy decision issued by the European Commission;
- the European Commission's Standard Contractual Clauses ("SCCs");
- an applicable approved transfer framework; or
- another transfer mechanism permitted under Chapter V of the GDPR.
Service providers may also implement additional technical and organisational safeguards where appropriate.
8. How long we keep your data
We keep personal data only for as long as necessary for the purposes for which it was collected and to comply with applicable legal obligations.
- Accounting records, financial statements, and ledgers — retained for the periods required under applicable Finnish accounting legislation. Certain accounting records are generally required to be retained for at least 10 years.
- Vouchers, transaction-related correspondence, and other accounting materials — generally retained for at least 6 years, subject to applicable Finnish accounting requirements.
- Order and transaction data — retained as necessary to fulfil your order and thereafter for accounting, tax, consumer protection, warranty, dispute-resolution, and legal purposes.
- Account data — retained while your account remains active and thereafter for a reasonable period where necessary for legal, security, or administrative purposes.
- Marketing data — retained until you unsubscribe, withdraw your consent, or the information is no longer required for the relevant marketing purpose. We may retain limited information necessary to respect an unsubscribe request.
- Customer service correspondence — retained for as long as reasonably necessary to resolve your request and thereafter where required for legal, contractual, or dispute-resolution purposes.
- Cookies and analytics data — retained according to the retention periods applicable to the relevant cookies and technologies, as described through our Cookie settings or Cookie Policy.
We may retain information for a longer period where required by law or where reasonably necessary to establish, exercise, or defend legal claims.
9. Your rights
Under the GDPR, subject to applicable requirements and limitations, you have the right to:
- access the personal data we process about you;
- request rectification of inaccurate or incomplete personal data;
- request erasure of your personal data where the legal requirements for erasure are met;
- request restriction of processing in certain circumstances;
- object to processing based on our legitimate interests;
- object to direct marketing at any time;
- receive certain personal data in a structured, commonly used, and machine-readable format (data portability); and
- withdraw consent at any time where processing is based on consent — withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
To exercise any of these rights, contact us at info@playartproductions.com.
We may need to verify your identity before fulfilling your request.
We will respond without undue delay and, in principle, within one month of receiving a valid request, as required by the GDPR. This period may be extended where permitted by law for particularly complex or numerous requests.
10. Right to lodge a complaint
If you believe that we have processed your personal data unlawfully, you have the right to lodge a complaint with a competent data protection supervisory authority.
In Finland, the supervisory authority is:
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Postal address:
PO Box 800
00531 Helsinki
Finland
Tel. +358 29 566 6700
Website: tietosuoja.fi
You may also have the right to lodge a complaint with the supervisory authority in the EU or EEA country where you live, work, or where you believe an infringement has occurred.
11. Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.
Certain payment, security, or fraud-prevention service providers may use automated systems as part of their services. Where those providers independently determine the purposes and means of such processing, their own privacy notices apply.
12. Cookies
We use cookies and similar technologies to operate the website and, subject to your choices and applicable law, to measure website performance and support analytics or marketing functionality.
Cookies that are strictly necessary for the operation of the store may be used without consent where permitted by law.
Where consent is required, analytics, advertising, and other non-essential cookies will not be activated until you have made the relevant choice.
You can review or change your cookie preferences through the Cookie settings option available on our website.
For additional information about the cookies and similar technologies we use, see our Cookie Policy, where available.
13. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our services, technology, processing activities, legal requirements, or business practices.
The current version will always be available on this page, with the "last updated" date shown at the top.
Where required by applicable law, we will provide additional notice of material changes.
14. Contact
For questions about this Privacy Policy, our processing of personal data, or to exercise your data protection rights, contact:
Playart Production Oy Ab
PL 64
00101 Helsinki
Finland
Email: info@playartproductions.com