Privacy Policy

 

Updated 16 September 2026

This Privacy Policy explains how Steely Partners Oy processes personal data in the Steely Pop retailer online store (Steely Pop Retailers) and related services.

This Policy applies to visitors to the online store, entrepreneurs applying to become retailers, contacts at retailer businesses and users of the online store.

 

Data controller and contact details

Steely Partners Oy
Business ID: 3343734-8

Hormistontie 2
29180 Eurajoki
Finland

Email: info@steelypop.fi

 

What personal data do we process?

Depending on how you interact with us, we may process the following data:

  • the name, email address and other contact details of the applicant and contact person provided when interacting with us

  • company name, business ID, VAT identification number, and address, billing and delivery details

  • information provided in the retailer application, correspondence relating to the application and information about the processing of the application

  • customer account details and purchase history

  • information relating to orders, invoicing, payments, deliveries and complaints

  • messages you send to customer service

  • marketing consents, direct marketing opt-outs and other communication preferences

  • technical data generated through the use of the online store, such as your IP address, browser and device information, data about how you use the site, and cookie preferences.

Information relating to a company may constitute personal data, for example when the company is operated by a sole trader.

 

Where do we obtain the data?

We obtain the data primarily from you or the company you represent when you apply to become a retailer, use a customer account, place an order or contact us.

Retailer applications are stored in the Pify form service. When an application is approved, the data required to manage the customer relationship is also stored in the Shopify online store so that a customer account can be created.

When processing an application, we review the company's publicly available website and verify the validity of its VAT identification number using an official validation service. Technical data is generated through the use of cookies and similar technologies when you use the online store.

Processing an application and fulfilling orders require you to provide the necessary contact, company, billing and delivery details. Without this information, we may be unable to process the application or deliver the order.

 

For what purposes and on what legal bases do we use the data?

We process personal data for the following purposes:

  • Assessing applications and managing customer relationships. The processing is based on our legitimate interest in assessing the suitability of retailers, maintaining customer accounts and communicating with business customers.

  • Orders, invoicing, deliveries and customer service. The processing of business contact persons' data is based on our legitimate interest in fulfilling orders and managing payments, deliveries and complaints. If you are personally a party to the contract, for example as a sole trader, the necessary processing is based on the performance of the contract or on taking steps at your request before entering into a contract.

  • Accounting and taxation. The processing is based on compliance with our legal obligations, including determining and documenting the basis for the applicable tax treatment.

  • Security and the protection of legal rights. The processing is based on our legitimate interest in protecting the online store and customer accounts, preventing misuse, and establishing, exercising and defending legal claims.

  • Electronic marketing. The processing is based on our legitimate interest in marketing our products to business customers where marketing messages may lawfully be sent without prior consent. Where consent is required, the processing is based on the consent you have given.

  • Cookies and tracking technologies that require consent. The processing is based on the consent you provide through the cookie settings.

When processing is based on legitimate interests, we take your rights and reasonable expectations into account. You may object to the processing as described below.

A human makes the decision to approve or reject a retailer application. Decisions on applications are not based solely on automated processing.

Newsletters and other electronic marketing

We may send retailers information by email about matters such as new products, our product range and special offers.

We send marketing messages without a separate newsletter subscription only where permitted by applicable law. We take into account the recipient's role, the customer relationship and the electronic marketing requirements of the recipient's country. Where consent is required, we send marketing messages only to recipients who have given their consent.

You may opt out of electronic direct marketing at any time and free of charge by following the instructions in the message or by contacting us at info@steelypop.fi. Where marketing is based on your consent, you may withdraw your consent in the same way.

Opting out of marketing does not prevent us from sending messages that are necessary for managing orders, invoicing, deliveries, product safety or your customer account.

 

Cookies and similar technologies

The online store uses cookies that are strictly necessary for its operation, for example to enable login and shopping cart functions, maintain security and remember cookie preferences.

We use the TinyCookie app to manage cookie preferences. We request your consent for non-essential cookies and similar tracking technologies.

You can accept or reject non-essential cookies and change your choices in the online store's cookie settings. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Shopify and Shopify Network Intelligence

Our retailer online store is hosted on the Shopify platform. Shopify processes personal data for purposes including the technical operation of the online store, customer accounts, order processing and security.

Shopify Network Intelligence is enabled for this online store. It allows Shopify to combine data about your activity in this online store with data generated through your use of other Shopify stores and Shopify services. The data may be used for purposes such as developing services, improving security, personalising the shopping experience and providing targeted advertising. Processing that requires consent is based on your consent choices.

Shopify acts as a processor on our behalf when providing online store services. For certain services that Shopify provides in its own capacity, such as services based on Network Intelligence, Shopify acts as a separate controller.

Data may be shared with Shopify and its service providers and may also be processed outside the EU and the EEA.

For more information, please see the Shopify Consumer Privacy Policy and the Shopify Privacy Portal. In the portal, you can exercise your rights in relation to data that Shopify processes as a controller, for example by requesting the deletion of your data or objecting to its use for advertising. For matters concerning data that we process, you can contact us directly.

 

Who do we share the data with?

Service providers process personal data to the extent necessary to provide their services. These include:

  • Shopify and providers of technical services for the online store

  • the service used to process application forms

  • invoicing, e-invoicing, accounting and financial administration services

  • carriers and services used to process shipments

  • email service providers

  • the service used to manage cookie preferences.

Processors acting on our behalf are required to process the data in accordance with our instructions. Some recipients also act as independent controllers in relation to their own legal obligations or services. Shopify's role is described above.

Data may be disclosed to public authorities where required by law and to parties responsible for debt collection or handling legal claims where necessary for the matter in question.

Transfers of data outside the EU and the EEA

Some service providers may process personal data outside the EU and the EEA. In connection with Shopify's services, for example, data may be processed in Canada and Singapore, as well as in the countries where Shopify's subcontractors operate.

Processing outside the EU and the EEA is subject to the transfer requirements of applicable data protection law. Depending on the circumstances, Shopify relies on European Commission adequacy decisions or Standard Contractual Clauses approved by the European Commission, together with any necessary supplementary safeguards, as the legal basis for its transfers. Further information is available in the Shopify Data Processing Addendum.


How long do we retain the data?

We retain personal data for as long as necessary for the purposes for which it is used, as follows:

  • Retailer applications: For approved applications, we retain the data necessary to manage the customer relationship. Personal data relating to rejected applications is deleted no later than six months after the decision, unless an ongoing matter or legal claim requires the necessary data to be retained for longer.

  • Customer accounts and contact persons: We retain data to manage the customer relationship. If two years have passed since the last order or other interaction relating to the customer relationship, we review whether the data still needs to be retained. If there is no justified need to continue the customer relationship or retain the data, we close the account and delete any personal data that is no longer necessary.

  • Routine customer service messages: These are deleted no later than 12 months after the matter has been concluded, unless the message is required, for example, for accounting purposes or to handle a complaint or legal claim.

  • Complaints and legal claims: We retain the necessary data for as long as required to handle the matter and for the applicable limitation periods.

  • Invoices and accounting records: Accounting vouchers are retained for at least six years from the end of the year in which the financial year ended. Financial statements and other accounting material subject to a ten-year retention obligation are retained for at least ten years after the end of the financial year.

  • Marketing data: We use the data for marketing for as long as there is an appropriate legal basis for doing so, unless you opt out of marketing or withdraw your consent. We may retain the information necessary to ensure that your opt-out is respected.

  • Technical data and cookies: The retention period depends on the purpose for which the data is used and the technology used. Session cookies are temporary, while persistent cookies remain stored for their period of validity or until you delete them. Data required to maintain security and investigate incidents is retained for as long as necessary for these purposes.

Closing a customer account does not affect statutory retention obligations. Where such obligations apply, we retain only the data necessary to comply with them.

 

Your rights

Depending on the circumstances, you have the right to:

  • receive information about the processing of your personal data, access your data and obtain a copy of it

  • request the rectification of inaccurate or incomplete data

  • request the erasure of your data or restriction of its processing

  • object to processing based on legitimate interests on grounds relating to your particular situation

  • object to direct marketing at any time without giving any specific reason

  • receive the data you have provided to us in a portable format where the processing is based on consent or a contract and is carried out by automated means

  • withdraw your consent at any time.

Not all data can be erased where its retention is required, for example, under accounting legislation. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

You can exercise your rights by contacting us at info@steelypop.fi. Where necessary, we may request additional information to verify your identity. We will respond without undue delay, usually within one month. If processing your request requires an extension permitted by law, we will inform you of the extension and the reasons for it within the first month.

You have the right to lodge a complaint with the Data Protection Ombudsman's Office or another competent data protection supervisory authority, for example the authority in the EU country of your habitual residence or place of work. You may also contact us so that we can investigate the matter.

 

Data security

We protect personal data using appropriate technical and organisational measures. Access to the data is restricted to individuals and service providers who need it to perform their duties.

 

Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our operations, services or applicable law. The current version will be published on this page. Where necessary, we will also provide separate notice of material changes affecting the processing of personal data. If new processing requires consent, we will request your consent before the processing begins.