Privacy Policy

This is the online store's privacy policy in accordance with the EU General Data Protection Regulation (GDPR). Prepared: October 1, 2026. Last modified: October 1, 2026.

1. Data Controller

• Company name: Musiikkipalveluyhtymä Kari Kangasluoma ja Anu Koskimaa (Arctic Stageworks)

• Business ID (Y-tunnus): 3651195-3

• Address: Tallikuja 10, 91500 Muhos, Finland

• Email: kari@kangasluoma.com

2. Contact Person for Data Protection Matters

Same as above

3. Name of the Register

• Customer and order register of the online store.

4. Legal Basis and Purpose of Processing Personal Data

The processing of personal data is based on the contract between the data controller and the customer (an order from the online store) as well as statutory obligations (such as the Accounting Act).

The data is used for:

• Processing, delivering, and archiving orders.

• Verifying payment transactions and invoicing.

• Managing the customer relationship and communication.

• Marketing and sending newsletters (provided that the customer has given their consent).

5. Data Content of the Register

Only data that is essential for managing orders and the customer relationship is collected in the register:

• First and last name

• Street address, postal code, and city/town

• Phone number

• Email address

• Order details (purchased products, price, time of order, and delivery method)

• Payment transaction details (no card details; these go directly to the payment processor)

• IP address and cookie data (for analytics)

6. Regular Sources of Data

Data is collected solely from the customer themselves during the process of placing an order, registering, or subscribing to the newsletter.

7. Regular Disclosures of Data and Transfer Outside the EU or EEA

Data is disclosed to third parties only to the extent necessary to fulfill the order:

• Logistics companies: Posti, so that the package can be delivered.

• Payment processors: Stripe, to ensure the payment can be processed securely.

• Accountant: Invoicing details for accounting purposes.

Data is not transferred outside the EU or the EEA.

8. Principles of Register Protection

Data is processed confidentially. The online store is protected with SSL encryption (HTTPS). The digital system and management panel can only be accessed by employees or partners of the data controller whose work duties require it. The system is protected by usernames and passwords.

9. Retention Period of Data

Personal data is retained for as long as necessary to manage the customer relationship. Material related to accounting (such as order history) is retained for the period required by the Finnish Accounting Act (generally 6 years after the end of the financial year).

10. Rights of the Data Subject

The customer has the right to:

• Inspect the data stored about themselves in the register.

• Request the correction of incorrect or outdated data.

• Request the erasure of their data ("the right to be forgotten"), unless otherwise provided by law (e.g., the Accounting Act).

• Withdraw their consent for direct marketing (unsubscribe from the newsletter).

Requests regarding these rights must be sent in writing to the email address mentioned in section 1.