Privacy Policy
Updated: 2 August 2026
1. General
When you use the Kalaluvat.net service, we process your personal data — for example when you purchase products, create a user account, visit our website or contact us.
Data controller: Noretki Oy Business ID: 3610366-9 Lohilantie 1 B, 37550 Lempäälä, Finland Email: info@kalaluvat.net
If you have any questions about this privacy policy or the processing of your personal data, you can contact us at the email address above.
2. What data we process, for what purposes and on what legal basis
2.1 Purchasing products
When you purchase products through the Kalaluvat.net service, we process the personal data necessary to fulfil your order. We typically process your contact details, such as your name, email address, phone number and address, as well as information related to the order and payment. You can also purchase a product for another person, in which case we also process the recipient's contact details in order to deliver the order.
The legal basis for this processing is that it is necessary for the performance of the purchase contract (Article 6(1)(b) GDPR).
2.2 User account
Your user account is personal. By creating an account or placing an order, you enter into a contract with us for the use of the service. The account makes purchasing easier and allows you to manage your order history. You can also sign in to the service with a Google or Microsoft account, in which case we receive your name and email address from that provider.
The legal basis for this processing is the performance of a contract (Article 6(1)(b) GDPR).
2.3 Payment processing
Payments are processed by our payment service provider Stripe Inc., which acts as an independent data controller for payment data. Card details are entered directly with Stripe — we do not see or store your full card number. More information about Stripe's privacy practices: stripe.com/privacy.
The legal basis for this processing is the performance of a contract (Article 6(1)(b) GDPR).
2.4 Permit validation
The QR codes attached to permits allow a seller organisation or an authorised party to verify that a permit is valid. This is necessary to enable seller organisations to carry out their supervisory activities.
The legal basis for this processing is a legitimate interest (Article 6(1)(f) GDPR).
2.5 Customer service and contacts
When you contact us, we process the information you provide in order to respond to your enquiry. Information submitted through the contact form is not stored in a database; it is sent by email to our customer service.
The legal basis for this processing is our legitimate interest in providing customer service (Article 6(1)(f) GDPR).
2.6 Management of seller organisations
Seller organisations can join the Kalaluvat.net service to sell their products. We process the details of these organisations and their contact persons to enable the management of the organisations and their sales.
Seller organisations can see the details of the buyers of their own products in order to fulfil their obligations as sellers.
The legal basis for this processing is the performance of a contract (Article 6(1)(b) GDPR).
2.7 Service security
We process technical data to maintain the security of the service and to prevent misuse. The legal basis for this processing is a legitimate interest (Article 6(1)(f) GDPR).
2.8 Analytics
We use Google Analytics 4 (provided by Google Ireland Limited) to measure how the website is used and to develop the service. Measurement starts only if you give your consent in the cookie banner — without consent, no cookies are stored and no measurement data is sent in an identifiable form (Consent Mode v2).
We collect, among other things, the following data: anonymised IP address, browser and device information, website usage (page paths, clicks, purchase funnel) and, for signed-in users, an internal user identifier (the Kalaluvat service ID, not your email or name), user role, organisation identifier and language preference. We do not send Google your name, email address, phone number, payment details or other personal data.
The data is retained in Google Analytics for 14 months, after which it is deleted automatically. We do not share the data with advertisers or use it for targeted advertising.
You can withdraw your consent at any time via the "Cookie Settings" link at the bottom of the website, in which case measurement stops immediately. You can also block Google Analytics with the Google Analytics Opt-out browser add-on.
The legal basis for this processing is consent (Article 6(1)(a) GDPR). More information: Google Privacy Policy.
2.9 Legal obligations
We retain order and payment data for the period required by the Finnish Accounting Act (1336/1997). The legal basis for this processing is a legal obligation (Article 6(1)(c) GDPR).
2.10 Prevention of money laundering
Anti-money laundering legislation requires us to monitor payment transactions in the service. For this purpose, we store the IP address of your device in connection with a purchase. The legal basis for this processing is a legal obligation (Article 6(1)(c) GDPR), and we retain this data for 5 years.
3. Who we share your data with
Noretki Oy may disclose personal data to other recipients to the extent necessary to provide the service. These may include, for example, payment service providers, analytics providers, email service providers, server infrastructure providers and seller organisations, which receive the necessary details of the buyers of the products they sell in order to fulfil their obligations as sellers.
We do not sell or disclose your personal data to third parties for marketing purposes.
4. Transfers of data outside the EU/EEA
As a rule, we process and store your personal data within the EU/EEA. The use of some service providers may result in data being transferred outside the EU/EEA (for example to the United States). In such cases, we ensure that appropriate safeguards are in place, such as an adequacy decision by the European Commission (the EU-U.S. Data Privacy Framework) or standard contractual clauses (SCCs).
5. Retention and deletion
We delete the data related to your user account when your account is deleted. Order and payment data is retained for 6 years in accordance with the requirements of the Finnish Accounting Act, after which it is deleted or anonymised. Data referred to in section 2.10 is retained for 5 years.
You can request access to your personal data and its deletion by contacting us.
6. Security of processing
We protect personal data with appropriate technical and organisational measures. Access to personal data is limited to personnel who need it for their work.
7. Your rights
Below is a summary of your rights under the GDPR:
Right of access: If you want to know what personal data we have stored about you, you can contact us. You can also view your profile details and order history by signing in to the service. The right of access is limited in certain situations provided for in anti-money laundering legislation.
Right to rectification: If you notice that we have incorrect information about you, you can correct it on your profile page or by contacting us.
Right to erasure and restriction of processing: You have the right to request the deletion of your personal data or the restriction of its use. We will fulfil your request where possible, but we cannot do so if the law requires us to retain certain data, for example for accounting purposes.
Right to data portability: You have the right to receive the personal data you have provided in a structured, machine-readable format.
Right to object: You have the right to object to the processing of your personal data where the processing is based on a legitimate interest.
Right to withdraw consent: Where processing is based on consent (for example analytics cookies), you can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint with the supervisory authority: If you consider that the processing of your personal data is not lawful, you can lodge a complaint with the Office of the Data Protection Ombudsman: tietosuoja.fi.
If you wish to exercise any of the rights above or have any questions, you can contact us by email at info@kalaluvat.net.
8. Cookies
Kalaluvat.net uses cookies to enable the operation and development of the service. We do not use marketing cookies.
Necessary cookies are required for the service to work, for example to keep you signed in and to make the shopping cart function. These cannot be disabled.
Functional cookies improve the user experience. For example, the map view is loaded only after you accept functional cookies via the cookie banner.
Analytics cookies (Google Analytics 4) collect anonymous usage data for the development of the service. Analytics cookies are set only after you accept them via the cookie banner.
You can manage your cookie preferences at any time via the cookie banner.
9. Updates and changes
We will announce material changes on the service's website.